Function at 0x40fef0
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x476b43
mov eax, dword fs:[0]
push eax
mov eax, 0x119c
call fcn.00458c60
mov eax, dword [0x4995d0]
xor eax, esp
mov dword [esp + 0x1198], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4995d0]
xor eax, esp
push eax
lea eax, [esp + 0x11b0]
mov dword fs:[0], eax
mov edi, dword [esp + 0x11c4]
mov ebp, dword [esp + 0x11c0]
test edi, edi
jl 0x41040b
cmp edi, dword [ebp + 0xf98]
jge 0x41040b
mov eax, dword [ebp + 0xf94]
lea ecx, [edi*4]
add eax, ecx
mov eax, dword [eax]
sub eax, 0x10
push eax
mov dword [esp + 0x2c], ecx
call fcn.00409e30
lea esi, [eax + 0x10]
add esp, 4
mov dword [esp + 0x24], esi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x4c]
push 0x481b3c
push ecx
mov dword [esp + 0x11c4], 0
call fcn.00408bc0
add esp, 0xc
push 0x481b34
push eax
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0x11c4], 1
call fcn.00408ae0
add esp, 0xc
mov byte [esp + 0x11b8], 3
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ffde
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x4a2600]
shr ecx, 5
test cl, 1
je 0x41043f
mov ebx, dword [esp + 0x2c]
call fcn.00413110
mov ecx, eax
push 0
mov eax, 4
call fcn.00406710
add esp, 4
cmp eax, 6
jne 0x410410
lea eax, [ebp + 0xfc0]
mov ebx, edi
call fcn.004116e0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [ebx]
mov eax, 0x10624dd3
mul edx
mov ebx, edx
shr ebx, 6
cmp dword [esi - 0xc], 0
jge 0x410043
or eax, 0xffffffff
jmp 0x41005e
push 0x4812e4
push esi
call fcn.0045449e
add esp, 8
test eax, eax
jne 0x41005a
or eax, 0xffffffff
jmp 0x41005e
sub eax, esi
sar eax, 1
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
call fcn.00411570
push 0x200
mov byte [esp + 0x11bc], 4
call fcn.00434490
add esp, 4
push 0x4812f0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
call fcn.0040a4d0
mov esi, eax
mov byte [esp + 0x11b8], 5
call fcn.00413490
push eax
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.00408ae0
add esp, 0xc
mov esi, eax
lea eax, [ebp + 0xfd8]
push edi
mov byte [esp + 0x11bc], 6
call fcn.004117c0
add eax, 0x38
cmp dword [eax + 0x18], 8
jb 0x4100d6
mov eax, dword [eax + 4]
jmp 0x4100d9
add eax, 4
mov edx, dword [esp + 0x20]
mov ecx, dword [esi]
push ebx
push edx
push eax
mov eax, dword [esp + 0x20]
push ecx
push 0x100
push eax
call fcn.004546d8
mov byte [esp + 0x11d0], 5
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
add esp, 0x18
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41011d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x11b8], 4
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410145
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp + 0xfcc]
cmp esi, dword [ebp + 0xfd0]
jbe 0x410158
call fcn.004564a4
mov edi, dword [ebp + 0xfc0]
mov ebx, edi
mov dword [esp + 0x1c], esi
test edi, edi
jne 0x410182
call fcn.004564a4
xor eax, eax
mov ecx, dword [esp + 0x28]
add esi, ecx
cmp esi, dword [eax + 0x10]
ja 0x41018d
test edi, edi
je 0x410186
mov edi, dword [edi]
jmp 0x410188
mov eax, dword [edi]
jmp 0x41016f
xor edi, edi
cmp esi, dword [edi + 0xc]
jae 0x410192
call fcn.004564a4
push esi
push ebx
lea edi, [esp + 0x20]
lea esi, [ebp + 0xfc0]
call fcn.00411760
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push edx
push 0x40d9c0
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
xor eax, eax
push 0x2e
push eax
lea ecx, [esp + 0x56]
push ecx
mov word [esp + 0x58], ax
call fcn.00458440
add esp, 0xc
lea esi, [esp + 0x4c]
call fcn.00407f10
xor edx, edx
push 0x7e
push edx
lea eax, [esp + 0xb6]
push eax
mov word [esp + 0xb8], dx
call fcn.00458440
add esp, 0xc
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x1b6]
push edx
mov word [esp + 0x1b8], cx
call fcn.00458440
add esp, 0xc
push 0x800
call fcn.00434490
add esp, 4
mov esi, eax
lea eax, [esp + 0xac]
push 0x400
push eax
mov ecx, 0x48138c
call fcn.00406780
add esp, 8
lea ecx, [esp + 0x1ac]
push 0x400
push ecx
call fcn.00413260
mov ecx, eax
call fcn.00406780
add esp, 8
lea edx, [esp + 0x1ac]
push edx
lea eax, [esp + 0x50]
push 0x48032c
push eax
call fcn.00413500
push eax
call fcn.00413490
push eax
call fcn.00413650
push eax
call fcn.004135e0
push eax
call fcn.00413570
push eax
call fcn.00413340
push eax
lea ecx, [esp + 0xd0]
push ecx
push 0x481398
push 0x480338
push 0x400
push esi
call fcn.004546d8
add esp, 0x38
push 0
push 0
push esi
push 0x40d9c0
push 0
push 0
call edi
push eax
call ebx
mov esi, dword [esp + 0x11c4]
cmp esi, dword [ebp + 0xf84]
lea ebx, [ebp + 0xf7c]
jge 0x41040b
mov edx, dword [ebx + 4]
mov eax, dword [edx + esi*4]
push 1
push esi
mov ecx, ebx
mov dword [esp + 0x1c], eax
call fcn.00437455
push 1
push esi
lea ecx, [ebp + 0xf90]
call fcn.004376b1
mov edi, dword [ebp + 0xfe4]
cmp edi, dword [ebp + 0xfe8]
jbe 0x41031f
call fcn.004564a4
mov ecx, dword [ebp + 0xfd8]
lea edx, [esp + 0x30]
mov dword [esp + 0x18], ecx
push edx
mov ecx, esi
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], edi
call fcn.00411990
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x20]
push eax
lea edi, [ebp + 0xfd8]
call fcn.00411900
mov eax, dword [ebp + 0xf84]
cmp esi, eax
jl 0x410361
lea esi, [eax - 1]
test esi, esi
jge 0x4103c4
mov ecx, dword [esp + 0x14]
push ecx
or esi, 0xffffffff
mov dword [ebp + 0xfbc], esi
mov dword [ebp + 0xfb8], esi
call fcn.0043e35f
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x60]
call eax
mov edx, dword [ebp]
mov eax, dword [edx + 0x15c]
mov ecx, ebp
call eax
mov byte [esp + 0x11b8], 3
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov edx, esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410894
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x410894
cmp esi, dword [ebx + 8]
jge 0x41040b
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + esi*4]
push eax
mov edi, ebp
call fcn.00410a20
mov eax, dword [ebp + 0xf98]
imul eax, eax, 0xb0
push 1
push 0x10
push 0x1c
push 5
add eax, 0x82
push eax
lea ecx, [ebp + 0x6d0]
mov dword [ebp + 0xfb4], esi
call fcn.0043a4c9
mov edx, dword [esp + 0x14]
jmp 0x410810
call fcn.0043474a
imul edi, edi, 0xb0
lea ecx, [edi + 0x82]
add edi, 0x132
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 3
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], 0x19
jmp 0x410874
lea eax, [ebp + 0xfc0]
mov ebx, edi
call fcn.004116e0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [ebx]
mov eax, 0x10624dd3
mul edx
mov ebx, edx
shr ebx, 6
cmp dword [esi - 0xc], 0
jge 0x41046f
or eax, 0xffffffff
jmp 0x41048a
push 0x4812e4
push esi
call fcn.0045449e
add esp, 8
test eax, eax
jne 0x410486
or eax, 0xffffffff
jmp 0x41048a
sub eax, esi
sar eax, 1
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
call fcn.00411570
push 0x200
mov byte [esp + 0x11bc], 7
call fcn.00434490
add esp, 4
push 0x4812f0
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], eax
call fcn.0040a4d0
mov esi, eax
mov byte [esp + 0x11b8], 8
call fcn.00413490
push eax
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.00408ae0
add esp, 0xc
mov esi, eax
lea eax, [ebp + 0xfd8]
push edi
mov byte [esp + 0x11bc], 9
call fcn.004117c0
add eax, 0x38
cmp dword [eax + 0x18], 8
jb 0x410502
mov eax, dword [eax + 4]
jmp 0x410505
add eax, 4
mov edx, dword [esp + 0x20]
mov ecx, dword [esi]
push ebx
push edx
push eax
mov eax, dword [esp + 0x20]
push ecx
push 0x100
push eax
call fcn.004546d8
mov byte [esp + 0x11d0], 8
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x18
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410549
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x11b8], 7
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410571
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp + 0xfcc]
cmp esi, dword [ebp + 0xfd0]
jbe 0x410584
call fcn.004564a4
mov edi, dword [ebp + 0xfc0]
mov ebx, edi
mov dword [esp + 0x1c], esi
test edi, edi
jne 0x4105ae
call fcn.004564a4
xor eax, eax
mov ecx, dword [esp + 0x28]
add esi, ecx
cmp esi, dword [eax + 0x10]
ja 0x4105b9
test edi, edi
je 0x4105b2
mov edi, dword [edi]
jmp 0x4105b4
mov eax, dword [edi]
jmp 0x41059b
xor edi, edi
cmp esi, dword [edi + 0xc]
jae 0x4105be
call fcn.004564a4
push esi
push ebx
lea edi, [esp + 0x20]
lea esi, [ebp + 0xfc0]
call fcn.00411760
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push edx
push 0x40d9c0
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
xor eax, eax
push 0x2e
push eax
lea ecx, [esp + 0x86]
push ecx
mov word [esp + 0x88], ax
call fcn.00458440
add esp, 0xc
lea esi, [esp + 0x7c]
call fcn.00407f10
xor edx, edx
push 0x7e
push edx
lea eax, [esp + 0x136]
push eax
mov word [esp + 0x138], dx
call fcn.00458440
add esp, 0xc
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x9b6]
push edx
mov word [esp + 0x9b8], cx
call fcn.00458440
add esp, 0xc
push 0x800
call fcn.00434490
add esp, 4
mov esi, eax
lea eax, [esp + 0x12c]
push 0x400
push eax
mov ecx, 0x48138c
call fcn.00406780
add esp, 8
lea ecx, [esp + 0x9ac]
push 0x400
push ecx
call fcn.00413260
mov ecx, eax
call fcn.00406780
add esp, 8
lea edx, [esp + 0x9ac]
push edx
lea eax, [esp + 0x80]
push 0x48032c
push eax
call fcn.00413500
push eax
call fcn.00413490
push eax
call fcn.00413650
push eax
call fcn.004135e0
push eax
call fcn.00413570
push eax
call fcn.00413340
push eax
lea ecx, [esp + 0x150]
push ecx
push 0x481398
push 0x480338
push 0x400
push esi
call fcn.004546d8
add esp, 0x38
push 0
push 0
push esi
push 0x40d9c0
push 0
push 0
call edi
push eax
call ebx
mov esi, dword [esp + 0x11c4]
cmp esi, dword [ebp + 0xf84]
lea ebx, [ebp + 0xf7c]
jge 0x41040b
mov edx, dword [ebx + 4]
mov eax, dword [edx + esi*4]
push 1
push esi
mov ecx, ebx
mov dword [esp + 0x30], eax
call fcn.00437455
push 1
push esi
lea ecx, [ebp + 0xf90]
call fcn.004376b1
mov edi, dword [ebp + 0xfe4]
cmp edi, dword [ebp + 0xfe8]
jbe 0x410754
call fcn.004564a4
mov eax, dword [ebp + 0xfd8]
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
test eax, eax
jne 0x410789
call fcn.004564a4
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov edx, esi
imul edx, edx, 0x54
add edi, edx
cmp edi, dword [ecx + 0x10]
ja 0x410794
test eax, eax
je 0x41078d
mov eax, dword [eax]
jmp 0x41078f
mov ecx, dword [eax]
jmp 0x410775
xor eax, eax
cmp edi, dword [eax + 0xc]
jae 0x410799
call fcn.004564a4
mov eax, dword [esp + 0x18]
push edi
push eax
lea ecx, [esp + 0x20]
push ecx
lea edi, [ebp + 0xfd8]
call fcn.00411900
mov eax, dword [ebp + 0xf84]
cmp esi, eax
jl 0x4107bc
lea esi, [eax - 1]
test esi, esi
jge 0x4107ca
mov edx, dword [esp + 0x28]
push edx
jmp 0x41036a
cmp esi, dword [ebx + 8]
jge 0x41040b
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + esi*4]
push eax
mov edi, ebp
call fcn.00410a20
mov eax, dword [ebp + 0xf98]
imul eax, eax, 0xb0
push 1
push 0x10
push 0x1c
push 5
add eax, 0x82
push eax
lea ecx, [ebp + 0x6d0]
mov dword [ebp + 0xfb4], esi
call fcn.0043a4c9
mov edx, dword [esp + 0x28]
mov eax, dword [ebp + 0xf84]
imul eax, eax, 0xb0
add eax, 0x132
mov ebx, 3
push edx
mov dword [esp + 0x3c], 0x82
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 0x19
call fcn.0043e35f
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x60]
call eax
mov byte [esp + 0x11b8], bl
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410874
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebp + 0x20]
push 1
lea ecx, [esp + 0x3c]
or esi, 0xffffffff
push ecx
push edx
mov dword [ebp + 0xfbc], esi
mov dword [ebp + 0xfb8], esi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [esp + 0x11b8], 0
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov edx, esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4108bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x11b8], esi
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x4108df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x11b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1198]
xor ecx, esp
call fcn.004541a5
add esp, 0x11a8
ret 8