Function at 0x40fa90
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0xfc]
add eax, 0x800
mov ecx, 0xc000
mov dword [ebp + 0x100], eax
mov edi, dword [ebp + 0x664]
or eax, 0xffffffff
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xfc]
mov edi, dword [ebp + 0x664]
mov esi, dword [ebp + 0x66c]
mov edx, ecx
add edi, 0x800
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xfc]
xor ecx, ecx
test eax, eax
jle 0x40fb17
mov edx, dword [ebp + 0x66c]
cmp byte [edx + ecx], 0xff
jne 0x40fb07
inc ecx
cmp ecx, eax
jl 0x40fafc
cmp ecx, 0x10000
mov dword [esp + 0x18], 0x10000
jg 0x40fb1b
mov dword [esp + 0x18], ecx
mov ebx, dword [ebp + 0x664]
mov edi, eax
mov eax, 0x1b4e81b5
mov dword [esp + 0x14], edi
mov word [ebx], 0xa55a
mov ecx, dword [ebp + 0xe4]
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov byte [ebx + 0xa], dl
mov cl, byte [ebp + 0xec]
mov byte [ebx + 0xb], cl
mov edx, dword [ebp + 0x11c]
shl edx, 5
mov ax, word [edx + 0x422720]
push eax
call fcn.0041f170
mov word [ebx + 0xc], ax
mov ecx, dword [ebp + 0x11c]
shl ecx, 5
mov dx, word [ecx + 0x422722]
push edx
call fcn.0041f170
mov word [ebx + 0xe], ax
mov byte [ebx + 0x10], 0
mov byte [ebx + 0x11], 0
mov byte [ebx + 0x12], 0
mov byte [ebx + 0x13], 0
mov eax, dword [ebp + 0xf8]
push eax
call fcn.0041f150
mov dword [ebx + 0x14], eax
mov ecx, dword [ebp + 0x114]
push ecx
call fcn.0041f150
mov dword [ebx + 0x18], eax
fild dword [ebp + 0xf8]
fmul dword [ebp + 0x1e8]
call sub.MSVCRT.dll__ftol
push eax
call fcn.0041f150
mov dword [ebx + 0x1a3], eax
mov edx, dword [ebp + 0x6a0]
push edx
call fcn.0041f150
mov dword [ebx + 0x1a9], eax
mov al, byte [ebp + 0x6a4]
mov byte [ebx + 0x1ad], al
mov cl, byte [ebp + 0x6a5]
mov byte [ebx + 0x1ae], cl
mov dl, byte [ebp + 0x6a6]
mov byte [ebx + 0x1af], dl
mov al, byte [ebp + 0x6a7]
mov byte [ebx + 0x1b0], al
mov cl, byte [ebp + 0x6a8]
mov byte [ebx + 0x1b1], cl
mov dl, byte [ebp + 0x6a9]
mov byte [ebx + 0x1b2], dl
mov al, byte [ebp + 0x6aa]
mov byte [ebx + 0x1b3], al
mov cl, byte [ebp + 0x6ab]
mov byte [ebx + 0x1b4], cl
mov dl, byte [ebp + 0x6ac]
mov byte [ebx + 0x1b9], dl
mov al, byte [ebp + 0x6ad]
mov byte [ebx + 0x1ba], al
mov cl, byte [ebp + 0x6ae]
mov byte [ebx + 0x1bb], cl
mov dl, byte [ebp + 0x6af]
mov byte [ebx + 0x1bc], dl
mov al, byte [ebx + 0x10]
or al, 0x20
mov byte [ebx + 0x10], al
mov eax, dword [ebp + 0x168]
push eax
call fcn.0041f150
add esp, 0x1c
mov dword [ebx + 0x1c], eax
lea ecx, [ebx + 0x20]
mov edx, dword [ebp + 0x678]
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov edx, dword [edx + 0xc]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 0x11c]
shl eax, 5
mov eax, dword [eax + 0x422718]
mov ecx, eax
and ecx, 0x7f8000
cmp ecx, 0x168000
jb 0x40fcd0
test al, 8
jne 0x40fcd0
mov byte [ebx + 0x23], 0xff
mov al, byte [ebp + 0x2f]
test al, al
je 0x40fcf6
mov al, byte [ebx + 0x10]
lea edi, [ebx + 0x300]
or al, 1
mov ecx, 0x40
mov byte [ebx + 0x10], al
mov esi, dword [ebp + 0x674]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
mov al, byte [ebp + 0x27]
test al, al
je 0x40fd01
or byte [ebx + 0x10], 2
mov edx, dword [ebp + 0x678]
test byte [edx + 0x10], 1
jne 0x40fd6b
mov al, byte [ebx + 0x10]
or al, 4
mov byte [ebx + 0x10], al
mov ecx, dword [ebp + 0x678]
test byte [ecx + 0x10], 2
jne 0x40fd2a
and eax, 0xff
or al, 8
jmp 0x40fd31
and eax, 0xff
and al, 0xf7
mov byte [ebx + 0x10], al
mov edx, dword [ebp + 0x678]
test byte [edx + 0x10], 4
jne 0x40fd49
and eax, 0xff
or al, 0x10
jmp 0x40fd50
and eax, 0xff
and al, 0xef
mov byte [ebx + 0x10], al
mov eax, dword [ebp + 0x678]
mov cl, byte [eax + 0x11]
mov byte [ebx + 0x30], cl
mov edx, dword [ebp + 0x678]
mov al, byte [edx + 0x12]
mov byte [ebx + 0x31], al
mov eax, dword [ebp + 0xf0]
test eax, eax
je 0x40fd79
or byte [ebx + 0x10], 0x40
mov ecx, dword [ebp + 0x11c]
shl ecx, 5
test byte [ecx + 0x422718], 0x20
je 0x40fd8f
or byte [ebx + 0x10], 0x80
mov dl, byte [ebp + 0x10c]
mov byte [ebx + 0x32], dl
mov eax, dword [ebp + 0x11c]
shl eax, 5
mov ecx, dword [eax + 0x422718]
shr ecx, 0xf
mov byte [ebx + 0x33], cl
mov al, byte [ebp + 0x31]
test al, al
je 0x40fe27
mov eax, dword [ebp + 0x88]
mov esi, dword [esp + 0x18]
cmp esi, eax
jl 0x40fdc8
mov esi, eax
mov dword [esp + 0x18], esi
mov edx, dword [ebp + 0x90]
add eax, edx
cmp edi, eax
jg 0x40fdda
mov edi, eax
mov dword [esp + 0x14], edi
mov dl, byte [ebx + 0x11]
or dl, 1
mov byte [ebx + 0x11], dl
mov eax, dword [ebp + 0x88]
push eax
call fcn.0041f150
mov dword [ebx + 0x34], eax
mov cl, byte [ebp + 0x90]
lea edx, [ebp + 0x48]
push 0x10
lea eax, [ebx + 0x40]
push edx
push eax
mov byte [ebx + 0x3c], cl
call fcn.0041f120
lea ecx, [ebp + 0x68]
push 0x10
lea edx, [ebx + 0x60]
push ecx
push edx
call fcn.0041f120
mov al, byte [ebp + 0x98]
add esp, 0x1c
mov byte [ebx + 0x3e], al
jmp 0x40fe2b
mov esi, dword [esp + 0x18]
mov al, byte [ebp + 0x32]
test al, al
je 0x40fe9f
mov eax, dword [ebp + 0x8c]
cmp esi, eax
jl 0x40fe42
mov esi, eax
mov dword [esp + 0x18], esi
mov ecx, dword [ebp + 0x94]
add eax, ecx
cmp edi, eax
jg 0x40fe54
mov edi, eax
mov dword [esp + 0x14], edi
mov cl, byte [ebx + 0x11]
or cl, 2
mov byte [ebx + 0x11], cl
mov edx, dword [ebp + 0x8c]
push edx
call fcn.0041f150
lea ecx, [ebp + 0x58]
mov dword [ebx + 0x38], eax
mov al, byte [ebp + 0x94]
push 0x10
lea edx, [ebx + 0x50]
push ecx
push edx
mov byte [ebx + 0x3d], al
call fcn.0041f120
lea eax, [ebp + 0x78]
push 0x10
lea ecx, [ebx + 0x70]
push eax
push ecx
call fcn.0041f120
mov dl, byte [ebp + 0x9c]
add esp, 0x1c
mov byte [ebx + 0x3f], dl
mov al, byte [ebp + 0x29]
test al, al
je 0x40feaa
or byte [ebx + 0x11], 4
mov al, byte [ebp + 0x2a]
test al, al
jne 0x40feb5
or byte [ebx + 0x12], 4
mov al, byte [ebp + 0x2b]
test al, al
je 0x40fec0
or byte [ebx + 0x12], 8
mov al, byte [ebp + 0x2c]
test al, al
jne 0x40fecb
or byte [ebx + 0x12], 0x10
mov eax, dword [ebp + 0x11c]
shl eax, 5
test byte [eax + 0x422718], 4
je 0x40fee1
or byte [ebx + 0x12], 0x20
mov cl, byte [ebp + 0xd8]
mov dl, byte [ebx + 0x12]
shl cl, 6
or dl, cl
mov byte [ebx + 0x12], dl
mov dl, byte [ebp + 0xf4]
mov byte [ebx + 0x80], dl
mov al, byte [ebp + 0x38]
test al, al
je 0x40fffb
mov eax, dword [ebp + 0xd0]
cmp esi, eax
jl 0x40ff17
mov dword [esp + 0x18], eax
mov ecx, dword [ebp + 0xcc]
add eax, ecx
cmp edi, eax
jg 0x40ff27
mov dword [esp + 0x14], eax
mov al, byte [ebx + 0x11]
or al, 0x40
mov byte [ebx + 0x11], al
mov ecx, dword [ebp + 0xb8]
mov eax, 0x1b4e81b5
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov byte [ebx + 0xa3], dl
mov ecx, dword [ebp + 0xc4]
cmp ecx, 0x20
jle 0x40ff5c
mov ecx, 0x20
mov byte [ebx + 0xa4], cl
mov esi, dword [ebp + 0x67c]
and ecx, 0xff
lea edi, [ebx + 0xa5]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xcc]
cmp eax, 0x800
jle 0x40ff94
mov eax, 0x800
push eax
mov word [ebx + 0xe5], ax
call fcn.0041f170
mov word [ebx + 0xe5], ax
mov eax, dword [ebp + 0xd0]
push eax
call fcn.0041f150
mov dword [ebx + 0xe7], eax
mov ecx, dword [ebp + 0xc8]
add esp, 8
cmp ecx, 0x1f
jle 0x40ffcd
mov ecx, 0x1f
mov byte [ebx + 0xc5], cl
mov esi, dword [ebp + 0x680]
and ecx, 0xff
lea edi, [ebx + 0xc6]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov al, byte [ebp + 0xee4]
test al, al
jne 0x410027
mov al, byte [ebp + 0xee5]
test al, al
jne 0x410027
mov al, byte [ebp + 0xee6]
test al, al
jne 0x410027
mov al, byte [ebp + 0xee7]
test al, al
je 0x410167
mov cl, byte [ebx + 0x11]
or cl, 8
mov byte [ebx + 0x11], cl
mov al, byte [ebp + 0xee8]
mov byte [ebx + 0xeb], al
mov cl, byte [ebp + 0xee9]
mov byte [ebx + 0xec], cl
mov dl, byte [ebp + 0xeea]
mov byte [ebx + 0xed], dl
mov al, byte [ebp + 0xeeb]
lea ecx, [ebp + 0xeec]
mov byte [ebx + 0xee], al
lea edx, [ebx + 0xef]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp + 0xefc]
push edx
call fcn.0041f150
mov dword [ebx + 0xff], eax
mov eax, dword [ebp + 0xf00]
push eax
call fcn.0041f150
mov dword [ebx + 0x103], eax
mov ecx, dword [ebp + 0xf04]
push ecx
call fcn.0041f150
mov dword [ebx + 0x107], eax
mov edx, dword [ebp + 0xf08]
push edx
call fcn.0041f150
mov dword [ebx + 0x10b], eax
mov al, byte [ebp + 0xee4]
add esp, 0x10
test al, al
je 0x4100f4
mov eax, dword [ebp + 0xefc]
cmp esi, eax
jl 0x4100e7
mov esi, eax
mov dword [esp + 0x18], esi
add eax, 7
cmp edi, eax
jg 0x4100f4
mov edi, eax
mov dword [esp + 0x14], edi
mov al, byte [ebp + 0xee5]
test al, al
je 0x41011b
mov eax, dword [ebp + 0xf00]
cmp esi, eax
jl 0x41010e
mov esi, eax
mov dword [esp + 0x18], esi
add eax, 7
cmp edi, eax
jg 0x41011b
mov edi, eax
mov dword [esp + 0x14], edi
mov al, byte [ebp + 0xee6]
test al, al
je 0x410142
mov eax, dword [ebp + 0xf04]
cmp esi, eax
jl 0x410135
mov esi, eax
mov dword [esp + 0x18], esi
add eax, 7
cmp edi, eax
jg 0x410142
mov edi, eax
mov dword [esp + 0x14], edi
mov al, byte [ebp + 0xee7]
test al, al
je 0x410167
mov eax, dword [ebp + 0xf08]
cmp esi, eax
jl 0x41015a
mov dword [esp + 0x18], eax
add eax, 7
cmp edi, eax
jg 0x410167
mov edi, eax
mov dword [esp + 0x14], edi
mov eax, dword [ebp + 0x678]
test byte [eax + 0xf], 2
je 0x410194
mov eax, dword [ebp + 0x11c]
xor ecx, ecx
shl eax, 5
mov cl, byte [eax + 0x422734]
mov eax, dword [eax + 0x422724]
sub eax, ecx
cmp edi, eax
jg 0x410194
mov dword [esp + 0x14], eax
mov edx, dword [ebp + 0x11c]
shl edx, 5
mov eax, dword [edx + 0x422724]
push eax
call fcn.0041f150
mov dword [ebx + 0x10f], eax
mov eax, dword [ebp + 0x11c]
shl eax, 5
mov ecx, dword [eax + 0x422728]
mov edi, dword [eax + 0x422724]
add ecx, edi
push ecx
call fcn.0041f150
mov dword [ebx + 0x113], eax
mov eax, dword [ebp + 0x16c]
add esp, 8
cmp eax, 0x10
jle 0x4101e5
mov eax, 0x10
mov dl, 0xa
imul dl
test al, al
mov byte [ebx + 0x117], al
jne 0x4101fa
mov byte [ebx + 0x117], 0x32
mov al, byte [ebp + 0xf0c]
test al, al
je 0x41025e
mov al, byte [ebp + 0xf10]
lea esi, [ebp + 0xf18]
mov byte [ebx + 0x118], al
mov cl, byte [ebp + 0xf14]
mov byte [ebx + 0x119], cl
mov ecx, dword [ebp + 0xf10]
mov edx, ecx
lea edi, [ebx + 0x11a]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xf14]
lea esi, [ebp + 0x1018]
mov eax, ecx
lea edi, [ebx + 0x15a]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41026c
mov byte [ebx + 0x118], 0
mov byte [ebx + 0x119], 0
mov ecx, dword [ebp + 0x678]
test byte [ecx + 0xf], 2
je 0x4102b9
mov eax, dword [ebp + 0x11c]
shl eax, 5
mov ecx, dword [eax + 0x422718]
and ecx, 0x7f8000
cmp ecx, 0x168000
jae 0x4102a7
mov eax, dword [eax + 0x422724]
mov edx, dword [esp + 0x14]
cmp edx, eax
jg 0x4102a7
mov dword [esp + 0x14], eax
cmp ecx, 0xc8000
jb 0x4102b5
or byte [ebx + 0x11], 0x80
jmp 0x4102b9
or byte [ebx + 0x12], 1
mov al, byte [ebp + 0x39]
test al, al
je 0x4102f1
mov eax, dword [ebp + 0x11c]
shl eax, 5
test byte [eax + 0x422718], 8
je 0x4102ed
mov edx, dword [eax + 0x422730]
sub edx, 0x800
push edx
call fcn.0041f150
add esp, 4
mov dword [ebx + 0x113], eax
or byte [ebx + 0x12], 2
mov al, byte [ebp + 0x188]
mov esi, dword [esp + 0x14]
mov byte [ebx + 0x19a], al
mov cl, byte [ebp + 0x18c]
mov byte [ebx + 0x19b], cl
mov dl, byte [ebp + 0x190]
mov byte [ebx + 0x19c], dl
mov eax, dword [ebp + 0x66c]
push 0
push esi
push eax
mov ecx, ebp
call fcn.00403170
push eax
call fcn.0041f170
mov word [ebx + 4], ax
lea eax, [esi + 0x7f]
cdq
and edx, 0x7f
mov esi, dword [esp + 0x1c]
add eax, edx
add esp, 4
mov edi, eax
mov eax, dword [ebp + 0x11c]
shl eax, 5
sar edi, 7
mov ecx, dword [eax + 0x422718]
and esi, 0xfffffe00
mov edx, ecx
and edx, 0x7f8000
shl edi, 7
cmp edx, 0xc8000
jb 0x41038c
test cl, 0x20
je 0x41038c
xor ecx, ecx
mov cl, byte [eax + 0x422734]
mov eax, dword [eax + 0x422724]
sub eax, ecx
cmp edi, eax
jl 0x41038c
mov edi, eax
mov edx, dword [ebp + 0xfc]
push edx
call fcn.0041f150
push edi
mov dword [ebx + 6], eax
call fcn.0041f150
push esi
mov dword [ebx + 0x1b5], eax
call fcn.0041f150
mov dword [ebx + 0x19d], eax
mov al, byte [ebp + 0x25]
add esp, 0xc
test al, al
je 0x41053b
mov eax, dword [ebp + 0xf0]
mov cl, byte [ebp + 0x10c]
neg eax
sbb al, al
lea edx, [esp + 0x15]
and al, 2
push edx
push 2
add al, 3
mov byte [esp + 0x1e], cl
push 0
push 0x40
mov ecx, ebp
mov byte [esp + 0x24], 0xff
mov byte [esp + 0x25], al
call fcn.00412210
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x13]
mov ecx, ebp
push eax
push 1
push 0
push 1
mov byte [esp + 0x23], 4
call fcn.00412210
mov eax, dword [ebp + 0x16c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
shl ecx, 3
push ecx
mov ecx, ebp
call fcn.00403be0
push 1
push 0
mov ecx, ebp
call fcn.00403970
mov al, byte [ebp + 0x23]
test al, al
je 0x41074d
mov ecx, ebp
call fcn.00403c00
test al, al
jne 0x41075a
lea edx, [ebp + 0x6b6]
push 1
push edx
mov ecx, ebp
call fcn.00403970
test al, al
je 0x410438
mov al, byte [ebp + 0x25]
test al, al
je 0x410484
mov eax, dword [ebp + 0x1c4]
test eax, eax
je 0x410484
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
xor eax, eax
lea esi, [ebx + 0x1a1]
mov ah, byte [ebp + 0x6b6]
mov al, byte [ebp + 0x6b7]
push eax
call fcn.0041f170
mov word [esi], ax
mov al, byte [ebp + 0x170]
add esp, 4
mov byte [ebx + 0x1a7], al
mov cl, byte [ebp + 0x174]
push esi
push 2
mov byte [ebx + 0x1a8], cl
push 0
push 2
mov ecx, ebp
call fcn.00412210
mov eax, dword [ebp + 0x16c]
mov ecx, ebp
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
push edx
call fcn.00403be0
push 1
push 0
mov ecx, ebp
call fcn.00403970
mov al, byte [ebp + 0x23]
test al, al
je 0x41074d
mov ecx, ebp
call fcn.00403c00
test al, al
jne 0x41075a
lea eax, [ebp + 0x6b6]
push 1
push eax
mov ecx, ebp
call fcn.00403970
test al, al
je 0x4104ef
mov al, byte [ebp + 0x25]
test al, al
je 0x41053b
mov eax, dword [ebp + 0x1c4]
test eax, eax
je 0x41053b
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
mov eax, dword [ebp + 0x664]
push 4
push 0x3fc
push eax
mov ecx, ebp
call fcn.00403170
push eax
call fcn.0041f170
add esp, 4
add edi, 0x800
mov word [ebx + 2], ax
mov ecx, ebp
push 0x5222
mov dword [ebp + 0x100], edi
call fcn.00402fa0
push eax
push ebp
call fcn.00402fe0
add esp, 8
mov ecx, ebp
push 0
push 0
call fcn.00403110
mov eax, dword [ebp + 0x100]
xor ebx, ebx
test eax, eax
mov dword [esp + 0x14], eax
mov byte [ebp + 0xab6], 0xf4
jle 0x4106fa
jmp 0x4105ab
mov eax, dword [esp + 0x14]
mov cl, byte [ebp + 0x25]
test cl, cl
je 0x4105c4
cmp eax, 0x38
jge 0x4105bd
mov byte [esp + 0x18], al
jmp 0x4105d4
mov byte [esp + 0x18], 0x38
jmp 0x4105d4
cmp eax, 0x80
mov byte [esp + 0x18], al
jl 0x4105d4
mov byte [esp + 0x18], 0x80
test cl, cl
je 0x4105f2
mov ecx, dword [ebp + 0x664]
mov esi, dword [esp + 0x18]
add ecx, ebx
push ecx
push esi
push ebx
push 0x49
mov ecx, ebp
call fcn.00412210
jmp 0x410640
mov esi, dword [ebp + 0x664]
mov edx, ebx
xor eax, eax
add esi, ebx
shr edx, 0x10
mov al, bh
lea edi, [ebp + 0xaba]
mov ecx, 0x20
mov byte [ebp + 0xab7], dl
mov byte [ebp + 0xab8], al
mov byte [ebp + 0xab9], bl
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x18]
lea eax, [ebp + 0xab6]
mov ecx, esi
and ecx, 0xff
add ecx, 4
push ecx
push eax
mov ecx, ebp
call fcn.004037d0
push 0x7d0
mov ecx, ebp
call fcn.00403be0
push 1
push 0
mov ecx, ebp
call fcn.00403970
mov al, byte [ebp + 0x23]
test al, al
je 0x41074d
mov ecx, ebp
call fcn.00403c00
test al, al
jne 0x41075a
lea edx, [ebp + 0x6b6]
push 1
push edx
mov ecx, ebp
call fcn.00403970
test al, al
je 0x410657
mov al, byte [ebp + 0x25]
test al, al
je 0x4106af
mov ecx, dword [ebp + 0x1c4]
test ecx, ecx
jne 0x41052e
test al, al
je 0x4106af
cmp byte [ebp + 0x6b6], 0x54
je 0x4106d0
test al, al
jne 0x41052e
mov al, byte [ebp + 0x6b6]
mov cl, byte [ebp + 0xab6]
cmp al, cl
jne 0x41052e
cmp byte [ebp + 0x6b7], 0x54
jne 0x41052e
mov ecx, dword [ebp + 0x100]
push ecx
push ebx
mov ecx, ebp
call fcn.00403110
mov ecx, dword [esp + 0x14]
mov eax, esi
and eax, 0xff
sub ecx, eax
add ebx, eax
test ecx, ecx
mov dword [esp + 0x14], ecx
jg 0x4105a7
push 0
push 0
mov ecx, ebp
call fcn.00403110
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
sub eax, ebx
sub esp, 8
mov dword [esp + 0x24], eax
mov ecx, ebp
fild qword [esp + 0x24]
fmul dword [0x42b9f0]
fstp qword [esp]
push 0x521f
call fcn.00402fa0
push eax
push ebp
call fcn.00402fe0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x14
ret