Function at 0x1006f195
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x103a82d0], 1
push esi
push edi
jne 0x1006f285
cmp byte [0x10342a77], 1
jne 0x1006f1d3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov byte [0x10342a77], 0
mov dword [0x10342890], eax
jmp 0x1006f8c0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, 0x3e8
xor edx, edx
mov ecx, edi
div ecx
sub eax, dword [0x10342890]
cmp eax, 5
jbe 0x1006f8c0
cmp byte [0x100a6394], 1
je 0x1006f8c0
push 0
call dword [sym.imp.MSVCR100.dll__time64]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
pop ecx
pop ecx
call fcn.10037deb
call esi
xor edx, edx
div edi
mov esi, dword [sym.imp.MSVCR100.dll_rand]
mov dword [0x10342890], eax
call esi
push 5
pop ecx
cdq
idiv ecx
push ecx
push ecx
mov dword [ebp - 0x1c], edx
fild dword [ebp - 0x1c]
fadd dword [0x10342918]
fsub qword [0x1009ad88]
fstp dword [ebp - 0x1c]
fld dword [ebp - 0x1c]
fstp dword [esp + 4]
fldz
fstp dword [esp]
call esi
push 5
cdq
pop ecx
idiv ecx
push ecx
mov dword [ebp - 0x1c], edx
fild dword [ebp - 0x1c]
fadd dword [0x10342914]
fsub qword [0x1009ad88]
fstp dword [ebp - 0x1c]
fld dword [ebp - 0x1c]
fstp dword [esp]
call fcn.1003823d
add esp, 0xc
jmp 0x1006f8c0
push ebx
mov ebx, dword [0x2fb6ac4]
test ebx, ebx
je 0x1006f8bf
mov eax, dword [ebx + 0x1d20]
push 0xd70444
push eax
mov dword [ebp - 4], eax
call fcn.1000631c
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 0x1c], edi
call esi
test edi, edi
je 0x1006f87a
fld dword [ebx + 0x1f60]
mov dword [0x103d27b0], eax
movzx eax, word [edi + 0x14]
mov dword [ebp - 0x18], eax
call fcn.10083f90
mov dword [ebp - 0x10], eax
mov eax, ebx
add eax, 0x1f68
mov dword [ebp - 8], eax
fld dword [eax]
call fcn.10083f90
cmp dword [0x103a81f8], 0
mov dword [ebp - 0xc], eax
jne 0x1006f5ab
cmp byte [0x100a6394], 1
je 0x1006f8bf
mov eax, dword [0x103434f0]
cmp eax, 8
jge 0x1006f32b
mov ecx, ebx
mov ecx, dword [ecx + 0x1d44]
mov dword [eax*4 + 0x10343360], ecx
inc dword [0x103434f0]
jmp 0x1006f40d
mov eax, dword [0x10343360]
mov ecx, 0x10343360
cmp dword [ecx], eax
jne 0x1006f3bd
add ecx, 4
cmp ecx, 0x10343380
jl 0x1006f335
test eax, eax
je 0x1006f35a
cmp eax, 0xff
je 0x1006f35a
cmp eax, 0xfe
jne 0x1006f3bd
xor edi, edi
inc edi
cmp dword [0x10112374], edi
jne 0x1006f394
fild dword [ebp - 0xc]
push ecx
push ecx
fstp dword [esp + 4]
fild dword [ebp - 0x10]
fstp dword [esp]
call fcn.10038013
push 0
push dword [ebp - 0x18]
push 0xffffffffffffffff
call fcn.1003812b
add esp, 0x14
mov dword [0x10112374], 2
jmp 0x1006f3b1
mov eax, dword [ebp - 4]
mov dword [0x10342a28], eax
call esi
push 0
mov dword [0x1034289c], eax
call fcn.1005f8c4
pop ecx
mov dword [0x10112374], edi
and dword [0x103434f0], 0
jmp 0x1006f8bf
mov eax, dword [0x10343364]
mov dword [0x10343360], eax
mov eax, dword [0x10343368]
mov dword [0x10343364], eax
mov eax, dword [0x1034336c]
mov dword [0x10343368], eax
mov eax, dword [0x10343370]
mov dword [0x1034336c], eax
mov eax, dword [0x10343374]
mov dword [0x10343370], eax
mov eax, dword [0x10343378]
mov dword [0x10343374], eax
mov eax, dword [0x1034337c]
mov dword [0x10343378], eax
mov dword [0x103434f0], 7
cmp dword [0x10342a6c], 2
je 0x1006f41d
and dword [0x101123b0], 0
cmp byte [0x10342a77], 1
je 0x1006f63a
call esi
mov edi, 0x3e8
xor edx, edx
mov ecx, edi
div ecx
sub eax, dword [0x10342890]
cmp eax, 0xf
jbe 0x1006f8bf
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
inc ebx
cmp dword [eax + 0x610], ebx
jle 0x1006f8bf
call esi
xor edx, edx
div edi
mov dword [0x10342890], eax
mov eax, dword [ebp - 4]
mov dword [0x10342a28], eax
call esi
mov dword [0x1034289c], eax
mov al, byte [0x10342a8e]
cmp dword [0x103a81f4], ebx
jne 0x1006f4f3
test al, al
jne 0x1006f4f3
mov eax, dword [0x103be1c0]
and dword [0x10112804], 0
and dword [0x101127fc], 0
push fcn.10059763
push 0x1f4
add eax, 0x4d
push eax
push dword [0x100e04bc]
call dword [sym.imp.USER32.dll_SetTimer]
fld dword [0x10342918]
sub esp, 0xc
fstp dword [esp + 8]
fldz
fstp dword [esp + 4]
fld dword [0x10342914]
fstp dword [esp]
call fcn.1003823d
push 0xffff
call fcn.1006dba0
push 0x1009c1b0
mov dword [0x10112374], ebx
call fcn.10006e54
add esp, 0x14
jmp 0x1006f8bf
cmp dword [0x103a82c8], ebx
jne 0x1006f596
test al, al
jne 0x1006f596
push 0xffff
call fcn.1006dba0
pop ecx
xor esi, esi
mov eax, dword [0x103be1c0]
lea eax, [eax + esi + 0x44]
push eax
push dword [0x100e04bc]
call dword [sym.imp.USER32.dll_KillTimer]
inc esi
cmp esi, 0xa
jl 0x1006f514
mov eax, dword [0x103be1c0]
push fcn.1003da0d
push 0x12c
add eax, 0x4d
push eax
push dword [0x100e04bc]
mov byte [0x10342a72], 0
call dword [sym.imp.USER32.dll_SetTimer]
fld dword [0x10342918]
and dword [0x101127fc], 0
sub esp, 0xc
fstp dword [esp + 8]
mov dword [0x10112374], ebx
fldz
fstp dword [esp + 4]
fld dword [0x10342914]
fstp dword [esp]
call fcn.1003823d
push 0x1009c1a8
call fcn.10006e54
add esp, 0x10
jmp 0x1006f8bf
push 0
call fcn.1005f8c4
fild dword [ebp - 0xc]
fstp dword [esp]
fild dword [ebp - 0x10]
jmp 0x1006f8b4
mov eax, dword [edi + 0x10a4]
fld dword [eax + 0x288]
sub esp, 0x10
fstp dword [esp + 0xc]
fld dword [eax + 0x280]
mov eax, dword [ebp - 8]
fstp dword [esp + 8]
fld dword [eax]
fstp dword [esp + 4]
fld dword [ebx + 0x1f60]
fstp dword [esp]
call fcn.10006f97
call fcn.10083f90
fld dword [edi + 0x107c]
fstp dword [esp + 0xc]
mov dword [ebp - 0x14], eax
fld dword [edi + 0x1074]
mov eax, dword [ebp - 8]
fstp dword [esp + 8]
fld dword [eax]
fstp dword [esp + 4]
fld dword [ebx + 0x1f60]
fstp dword [esp]
call fcn.10006f97
add esp, 0x10
call fcn.10083f90
cmp eax, 0x1e
jge 0x1006f631
cmp dword [ebp - 0x14], 0x1e
jle 0x1006f631
mov byte [0x10342a77], 1
jmp 0x1006f8bf
cmp byte [0x10342a77], 1
jne 0x1006f660
mov dword [0x10112374], 1
mov byte [0x10342a77], 0
call esi
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x10342890], eax
jmp 0x1006f8bf
call esi
mov edi, 0x3e8
xor edx, edx
mov ecx, edi
div ecx
sub eax, dword [0x10342890]
cmp eax, 7
jb 0x1006f6b9
cmp dword [0x10112374], 1
jne 0x1006f6b9
call esi
xor edx, edx
div edi
push 0
push dword [ebp - 0x18]
mov dword [0x10342890], eax
mov eax, dword [0x103a99c0]
dec eax
push eax
call fcn.1003812b
mov eax, dword [0x103a99c0]
dec eax
push 0x37
push eax
call fcn.1005c63e
add esp, 0x14
inc dword [0x10112374]
jmp 0x1006f8bf
call esi
xor edx, edx
mov ecx, edi
div ecx
sub eax, dword [0x10342890]
cmp eax, 1
jb 0x1006f719
cmp dword [0x10112374], 2
jne 0x1006f719
call esi
xor edx, edx
div edi
mov dword [0x10342890], eax
mov eax, dword [ebp - 8]
fld dword [eax]
call fcn.10083f90
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
push ecx
fstp dword [esp]
fld dword [ebx + 0x1f60]
call fcn.10083f90
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
push ecx
fstp dword [esp]
call fcn.10038013
inc dword [0x10112374]
jmp 0x1006f8bd
call esi
xor edx, edx
mov ecx, edi
div ecx
sub eax, dword [0x10342890]
cmp eax, 1
jb 0x1006f8bf
cmp dword [0x10112374], 3
jne 0x1006f8bf
cmp byte [0x100a6394], 1
je 0x1006f8bf
cmp dword [0x103a82d4], 1
jne 0x1006f857
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax + 0x10a4]
fld dword [edi + 0x280]
call fcn.10083f90
mov dword [0x103429d4], eax
fld dword [edi + 0x288]
call fcn.10083f90
fild dword [ebp - 0xc]
sub esp, 0x10
mov dword [0x103429d8], eax
fstp dword [esp + 0xc]
fild dword [ebp - 0x10]
fstp dword [esp + 8]
fild dword [0x103429d8]
fstp dword [esp + 4]
fild dword [0x103429d4]
fstp dword [esp]
call fcn.10006f97
fcomp qword [0x10090ef8]
add esp, 0x10
sub esp, 0xc
fnstsw ax
test ah, 1
jne 0x1006f7c4
fld dword [0x1009c1a4]
jmp 0x1006f7ca
fld dword [0x1009c068]
fstp dword [esp + 8]
fild dword [0x103429d8]
fstp dword [esp + 4]
fild dword [0x103429d4]
fstp dword [esp]
call fcn.10006fda
mov dword [ebp - 0x1c], edx
fld dword [ebp - 0x1c]
add esp, 0xc
mov dword [ebp - 0x20], eax
call fcn.10083f90
fld dword [ebp - 0x20]
mov dword [0x103429dc], eax
call fcn.10083f90
mov dword [0x103429e0], eax
mov eax, dword [ebp - 4]
mov dword [0x10342944], eax
call esi
mov dword [0x103428a0], eax
mov eax, dword [0x103be1c0]
push 0x1006e596
push 0x12c
add eax, 0x46
push eax
push dword [0x100e04bc]
xor esi, esi
mov dword [0x103429e4], esi
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x10112804], esi
mov dword [0x101127fc], esi
mov dword [0x101123b0], 4
jmp 0x1006f8bf
call esi
xor edx, edx
div edi
mov dword [0x10342890], eax
mov eax, dword [ebp - 4]
mov dword [0x10342a28], eax
call esi
push 0
mov dword [0x1034289c], eax
call fcn.1005f8c4
jmp 0x1006f8be
sub eax, dword [0x103d27b0]
cmp eax, 0x2710
jb 0x1006f8bf
call esi
fld dword [ebx + 0x1f68]
mov dword [0x103d27b0], eax
call fcn.10083f90
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
push ecx
fstp dword [esp]
fld dword [ebx + 0x1f60]
call fcn.10083f90
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
push ecx
fstp dword [esp]
call fcn.10038013
pop ecx
pop ecx
pop ebx
pop edi
pop esi
leave
ret