Function at 0x441020
Capabilities:
Identify system language via api
Open clipboard
Query or enumerate registry value
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x50], eax
mov esi, dword [0x4be784]
xor eax, eax
push ebp
push 0x441ef0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [esi + 0x100]
mov eax, dword [0x4bedb0]
call fcn.004b81b0
push 0x441f00
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4bedb0]
call fcn.004b8404
mov edx, dword [0x4beae0]
mov dword [edx], eax
lea edx, [esi + 0x200]
mov eax, dword [0x4bedb0]
call fcn.004b81b0
push 0x441f0c
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4bedb0]
call fcn.004b8404
mov edx, dword [0x4be880]
mov dword [edx], eax
mov eax, dword [0x4be880]
mov eax, dword [eax]
mov ecx, 0x8000000
mov edx, 0x80000000
call fcn.004adc9c
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4410f7
push 0x1770
mov eax, dword [0x4be9d0]
push eax
push ebx
call sub.kernel32.dll__lread
cmp eax, 0x1770
jae 0x4410ef
mov edx, dword [0x4be880]
mov edx, dword [edx]
mov ax, 2
call fcn.004acdac
push ebx
call sub.kernel32.dll_CloseHandle_1
jmp 0x44110b
mov eax, dword [0x4be9d0]
mov ecx, 0xff
mov edx, 0x1770
call fcn.00402ff0
mov eax, dword [0x4bece0]
mov byte [eax], 1
mov eax, dword [0x4bee0c]
mov dword [eax], 0xffffffff
mov ax, 0x4b
call fcn.004aa600
lea edx, [esi + 0x100]
call fcn.004ae1b0
mov eax, dword [0x4be728]
push eax
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4bedb0]
call fcn.004b8404
mov edx, dword [0x4beaa8]
mov dword [edx], eax
mov eax, dword [0x4be374]
mov edx, 0x11
call fcn.004066e4
mov edx, dword [0x4be82c]
mov eax, dword [0x4be374]
call fcn.004b81b0
push 0
mov ecx, dword [0x4be374]
mov edx, dword [fcn.00407928]
xor eax, eax
call fcn.00407c1c
mov ebx, eax
push 0
mov edx, dword [0x4bea10]
mov eax, ebx
mov ecx, 0x1e
call fcn.00407d08
mov eax, ebx
call fcn.00407c44
push 0
mov edx, dword [0x4bea00]
mov eax, ebx
mov ecx, 0x6c
call fcn.00407d08
mov eax, ebx
call fcn.00407c44
push 0
mov edx, dword [0x4bea18]
mov eax, ebx
mov ecx, 9
call fcn.00407d08
mov eax, ebx
call fcn.00407c44
push 0
mov edx, dword [0x4be804]
mov eax, ebx
mov ecx, 0xc
call fcn.00407d08
mov eax, ebx
call fcn.00407c44
push 0
mov edx, dword [0x4bec2c]
mov eax, ebx
mov ecx, 9
call fcn.00407d08
mov eax, dword [0x4be374]
mov edx, 0x11
call fcn.004066e4
mov edx, 0x2c
mov eax, ebx
call fcn.00402524
mov bl, 0x10
mov edi, dword [0x4be4c8]
mov eax, pe_nt_image_headers32
call fcn.00403010
mov byte [edi], al
inc edi
dec bl
jne 0x44122e
lea edx, [esi + 0x100]
mov eax, 0x441f20
call fcn.004ae1b0
mov eax, dword [0x4bedb0]
call fcn.004b8404
mov edx, dword [0x4bead4]
mov dword [edx], eax
lea edx, [esi + 0x100]
mov eax, 0x441f30
call fcn.004ae1b0
mov eax, dword [0x4bedb0]
call fcn.004b8404
mov edx, dword [0x4bec60]
mov dword [edx], eax
push 0xffffffffffffffff
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.shell32.dll_DragAcceptFiles
push 0x11
call sub.gdi32.dll_GetStockObject
mov edi, eax
push 0
call sub.user32.dll_GetDC
mov ebx, eax
push edi
push ebx
call sub.gdi32.dll_SelectObject
mov dword [ebp - 8], eax
lea eax, [ebp - 0x4c]
push eax
push ebx
call sub.gdi32.dll_GetTextMetricsA
mov ax, word [ebp - 0x38]
inc eax
mov edx, dword [0x4be990]
mov word [edx], ax
mov eax, dword [0x4be890]
mov dx, word [ebp - 0x4c]
mov word [eax], dx
push 0xc
call sub.gdi32.dll_GetStockObject
push eax
push ebx
call sub.gdi32.dll_SelectObject
lea eax, [ebp - 0x4c]
push eax
push ebx
call sub.gdi32.dll_GetTextMetricsA
mov al, byte [ebp - 0x4c]
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.gdi32.dll_SelectObject
push ebx
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [0x4bedec]
cmp byte [eax], 0
je 0x4413a9
push 0
push 0x31
push 2
push 0
push 0
push 0xff
push 0
push 0
push 0
push 0x190
push 0
push 0
push 9
push 0x10
call sub.gdi32.dll_CreateFontA
mov edx, dword [0x4be8b8]
mov dword [edx + 4], eax
cmp byte [ebp - 0xd], 0xd
ja 0x441350
mov eax, dword [0x4bef14]
cmp byte [eax], 2
jbe 0x441397
push 0x441f40
push 0x22
push 2
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64
push 0
push 0
push 0
mov eax, dword [0x4bef14]
cmp byte [eax], 2
seta al
and eax, 0x7f
add eax, 0xe
push eax
call sub.gdi32.dll_CreateFontA
mov edx, dword [0x4be8b8]
mov dword [edx + 8], eax
mov eax, dword [0x4be9b4]
mov byte [eax], 1
jmp 0x4413c1
push 0xc
call sub.gdi32.dll_GetStockObject
mov edx, dword [0x4be8b8]
mov dword [edx + 8], eax
jmp 0x4413c1
push 0xa
call sub.gdi32.dll_GetStockObject
mov edx, dword [0x4be8b8]
mov dword [edx + 4], eax
mov eax, dword [0x4be8b8]
mov dword [eax + 8], edi
call sub.kernel32.dll_GetUserDefaultLangID
cmp ax, 0x324
mov eax, dword [0x4bee30]
sete byte [eax]
push 0xff
mov eax, dword [0x4bedb0]
push eax
mov eax, dword [0x4bf704]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
mov eax, dword [0x4bedb0]
push eax
call sub.gdi32.dll_AddFontResourceA
push 0x1000
push 0
push 0
push 0
push 1
mov eax, dword [0x4bf704]
push eax
call sub.user32.dll_LoadImageA
mov edx, dword [0x4be4c0]
mov dword [edx], eax
lea eax, [esi + 0x16a0]
push eax
call sub.gdi32.dll_CreateFontIndirectA
mov edx, dword [0x4be8b8]
mov dword [edx], eax
mov eax, dword [0x4be9b4]
cmp byte [eax], 0
je 0x441443
push 0x11
call sub.gdi32.dll_GetStockObject
mov edx, dword [0x4be8b8]
mov dword [edx + 0xc], eax
jmp 0x441470
push 0x441f48
push 0
push 2
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64
push 0
push 0
push 0
push 0x12
call sub.gdi32.dll_CreateFontA
mov edx, dword [0x4be8b8]
mov dword [edx + 0xc], eax
mov eax, dword [0x4bea18]
call fcn.004b1c50
lea eax, [ebp - 0x50]
mov edx, dword [0x4bedb0]
mov ecx, 0x22c
call fcn.00404b04
mov edx, dword [ebp - 0x50]
xor eax, eax
call fcn.00440ea0
mov eax, dword [0x4bee68]
cmp byte [eax], 4
jae 0x4414af
mov byte [esi + 0x185a], 0
mov byte [esi + 0x185b], 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x4bed8c]
mov eax, dword [eax]
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyA
mov eax, dword [0x4be6b0]
mov dword [eax], 0xff
mov eax, dword [0x4be6b0]
push eax
mov eax, dword [0x4bedb0]
push eax
push 0
push 0
push 0x441f58
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x441514
push 0x441f60
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4bedb0]
call fcn.004b8404
mov edx, dword [0x4bebe0]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [esi + 0x192d], 0
jne 0x4415f0
mov byte [esi + 0x192d], 1
mov dword [esi + 0x1798], 0xe90000
mov byte [esi + 0x192f], 1
mov byte [esi + 0x192c], 1
push 0x441f6c
push 0x441f74
push 0
mov ax, 0x2e6
call fcn.004aa600
mov edx, eax
mov ecx, dword [0x4be9a0]
mov eax, dword [0x4bef44]
call fcn.004af51c
mov ax, 0xb
call fcn.004aa600
mov edx, eax
mov eax, dword [0x4beb38]
call fcn.004b81b0
mov eax, dword [0x4beb38]
call fcn.004b8144
mov edx, dword [0x4beb38]
mov byte [edx + eax - 3], 0
mov eax, dword [0x4beb38]
mov dl, 0x26
call fcn.004aec2c
push eax
push 0x441f74
push 1
mov ax, 0x2e6
call fcn.004aa600
mov edx, eax
mov ecx, dword [0x4be9a0]
mov eax, dword [0x4bef44]
call fcn.004af51c
push 0x441f6c
push 0x441f78
push 0
mov ax, 0xac
call fcn.004aa600
mov edx, eax
mov ecx, dword [0x4be5a4]
mov eax, dword [0x4bebf0]
call fcn.004af51c
cmp dword [esi + 0x19c8], 0
jne 0x441603
mov dword [esi + 0x19c8], 0xa
cmp word [esi + 0x17bc], 0
jne 0x441616
mov word [esi + 0x17bc], 0x19
cmp byte [esi + 0x1d7a], 0
jne 0x44166a
mov byte [esi + 0x1d7a], 1
mov byte [ebp - 0xe], 3
lea edi, [esi + 0x1d7e]
lea ebx, [esi + 0x1d83]
lea eax, [esi + 0x1de6]
mov dword [ebp - 0x14], eax
mov byte [edi], 0xff
mov edx, 0x441f7c
mov eax, ebx
call fcn.004b81b0
mov eax, dword [ebp - 0x14]
mov byte [eax], 1
inc dword [ebp - 0x14]
add ebx, 0x21
add edi, 2
dec byte [ebp - 0xe]
jne 0x44163f
mov eax, dword [0x4be580]
mov byte [eax], 1
mov al, byte [esi + 0x859]
test al, al
je 0x441678
cmp al, 0x2a
jne 0x441692
mov edx, 0x441f80
lea eax, [esi + 0x859]
call fcn.004b81b0
mov dword [esi + 0x16f4], 1
cmp word [esi + 0x1dea], 0
je 0x4416a6
cmp word [esi + 0x1df8], 0
jne 0x4416cd
mov byte [ebp - 0xe], 8
mov eax, dword [0x4befa0]
mov dword [ebp - 0x14], eax
lea ebx, [esi + 0x1dea]
mov eax, dword [ebp - 0x14]
mov ax, word [eax]
mov word [ebx], ax
add ebx, 2
add dword [ebp - 0x14], 2
dec byte [ebp - 0xe]
jne 0x4416b8
mov byte [esi + 0x19cf], 1
mov al, byte [esi + 0x19dd]
cmp al, 1
jb 0x4416e2
cmp al, 3
jbe 0x4416e9
mov byte [esi + 0x19dd], 1
cmp word [esi + 0x1e1c], 0
jne 0x441722
mov eax, dword [0x4bef14]
cmp byte [eax], 6
jae 0x441709
mov eax, dword [0x4beee0]
mov word [eax], 0x10
jmp 0x441713
mov eax, dword [0x4beee0]
mov word [eax], 0x20
mov eax, dword [0x4beee0]
mov ax, word [eax]
mov word [esi + 0x1e1c], ax
mov ax, word [esi + 0x19cc]
cmp ax, 0x28
jb 0x441735
cmp ax, 0xfa
jbe 0x44173e
mov word [esi + 0x19cc], 0x6e
cmp dword [esi + 0x170c], 0
jne 0x441776
xor eax, eax
mov dword [esi + 0x1704], eax
mov dword [esi + 0x1708], 0x64
mov eax, dword [0x4be9cc]
mov eax, dword [eax]
mov dword [esi + 0x170c], eax
mov eax, dword [0x4beb7c]
mov eax, dword [eax]
sub eax, 0x64
mov dword [esi + 0x1710], eax
cmp byte [esi + 0x241f], 0
jne 0x44178f
mov edx, 0x441f84
lea eax, [esi + 0x241f]
call fcn.004b81b0
cmp byte [esi + 0x243f], 0
jne 0x4417a8
mov edx, 0x441f90
lea eax, [esi + 0x241f]
call fcn.004b81b0
cmp byte [esi + 0x201f], 1
jne 0x4417b8
mov byte [esi + 0x201f], 0
movzx eax, word [esi + 0x1e1c]
mov edx, pe_nt_image_headers32
call fcn.004aa570
mov edx, dword [0x4beee0]
mov word [edx], ax
mov al, byte [esi + 0x190c]
mov edx, dword [0x4be9d4]
mov byte [edx + 0xd], al
xor eax, eax
mov al, byte [esi + 0x188c]
inc eax
push eax
mov eax, dword [0x4bf704]
push eax
call sub.user32.dll_LoadMenuA
mov edx, dword [0x4bed90]
mov dword [edx], eax
xor eax, eax
mov al, byte [esi + 0x188c]
inc eax
push eax
mov eax, dword [0x4bf704]
push eax
call sub.user32.dll_LoadMenuA
mov edx, dword [0x4be75c]
mov dword [edx], eax
mov eax, dword [0x4be75c]
cmp dword [eax], 0
jne 0x441834
mov eax, dword [0x4bed90]
mov eax, dword [eax]
mov edx, dword [0x4be75c]
mov dword [edx], eax
mov ax, 0x377
call fcn.004aa600
mov dl, 0x26
call fcn.004b8284
inc eax
mov al, byte [eax]
call fcn.00402880
mov edx, dword [0x4be30c]
mov byte [edx], al
mov ax, 0x378
call fcn.004aa600
mov dl, 0x26
call fcn.004b8284
inc eax
mov al, byte [eax]
call fcn.00402880
mov edx, dword [0x4be834]
mov byte [edx], al
mov eax, dword [0x4bed90]
mov eax, dword [eax]
push eax
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetMenu
cmp word [esi + 0x17be], 0
jne 0x4418b1
mov eax, dword [0x4bef14]
cmp byte [eax], 3
jbe 0x4418a8
mov word [esi + 0x17be], 0xc8
jmp 0x4418b1
mov word [esi + 0x17be], 0xa1
cmp byte [esi + 0xa3b], 0
je 0x4418ca
mov ax, word [esi + 0x17be]
mov edx, dword [0x4be588]
mov word [edx], ax
call fcn.00428b0c
call fcn.00442374
cmp byte [esi + 0x198b], 0
jne 0x441907
mov eax, dword [0x4bee68]
cmp byte [eax], 6
jne 0x441907
cmp byte [esi + 0xa3b], 0
je 0x4418f9
cmp byte [esi + 0x18b9], 0
jne 0x441907
mov byte [esi + 0x198b], 1
mov byte [esi + 0x1e1e], 0
cmp byte [esi + 0x1e1e], 0
jne 0x4419e3
mov eax, dword [0x4be7e4]
cmp byte [eax], 0
jne 0x4419e3
call fcn.00402780
test eax, eax
jne 0x4419e3
mov eax, dword [0x4bee68]
cmp byte [eax], 6
je 0x44195a
mov eax, dword [0x4bee68]
cmp byte [eax], 0
jne 0x4419b1
mov ax, 0x34f
call fcn.004aa600
mov edx, 2
call fcn.004b12a8
cmp al, 1
jne 0x4419b1
mov byte [esi + 0xa3b], 1
mov byte [esi + 0x193a], 1
mov byte [esi + 0x19dd], 2
mov byte [esi + 0x18e8], 7
mov byte [esi + 0x18b9], 1
mov eax, dword [0x4bef14]
cmp byte [eax], 3
ja 0x44199b
cmp word [esi + 0x17ba], 0xaf
jl 0x44199b
mov word [esi + 0x17ba], 0xaf
push 0
push 0x3e8
push 6
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetTimer
mov word [esi + 0x17be], 0
push 0x441f6c
push 0x441f78
push 0
mov ecx, dword [0x4be554]
mov edx, dword [0x4bebd8]
mov eax, dword [0x4beba0]
call fcn.004af51c
mov byte [esi + 0x1e1e], 1
push 0x441f9c
call sub.user32.dll_RegisterClipboardFormatA
mov edx, dword [0x4bec08]
mov dword [edx], eax
push 0x441fa8
call sub.user32.dll_RegisterClipboardFormatA
mov edx, dword [0x4bea20]
mov dword [edx], eax
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x441a76
mov eax, dword [0x4bea20]
mov eax, dword [eax]
push eax
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x441a71
mov eax, dword [0x4bea20]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetClipboardData
mov edx, dword [0x4be370]
mov dword [edx], eax
mov eax, dword [0x4be370]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, dword [0x4beb5c]
mov dword [edx], eax
mov eax, dword [0x4beb5c]
mov eax, dword [eax]
mov eax, dword [eax]
mov edx, dword [0x4be6c4]
mov dword [edx], eax
mov eax, dword [0x4be370]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
push 0x441fbc
call sub.user32.dll_RegisterWindowMessageA
mov edx, dword [0x4be53c]
mov dword [edx], eax
push 0xff
mov eax, dword [0x4beb38]
push eax
push 0x441fcc
push 0x441fd0
push 0x441fd8
call sub.kernel32.dll_GetProfileStringA
test eax, eax
jbe 0x441b15
mov eax, dword [0x4beb38]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00486250
mov edx, eax
mov eax, dword [0x4be598]
call fcn.004b81b0
lea eax, [ebp - 4]
call fcn.00486250
mov edx, eax
mov eax, dword [0x4be598]
add eax, 0x81
call fcn.004b81b0
push 0x441fe0
mov eax, dword [0x4be598]
add eax, 0x81
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 4]
call fcn.00486250
mov edx, eax
mov eax, dword [0x4be598]
add eax, 0x8e
call fcn.004b81b0
xor eax, eax
call fcn.00486a84
mov eax, dword [0x4be350]
cmp byte [eax], 8
jbe 0x441b3e
mov eax, dword [0x4becf4]
mov edx, 0xd7
call fcn.004066e4
mov eax, dword [0x4bebd4]
mov byte [eax], 0
mov eax, dword [0x4bee68]
mov byte [eax], 0
mov eax, dword [0x4be7a4]
mov edx, dword [0x4be750]
mov dword [edx], eax
mov eax, dword [0x4becf4]
mov al, byte [eax + 0xbf]
mov edx, dword [0x4becf4]
xor al, byte [edx + 0xc5]
mov edx, dword [0x4becf4]
xor al, byte [edx + 0xbb]
mov edx, dword [0x4becf4]
xor al, byte [edx + 0xba]
mov edx, dword [0x4becf4]
add edx, 0xb7
cmp dword [edx], 0xe0e0c038
je 0x441b9c
mov edx, dword [0x4becf4]
cmp al, byte [edx + 0xc1]
je 0x441ba8
mov eax, dword [0x4becf4]
mov byte [eax + 0xc5], 0x54
push 1
mov edx, dword [0x4bedf0]
mov edx, dword [edx]
mov eax, dword [0x4be9d4]
xor ecx, ecx
call fcn.004abe40
test al, al
jne 0x441bcb
mov eax, dword [0x4be9d4]
mov byte [eax + 0xc], 0
mov bl, byte [esi + 0x188c]
test bl, bl
jne 0x441c0b
mov eax, dword [0x4bed1c]
push esi
mov esi, eax
lea edi, [ebp - 0x70]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x70]
mov edx, dword [0x4bea0c]
mov cl, 0x20
call fcn.004036bc
mov eax, dword [0x4bed1c]
push esi
lea esi, [ebp - 0x70]
mov edi, eax
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
cmp bl, 2
jne 0x441c46
mov eax, dword [0x4bed1c]
push esi
mov esi, eax
lea edi, [ebp - 0x70]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x70]
mov edx, dword [0x4bea68]
mov cl, 0x20
call fcn.004036bc
mov eax, dword [0x4bed1c]
push esi
lea esi, [ebp - 0x70]
mov edi, eax
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
call fcn.00440b90
push 0
mov eax, dword [0x4bed90]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetSubMenu
mov edx, dword [0x4be544]
mov dword [edx], eax
push 0
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetSubMenu
mov edx, dword [0x4bec80]
mov dword [edx], eax
mov eax, dword [0x4be738]
mov byte [eax], 1
mov eax, dword [0x4be580]
mov byte [eax], 1
mov eax, dword [0x4be904]
mov dword [eax], 0x1c
mov eax, dword [0x4bedb8]
mov dword [eax], 0x1c
movzx eax, word [esi + 0x17bc]
add eax, eax
add eax, 0x21b4
mov ecx, 3
xor edx, edx
div ecx
cmp eax, dword [esi + 0x16f8]
mov eax, dword [0x4be5e0]
sete byte [eax]
call fcn.00402780
test eax, eax
jle 0x441cd5
mov eax, dword [0x4beb10]
mov byte [eax], 0
call fcn.00402780
dec eax
jne 0x441d00
lea edx, [ebp - 0x74]
mov eax, 1
call fcn.004027e0
mov eax, dword [ebp - 0x74]
mov edx, 0x441ff0
call fcn.00404c60
jne 0x441d00
mov al, 1
call fcn.00442f74
cmp dword [esi + 0x176c], 0
jne 0x441d2b
call fcn.004b0054
test al, al
jne 0x441d2b
mov eax, dword [0x4be7e4]
cmp byte [eax], 0
jne 0x441d2b
mov al, 0x10
call fcn.004b0608
mov eax, dword [0x4be9ec]
mov byte [eax], 1
inc dword [esi + 0x176c]
mov eax, dword [0x4bebd4]
cmp byte [eax], 0
jne 0x441d87
mov eax, dword [esi + 0x176c]
mov ecx, 0xe
cdq
idiv ecx
cmp edx, 0xd
jne 0x441d68
mov ax, 0x4c
call fcn.004aa600
mov edx, 3
call fcn.004b12a8
mov al, 4
call fcn.004b0608
cmp dword [esi + 0x176c], 2
jle 0x441d87
push 0
push 0x1b7740
push 2
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetTimer
mov byte [ebp - 0xf], 0
mov eax, dword [0x4beb40]
mov eax, dword [eax + 0x28]
call fcn.004b1c50
call fcn.004b22dc
mov dword [ebp - 0x78], eax
fild dword [ebp - 0x78]
mov eax, dword [0x4be4c4]
fistp qword [eax]
wait
mov eax, dword [0x4be4c4]
fild qword [eax]
fcomp dword [0x441ff8]
fnstsw ax
sahf
jbe 0x441dcf
mov eax, dword [0x4be4c4]
fild qword [eax]
fcomp dword [0x441ffc]
fnstsw ax
sahf
jb 0x441dd3
xor eax, eax
jmp 0x441dd5
mov al, 1
mov edx, dword [0x4bed0c]
mov byte [edx], al
mov eax, dword [0x4bee68]
cmp byte [eax], 6
jne 0x441e46
mov eax, dword [0x4bed0c]
cmp byte [eax], 0
jne 0x441e46
cmp byte [ebp - 0xf], 0
jne 0x441e02
mov al, 0x4e
call fcn.004b0608
mov byte [ebp - 0xf], 1
cmp byte [esi + 0x188c], 0
jne 0x441e22
mov edx, dword [0x4beb40]
mov edx, dword [edx + 0x28]
mov eax, dword [0x4bea90]
mov eax, dword [eax]
call fcn.004ae1b0
jmp 0x441e37
mov edx, dword [0x4beb40]
mov edx, dword [edx + 0x28]
mov eax, dword [0x4bef18]
mov eax, dword [eax]
call fcn.004ae1b0
mov eax, dword [0x4bedb0]
mov edx, 4
call fcn.004b12a8
mov byte [ebp - 0xe], 0xc
mov ebx, dword [0x4beb40]
add ebx, 0x2c
mov eax, dword [0x4bee68]
cmp byte [eax], 6
jne 0x441ec6
mov eax, dword [ebx]
call fcn.004b1c50
call fcn.004b1914
test al, al
jne 0x441eb6
cmp byte [ebp - 0xf], 0
jne 0x441e7e
mov al, 0x4e
call fcn.004b0608
mov byte [ebp - 0xf], 1
cmp byte [esi + 0x188c], 0
jne 0x441e97
mov eax, dword [0x4bea90]
mov eax, dword [eax]
mov edx, dword [ebx]
call fcn.004ae1b0
jmp 0x441ea5
mov eax, dword [0x4bef18]
mov eax, dword [eax]
mov edx, dword [ebx]
call fcn.004ae1b0
mov eax, dword [0x4bedb0]
mov edx, 4
call fcn.004b12a8
jmp 0x441ec6
cmp byte [ebp - 0xe], 0xc
jne 0x441ec6
mov eax, dword [0x4bedb0]
call fcn.004ac35c
inc byte [ebp - 0xe]
add ebx, 4
cmp byte [ebp - 0xe], 0x10
jne 0x441e53
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x441ef7
lea eax, [ebp - 0x74]
call fcn.0040489c
lea eax, [ebp - 0x50]
call fcn.0040489c
ret