Function at 0x493c30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xe
push 0
push 0
dec ecx
jne 0x493c38
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x494a72
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4baf80]
dec eax
jne 0x494683
mov eax, dword [ebx + 0x2d4]
mov edx, dword [eax + 4]
mov ecx, 0x494a88
call fcn.0047bc10
mov esi, eax
cmp esi, 0xffffffff
je 0x493c9d
mov eax, dword [ebx + 0x2d4]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4]
mov edx, dword [0x47bfc8]
call fcn.00403140
mov edx, 0x494a98
call fcn.0047c434
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0x10
mov ecx, 0x494aa8
mov edx, 0x494ac0
mov eax, dword [0x4bad9c]
call fcn.004b17dc
mov eax, ebx
call fcn.00490abc
cmp byte [0x4baec0], 0
je 0x493cd5
mov edx, 0x494aa8
mov eax, ebx
call fcn.004911b0
mov edx, 0x494aa8
mov eax, ebx
call fcn.00490310
mov edx, 0x494aa8
mov eax, ebx
call fcn.00491824
cmp dword [0x4bafa8], 0xffffffff
je 0x493d24
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, dword [0x4bafac]
cdq
cmp edx, dword [esp + 4]
jne 0x493d14
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x493d24
jmp 0x493d18
pop edx
pop eax
jle 0x493d24
mov edx, 0x494aa8
mov eax, ebx
call fcn.00490e84
cmp byte [0x4b9800], 0
je 0x493dd0
cmp byte [0x4b97e8], 0
je 0x493dd0
push 0
push 0x3e8
mov eax, dword [0x4bb060]
cdq
push edx
push eax
call sub.kernel32.dll_GetTickCount
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
call fcn.00406516
mov edi, eax
mov eax, edi
mov ecx, 0x3c
cdq
idiv ecx
mov eax, edx
lea edx, [ebp - 0x1c]
call fcn.004087d0
mov eax, dword [ebp - 0x1c]
call fcn.00403eb8
dec eax
jne 0x493d93
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x494ad4
call fcn.00403f04
test edi, edi
jl 0x493dd0
mov eax, edi
mov ecx, 0x3c
cdq
idiv ecx
lea edx, [ebp - 0x24]
call fcn.004087d0
push dword [ebp - 0x24]
push 0x494ae0
push dword [ebp - 0x1c]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403f78
mov ecx, dword [ebp - 0x20]
mov edx, 0x494aec
mov eax, ebx
call fcn.004935c8
mov edx, 0x494b08
mov eax, dword [ebx + 0x2d0]
call fcn.00472ce8
mov edx, 0x494aa8
mov eax, ebx
call fcn.0048fa74
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, dword [0x4baeb8]
cdq
cmp edx, dword [esp + 4]
jne 0x493e0a
cmp eax, dword [esp]
pop edx
pop eax
ja 0x493e17
jmp 0x493e0e
pop edx
pop eax
jg 0x493e17
cmp byte [0x4b97a0], 0
je 0x493e42
push 0x2cf
push 0x1f2
push 0xb4
push 0
push 0
push 0
push 0
mov ecx, 0x494aa8
mov edx, 0x494b1c
mov eax, dword [0x4bad9c]
call fcn.004b293c
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, dword [0x4baebc]
cdq
cmp edx, dword [esp + 4]
jne 0x493e60
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x493e8f
jmp 0x493e64
pop edx
pop eax
jle 0x493e8f
push 0x25e
push 0x184
push 0xff
push 0
push 0
push 0
push 0
mov ecx, 0x494aa8
mov edx, 0x494b34
mov eax, dword [0x4bad9c]
call fcn.004b293c
cmp byte [0x4b97a4], 0
je 0x493f2e
cmp byte [0x4baf64], 0
jne 0x493f2e
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, dword [0x4bafd8]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, 0xb
xor edx, edx
call fcn.004064d0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
fild qword [ebp - 0x2c]
fild dword [0x4b97a8]
fdivp st(1)
call fcn.00402a5c
mov edi, eax
dec edi
test edi, edi
jl 0x493f2e
inc edi
mov dword [ebp - 4], 0
push 0x310
mov eax, dword [ebp - 4]
shl eax, 3
mov edx, 0x242
sub edx, eax
push edx
push 0xff
push 0
push 0
push 0
push 0
mov ecx, 0x494aa8
mov edx, 0x494b50
mov eax, dword [0x4bad9c]
call fcn.004b293c
inc dword [ebp - 4]
dec edi
jne 0x493ef4
mov eax, ebx
call fcn.00493134
mov edx, 0x494aa8
mov eax, ebx
call fcn.004921d0
cmp dword [0x4baddc], 0xffffffff
je 0x493f51
mov eax, ebx
call fcn.00492a34
cmp byte [0x4b97d8], 0
jne 0x493f63
mov eax, ebx
call fcn.0048bf78
jmp 0x493f6a
mov eax, ebx
call fcn.0048c51c
mov edx, dword [0x4badc8]
sub edx, dword [0x4badc0]
mov eax, dword [0x4bad9c]
call fcn.004b5140
lea edx, [ebp - 0x30]
mov eax, dword [0x4baf78]
call fcn.004087d0
mov edx, dword [ebp - 0x30]
mov eax, 0x4badd8
call fcn.00403c8c
cmp dword [0x4baddc], 0xffffffff
je 0x494004
push dword [0x4badd8]
push 0x494b68
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movzx eax, byte [edx + eax*8]
lea edx, [ebp - 0x34]
call fcn.004087d0
push dword [ebp - 0x34]
push 0x494b7c
mov ecx, dword [0x4bada4]
mov edx, dword [0x4bada0]
mov eax, ebx
call fcn.00499e80
movsx eax, ax
lea edx, [ebp - 0x38]
call fcn.004087d0
push dword [ebp - 0x38]
mov eax, 0x4badd8
mov edx, 5
call fcn.00403f78
inc dword [0x4bad8c]
cmp byte [0x4b976c], 0
je 0x4940cb
push 0x494aa8
push 1
push 0x1fe
push 0xff
push 0
push 0
mov eax, dword [ebx + 0x2d4]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4]
mov edx, dword [0x47bfc8]
call fcn.00403140
mov eax, dword [eax + 0x18]
mov edi, dword [ebp - 8]
mov edx, edi
shl edi, 7
add edi, edx
lea eax, [eax + edi*8 + 8]
push eax
push 0x494b8c
xor eax, eax
mov al, byte [0x4bad48]
mov dword [ebp - 0x44], eax
fild dword [ebp - 0x44]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x40]
push eax
mov ecx, 2
mov edx, 2
xor eax, eax
call fcn.00409590
push dword [ebp - 0x40]
push 0x494b9c
push dword [0x4badd8]
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.00403f78
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebx + 0x2d4]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4]
mov edx, dword [0x47bfc8]
call fcn.00403140
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + edi*8 + 4]
mov eax, dword [0x4bad9c]
pop edx
call fcn.004b36d4
cmp byte [0x4b97d4], 0
je 0x49413c
push 0x494aa8
push 1
push 1
push 0xff
push 0
push 0
mov eax, dword [ebx + 0x2d4]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4]
mov edx, dword [0x47bfc8]
call fcn.00403140
mov eax, dword [eax + 0x18]
mov edi, dword [ebp - 8]
mov edx, edi
shl edi, 7
add edi, edx
lea eax, [eax + edi*8 + 8]
push eax
mov eax, dword [ebx + 0x2d4]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4]
mov edx, dword [0x47bfc8]
call fcn.00403140
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + edi*8 + 4]
mov edx, 0x494ba8
mov eax, dword [0x4bad9c]
call fcn.004b36d4
cmp dword [0x4baddc], 0xffffffff
je 0x4943b3
lea eax, [ebp - 0x48]
mov edx, dword [0x4baddc]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [0x4bae08]
movzx edx, byte [ecx + edx*8]
imul edx, edx, 0x4c
mov ecx, dword [0x4bae04]
lea edx, [ecx + edx*8 + 0x14]
call fcn.00403e5c
mov edx, dword [ebp - 0x48]
mov eax, dword [0x4bad9c]
call fcn.004b1524
mov esi, eax
mov edi, esi
shl edi, 2
mov eax, dword [0x4bad9c]
mov eax, dword [eax + 0x14]
mov eax, dword [eax + edi*8 + 0x10]
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [0x4bad9c]
mov eax, dword [eax + 0x14]
mov ecx, dword [eax + edi*8 + 0xc]
dec ecx
xor edx, edx
xor eax, eax
call fcn.004103b8
lea esi, [ebp - 0x58]
mov edi, 0x4badb0
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov edx, dword [edx + eax*8 + 4]
mov dword [ebp - 0x10], edx
mov edx, dword [0x4bae08]
mov edx, dword [edx + eax*8 + 8]
mov dword [ebp - 0xc], edx
mov edx, dword [0x4baddc]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [0x4bae08]
cmp dword [ecx + edx*8 + 4], 0
jge 0x494224
mov edx, dword [0x4baddc]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [0x4bae08]
mov edx, dword [ecx + edx*8 + 4]
neg edx
add dword [0x4badb0], edx
xor edx, edx
mov dword [ebp - 0x10], edx
mov edx, dword [0x4baddc]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [0x4bae08]
cmp dword [ecx + edx*8 + 8], 0
jge 0x494262
mov edx, dword [0x4baddc]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [0x4bae08]
mov edx, dword [ecx + edx*8 + 8]
neg edx
add dword [0x4badb4], edx
xor edx, edx
mov dword [ebp - 0xc], edx
mov edx, dword [0x4baddc]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [0x4bae08]
mov edx, dword [ecx + edx*8 + 4]
add edx, dword [0x4badb8]
cmp edx, 0x31f
jle 0x4942a6
mov ecx, dword [0x4baddc]
mov esi, ecx
shl ecx, 3
sub ecx, esi
mov esi, dword [0x4bae08]
sub edx, 0x31f
sub dword [0x4badb8], edx
mov edx, dword [0x4baddc]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [0x4bae08]
mov edx, dword [ecx + edx*8 + 8]
add edx, dword [0x4badbc]
cmp edx, 0x257
jle 0x4942ea
mov ecx, dword [0x4baddc]
mov esi, ecx
shl ecx, 3
sub ecx, esi
mov esi, dword [0x4bae08]
sub edx, 0x257
sub dword [0x4badbc], edx
mov edx, dword [0x4bae08]
cmp byte [edx + eax*8 + 0x15], 0
je 0x494345
mov dword [ebp - 0x14], 0xffff
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fdiv dword [0x494bb4]
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
fadd qword [edx + eax*8 + 0x20]
call fcn.00402a4c
fmul dword [0x494bb8]
fadd dword [0x494bbc]
call fcn.00402a5c
mov byte [ebp - 0x15], al
jmp 0x494349
mov byte [ebp - 0x15], 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0xff
push 0x4badb0
mov eax, dword [ebp - 0x14]
push eax
mov al, byte [ebp - 0x15]
push eax
push 0
lea eax, [ebp - 0x5c]
mov edx, dword [0x4baddc]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [0x4bae08]
movzx edx, byte [ecx + edx*8]
imul edx, edx, 0x4c
mov ecx, dword [0x4bae04]
lea edx, [ecx + edx*8 + 0x14]
call fcn.00403e5c
mov edx, dword [ebp - 0x5c]
mov ecx, 0x494aa8
mov eax, dword [0x4bad9c]
call fcn.004b293c
cmp dword [0x4baf9c], 0xffffffff
je 0x4943b3
mov eax, ebx
call fcn.004927d0
cmp dword [0x4b979c], 0xffffffff
je 0x4944f7
imul eax, dword [0x4bafbc], 0xb
mov edx, dword [0x4badf8]
movzx eax, word [edx + eax*2 + 2]
mov edx, dword [0x4badf0]
movsx edi, word [edx + eax*4 + 2]
sub edi, dword [0x4badc8]
add edi, dword [0x4badc0]
lea eax, [ebp - 0x60]
imul edx, dword [0x4b979c], 0x4c
mov ecx, dword [0x4bae04]
lea edx, [ecx + edx*8 + 0x14]
call fcn.00403e5c
mov edx, dword [ebp - 0x60]
mov eax, dword [0x4bad9c]
call fcn.004b1524
mov esi, eax
mov eax, esi
shl eax, 2
mov edx, dword [0x4bad9c]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*8 + 0x10]
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, esi
shl eax, 2
mov edx, dword [0x4bad9c]
mov edx, dword [edx + 0x14]
mov ecx, dword [edx + eax*8 + 0xc]
dec ecx
xor edx, edx
xor eax, eax
call fcn.004103b8
push esi
push edi
lea esi, [ebp - 0x58]
mov edi, 0x4badb0
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
test edi, edi
jge 0x494464
add dword [0x4badb4], edi
xor edi, edi
mov eax, esi
shl eax, 2
mov edx, dword [0x4bad9c]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*8 + 0x10]
add eax, edi
dec eax
cmp eax, 0x1e5
jle 0x49449b
mov eax, esi
shl eax, 2
mov edx, dword [0x4bad9c]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*8 + 0x10]
add eax, edi
sub eax, 0x1e6
sub edi, eax
imul eax, dword [0x4bafbc], 0xb
mov edx, dword [0x4badf8]
movzx eax, word [edx + eax*2 + 2]
mov edx, dword [0x4badf0]
movsx eax, word [edx + eax*4]
push eax
add edi, 5
push edi
push 0x64
push 0x4badb0
push 0xffffff
push 1
push 0
lea eax, [ebp - 0x64]
imul edx, dword [0x4b979c], 0x4c
mov ecx, dword [0x4bae04]
lea edx, [ecx + edx*8 + 0x14]
call fcn.00403e5c
mov edx, dword [ebp - 0x64]
mov ecx, 0x494aa8
mov eax, dword [0x4bad9c]
call fcn.004b293c
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, dword [0x4bb010]
cdq
cmp edx, dword [esp + 4]
jne 0x494515
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x494520
jmp 0x494519
pop edx
pop eax
jle 0x494520
mov eax, ebx
call fcn.00495524
cmp byte [0x4b97d8], 0
je 0x4945d2
mov eax, dword [0x4badac]
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [0x4bada8]
dec ecx
xor edx, edx
xor eax, eax
call fcn.004103b8
lea esi, [ebp - 0x58]
mov edi, 0x4badb0
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x4bb044]
mov edx, eax
add edx, dword [0x4bada8]
cmp edx, 0x320
jle 0x494578
sub edx, 0x320
sub dword [0x4badb8], edx
mov edx, dword [0x4bb048]
mov ecx, edx
add ecx, dword [0x4badac]
cmp ecx, 0x258
jle 0x4945a6
mov ecx, dword [0x4bb048]
add ecx, dword [0x4badac]
sub ecx, 0x258
sub dword [0x4badbc], ecx
push eax
push edx
push 0xff
push 0x4badb0
push 0
push 0
push 0
mov ecx, 0x494aa8
mov eax, dword [0x4bad9c]
mov edx, dword [0x4baf2c]
call fcn.004b293c
jmp 0x494a35
mov eax, dword [0x4badac]
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [0x4bada8]
dec ecx
xor edx, edx
xor eax, eax
call fcn.004103b8
lea esi, [ebp - 0x58]
mov edi, 0x4badb0
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x4bada0]
mov edx, eax
add edx, dword [0x4bada8]
cmp edx, 0x320
jle 0x494629
mov edx, dword [0x4bada0]
add edx, dword [0x4bada8]
sub edx, 0x320
sub dword [0x4badb8], edx
mov edx, dword [0x4bada4]
mov ecx, edx
add ecx, dword [0x4badac]
cmp ecx, 0x258
jle 0x494657
mov ecx, dword [0x4bada4]
add ecx, dword [0x4badac]
sub ecx, 0x258
sub dword [0x4badbc], ecx
push eax
push edx
push 0xff
push 0x4badb0
push 0
push 0
push 0
mov ecx, 0x494aa8
mov eax, dword [0x4bad9c]
mov edx, dword [0x4baf2c]
call fcn.004b293c
jmp 0x494a35
push 0
push 0
push 0
push 0x10
mov ecx, 0x494aa8
mov edx, 0x494ac0
mov eax, dword [0x4bad9c]
call fcn.004b17dc
mov eax, dword [ebx + 0x2d0]
mov edx, dword [eax + 4]
mov ecx, 0x494bc8
call fcn.0047bc10
mov esi, eax
cmp esi, 0xffffffff
je 0x494755
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fdiv dword [0x494bd4]
call fcn.00402a4c
fmul dword [0x494bd8]
fadd dword [0x494bd8]
call fcn.00402a5c
mov edi, eax
mov eax, dword [ebx + 0x2d0]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4]
mov edx, dword [0x475598]
call fcn.00403140
mov dword [eax + 0x54], edi
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fdiv dword [0x494bdc]
fld xword [0x494be0]
faddp st(1)
call fcn.00402a4c
fmul dword [0x494bec]
fadd dword [0x494bf0]
call fcn.00402a5c
mov edi, eax
mov eax, dword [ebx + 0x2d0]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4]
mov edx, dword [0x475598]
call fcn.00403140
mov dword [eax + 0x50], edi
cmp byte [0x4baec0], 0
je 0x49476a
mov edx, 0x494aa8
mov eax, ebx
call fcn.004911b0
mov edx, 0x494aa8
mov eax, ebx
call fcn.00490310
mov edx, 0x494aa8
mov eax, ebx
call fcn.00491824
mov edx, 0x494aa8
mov eax, ebx
call fcn.004921d0
cmp byte [0x4b9800], 0
je 0x49483a
cmp byte [0x4b97e8], 0
je 0x49483a
push 0
push 0x3e8
mov eax, dword [0x4bb060]
cdq
push edx
push eax
call sub.kernel32.dll_GetTickCount
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
call fcn.00406516
mov edi, eax
mov eax, edi
mov ecx, 0x3c
cdq
idiv ecx
mov eax, edx
lea edx, [ebp - 0x1c]
call fcn.004087d0
mov eax, dword [ebp - 0x1c]
call fcn.00403eb8
dec eax
jne 0x4947fd
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x494ad4
call fcn.00403f04
test edi, edi
jl 0x49483a
mov eax, edi
mov ecx, 0x3c
cdq
idiv ecx
lea edx, [ebp - 0x6c]
call fcn.004087d0
push dword [ebp - 0x6c]
push 0x494ae0
push dword [ebp - 0x1c]
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.00403f78
mov ecx, dword [ebp - 0x68]
mov edx, 0x494aec
mov eax, ebx
call fcn.004935c8
mov edx, 0x494b08
mov eax, dword [ebx + 0x2d0]
call fcn.00472ce8
mov eax, dword [ebx + 0x2d4]
mov edx, dword [eax + 4]
mov ecx, 0x494a88
call fcn.0047bc10
mov esi, eax
cmp esi, 0xffffffff
je 0x494888
mov eax, dword [ebx + 0x2d4]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4]
mov edx, dword [0x47bfc8]
call fcn.00403140
mov edx, 0x494a98
call fcn.0047c434
mov dword [ebp - 8], eax
inc dword [0x4bad8c]
cmp byte [0x4b976c], 0
je 0x49494f
push 0x494aa8
push 1
push 0x1fe
push 0xff
push 0
push 0
mov eax, dword [ebx + 0x2d4]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4]
mov edx, dword [0x47bfc8]
call fcn.00403140
mov eax, dword [eax + 0x18]
mov edi, dword [ebp - 8]
mov edx, edi
shl edi, 7
add edi, edx
lea eax, [eax + edi*8 + 8]
push eax
push 0x494b8c
xor eax, eax
mov al, byte [0x4bad48]
mov dword [ebp - 0x44], eax
fild dword [ebp - 0x44]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x74]
push eax
mov ecx, 2
mov edx, 2
xor eax, eax
call fcn.00409590
push dword [ebp - 0x74]
push 0x494b9c
push dword [0x4badd8]
lea eax, [ebp - 0x70]
mov edx, 4
call fcn.00403f78
mov eax, dword [ebp - 0x70]
push eax
mov eax, dword [ebx + 0x2d4]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi*4]
mov edx, dword [0x47bfc8]
call fcn.00403140
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + edi*8 + 4]
mov eax, dword [0x4bad9c]
pop edx
call fcn.004b36d4
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, dword [0x4bb00c]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x494975
cmp eax, 0x1f4
jbe 0x494991
jmp 0x494977
jle 0x494991
cmp dword [0x4b97b4], 0
jge 0x494991
mov eax, ebx
call fcn.00494e9c
call sub.kernel32.dll_GetTickCount
mov dword [0x4b97b4], eax
cmp dword [0x4b97b4], 0
jle 0x4949a1
mov eax, ebx
call fcn.00494e9c
mov eax, dword [0x4badac]
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [0x4bada8]
dec ecx
xor edx, edx
xor eax, eax
call fcn.004103b8
lea esi, [ebp - 0x58]
mov edi, 0x4badb0
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x4bada0]
mov edx, eax
add edx, dword [0x4bada8]
cmp edx, 0x320
jle 0x4949ec
sub edx, 0x320
sub dword [0x4badb8], edx
mov edx, dword [0x4bada4]
mov ecx, edx
add ecx, dword [0x4badac]
cmp ecx, 0x258
jle 0x494a0e
sub ecx, 0x258
sub dword [0x4badbc], ecx
push eax
push edx
push 0xff
push 0x4badb0
push 0
push 0
push 0
mov ecx, 0x494aa8
mov eax, dword [0x4bad9c]
mov edx, dword [0x4baf2c]
call fcn.004b293c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494a79
lea eax, [ebp - 0x74]
mov edx, 7
call fcn.00403c5c
lea eax, [ebp - 0x48]
call fcn.00403c38
lea eax, [ebp - 0x40]
mov edx, 5
call fcn.00403c5c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403c5c
ret