Function at 0x494d14
Capabilities:
Access peb ldr_data
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
call fcn.00403fd8
mov eax, dword [ebp - 0xc]
call fcn.00403fd8
xor eax, eax
push ebp
push 0x4956e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x1424], 0
mov eax, dword [ebp - 4]
mov dl, byte [ebp + 0x14]
mov byte [eax + 0x1404], dl
mov eax, dword [ebp - 4]
mov byte [eax + 0x1368], 0
mov byte [ebp - 0x19], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x329], 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
call fcn.0048b820
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1360], 0
je 0x4956be
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00494228
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x308]
test edi, edi
je 0x494dce
mov eax, edi
mov dl, 1
mov ecx, dword [eax]
call dword [ecx - 4]
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x308], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1426], 2
jne 0x494e1c
cmp byte [esi], 0
je 0x494e1c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1360], 0
je 0x494e1c
mov ecx, 0x495700
mov dl, 0x14
mov eax, dword [ebp - 4]
call fcn.0048df60
mov eax, dword [ebp - 4]
mov dword [eax + 0x13f8], 0
mov dword [eax + 0x13fc], 0
mov eax, dword [ebp - 0xc]
call fcn.004092cc
mov byte [esi], 0
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x489a20]
call fcn.00489dd8
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x308], ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2c8]
mov eax, ebx
call fcn.0048e39c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov byte [eax + 0x310], 2
mov byte [eax + 0x300], 0
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x313]
mov byte [eax + 0x313], dl
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x318]
mov dword [eax + 0x318], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x142c]
mov dword [eax + 0xc8], edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x30], edx
mov dword [eax + 0x2c], 0x4974d0
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x8c]
mov dword [eax + 0x8c], ecx
mov ecx, dword [edx + 0x90]
mov dword [eax + 0x90], ecx
mov edx, dword [ebp - 4]
mov dword [eax + 0x28], edx
mov dword [eax + 0x24], 0x497614
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [eax + 0xf8], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 0xfc], edx
xor edx, edx
push ebp
push 0x4956b4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
call fcn.004091d4
test al, al
jne 0x494f0a
mov eax, dword [ebp - 0xc]
call fcn.004574b4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
call fcn.004092e4
xor eax, eax
push ebp
push 0x494f36
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x22
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x40f610]
call fcn.00413c48
mov dword [ebp - 0x20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494f76
cmp byte [ebp + 0x14], 1
je 0x494fac
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe0], 0xa
je 0x494fac
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe0], 0x10
je 0x494fac
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe0], 0xb
je 0x494fac
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe0], 0xd
jne 0x494fe4
mov byte [ebp + 0x14], 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004969ec
test al, al
je 0x494fe0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1360], 0
je 0x494fe0
mov eax, dword [ebp - 0x18]
mov edx, dword [0x54d6c4]
mov edx, dword [edx]
call fcn.00403f34
jne 0x494fe4
mov byte [ebp + 0x14], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1360], 0
jne 0x495004
mov eax, dword [ebp - 4]
mov byte [eax + 0x1424], 2
call fcn.004036bc
jmp 0x4956be
cmp byte [ebp + 0x14], 0
je 0x495044
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00494440
test al, al
jne 0x4950b6
mov eax, dword [ebp - 4]
mov byte [eax + 0x1424], 2
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x49161c]
call fcn.0040ba6c
call fcn.0040361c
jmp 0x4950b6
mov eax, dword [0x54d5d4]
mov eax, dword [eax]
call fcn.0043b290
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x140c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1408]
mov eax, dword [ebp - 4]
call fcn.004991b0
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x308]
mov dword [ebx + 0xf0], eax
mov eax, ebx
mov dl, 1
call fcn.0048c8b8
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0048f344
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.0048e4e0
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00403e2c
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00496e50
mov eax, dword [ebp - 4]
cmp byte [eax + 0x329], 0
jne 0x4950ce
mov eax, dword [ebp - 4]
cmp byte [eax + 0x32a], 0
je 0x4950d8
call fcn.004036bc
jmp 0x4956be
mov dl, 0xe
mov eax, dword [ebp - 4]
call fcn.004975bc
test al, al
je 0x4950f0
call fcn.004036bc
jmp 0x4956be
mov eax, dword [ebp - 4]
cmp word [eax + 0x112], 0
je 0x495121
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x110]
mov dword [eax + 0x110], ecx
mov ecx, dword [edx + 0x114]
mov dword [eax + 0x114], ecx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1360], 0
jne 0x495141
mov eax, dword [ebp - 4]
mov byte [eax + 0x1424], 2
call fcn.004036bc
jmp 0x4956be
cmp byte [esi], 0
je 0x49519b
cmp dword [ebp - 0x20], 0
je 0x49519b
cmp byte [esi], 0
je 0x495184
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1410], 0
je 0x495184
mov eax, dword [ebp - 0x20]
call fcn.004136ac
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1414]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, dword [ebp - 0x20]
call fcn.004136fc
mov eax, dword [ebp - 0x20]
call fcn.004136ac
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x13f8], eax
mov dword [ecx + 0x13fc], edx
cmp byte [esi], 0
je 0x4952bb
mov eax, dword [ebp - 4]
cmp dword [eax + 0x13fc], 0
jne 0x4951b7
cmp dword [eax + 0x13f8], 0
je 0x4952bb
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x141e]
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x141e], 0
xor eax, eax
push ebp
push 0x4952b4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push dword [eax + 0x13fc]
push dword [eax + 0x13f8]
lea eax, [ebp - 0x2c]
call fcn.00408e7c
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x495744
call fcn.00403e70
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.00493990
mov eax, dword [ebp - 4]
cmp word [eax + 0x2d8], 0x1a5
jne 0x49523c
mov eax, dword [ebp - 4]
mov byte [eax + 0x1424], 2
call fcn.004036bc
call fcn.004036bc
jmp 0x4956be
mov eax, dword [ebp - 4]
cmp word [eax + 0x2d8], 0x15e
je 0x495288
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1360], 0
je 0x495288
mov ecx, 0x495700
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.0048df60
mov eax, dword [ebp - 4]
mov dword [eax + 0x13f8], 0
mov dword [eax + 0x13fc], 0
push 0
push 0
mov eax, dword [ebp - 0x20]
call fcn.004136fc
push 0
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0049687c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4952d2
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0x21]
mov byte [eax + 0x141e], dl
ret
mov eax, dword [ebp - 4]
mov dword [eax + 0x13f8], 0
mov dword [eax + 0x13fc], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x329], 0
jne 0x4952ea
mov eax, dword [ebp - 4]
cmp byte [eax + 0x32a], 0
je 0x4952f4
call fcn.004036bc
jmp 0x4956be
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1360], 0
jne 0x495314
mov eax, dword [ebp - 4]
mov byte [eax + 0x1424], 2
call fcn.004036bc
jmp 0x4956be
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov dword [eax + 0x2e0], edx
mov dword [eax + 0x2dc], 0x4942a8
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov edx, 0x495754
call fcn.00403e70
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.00493990
mov dl, 0xe
mov eax, dword [ebp - 4]
call fcn.004975bc
test al, al
je 0x49535f
call fcn.004036bc
jmp 0x4956be
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1360], 0
jne 0x495375
call fcn.004036bc
jmp 0x4956be
mov eax, dword [ebp - 4]
test byte [eax + 0x2e9], 2
jne 0x495391
cmp byte [ebp + 0x14], 0
jne 0x495391
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00497b70
mov eax, dword [ebp - 4]
cmp word [eax + 0x138e], 0
je 0x4953b0
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1390]
call dword [ebx + 0x138c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0xf8]
mov dword [eax + 0xf8], ecx
mov ecx, dword [edx + 0xfc]
mov dword [eax + 0xfc], ecx
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x32c], eax
cmp dword [ebp - 0x20], 0
je 0x4953f0
lea eax, [ebp - 0x20]
call fcn.00455570
mov eax, dword [ebp - 4]
cmp byte [eax + 0x329], 0
jne 0x495419
mov eax, dword [ebp - 4]
cmp byte [eax + 0x32a], 0
jne 0x495419
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov edx, dword [ebp - 0xc]
call fcn.0048c408
mov eax, dword [ebp - 4]
cmp word [eax + 0x1396], 0
je 0x495438
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1398]
call dword [ebx + 0x1394]
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x32c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x32c], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x308]
mov ecx, dword [edx + 0x108]
mov dword [eax + 0xf8], ecx
mov ecx, dword [edx + 0x10c]
mov dword [eax + 0xfc], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
xor ecx, ecx
xor edx, edx
call fcn.0048dce0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x329], 0
jne 0x4954b7
mov eax, dword [ebp - 4]
cmp byte [eax + 0x32a], 0
jne 0x4954b7
mov eax, dword [ebp - 4]
cmp word [eax + 0x2d8], 0xc7
jge 0x4954b7
mov dx, 5
mov eax, dword [ebp - 4]
call fcn.0048e48c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x329], 0
jne 0x49556a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x32a], 0
jne 0x49556a
mov eax, dword [ebp - 4]
cmp word [eax + 0x2d8], 0xc7
jge 0x49556a
mov edx, 0x2710
mov eax, dword [ebp - 4]
call fcn.0048cbc4
mov eax, dword [ebp - 4]
mov byte [eax + 0x328], 1
xor edx, edx
push ebp
push 0x495563
push dword fs:[edx]
mov dword fs:[edx], esp
jmp 0x495522
push 0
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0049687c
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x2d8]
cmp ax, 0xc7
jge 0x495543
test ax, ax
je 0x495543
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1360], 0
jne 0x495510
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49556a
mov eax, dword [ebp - 4]
call fcn.0048cc14
mov eax, dword [ebp - 4]
mov byte [eax + 0x328], 0
ret
mov byte [ebp - 0x19], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4956be
cmp dword [ebp - 0x20], 0
je 0x495589
lea eax, [ebp - 0x20]
call fcn.00455570
mov eax, dword [ebp - 4]
cmp byte [eax + 0x329], 0
je 0x4955a7
push 0
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0049687c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1424], 0
jne 0x4955f9
mov eax, dword [ebp - 4]
cmp word [eax + 0x2d8], 0x12c
jle 0x4955f9
mov eax, dword [ebp - 4]
cmp word [eax + 0x2d8], 0x258
jge 0x4955f9
mov eax, dword [ebp - 0xc]
call fcn.004574e8
cmp edx, dword [ebp + 0xc]
jne 0x4955ef
cmp eax, dword [ebp + 8]
jne 0x4955ef
mov eax, dword [ebp - 4]
mov word [eax + 0x2d8], 0xc8
jmp 0x4955f9
mov eax, dword [ebp - 4]
mov byte [eax + 0x1424], 2
cmp byte [ebp - 0x19], 0
jne 0x49561e
mov eax, dword [ebp - 4]
cmp word [eax + 0x1396], 0
je 0x49561e
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1398]
call dword [ebx + 0x1394]
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x308]
test esi, esi
je 0x49563f
mov eax, esi
mov dl, 1
mov ecx, dword [eax]
call dword [ecx - 4]
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x308], edx
mov eax, dword [ebp - 4]
cmp word [eax + 0x2d8], 0x96
jne 0x49568c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1360], 0
je 0x49568c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x329], 0
jne 0x49568c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x32a], 0
jne 0x49568c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1368], 0
jne 0x49568c
mov cl, 1
mov edx, 0x495764
mov eax, dword [ebp - 4]
call fcn.00496700
cmp byte [ebp - 0x19], 0
je 0x4956b3
mov eax, dword [ebp - 4]
cmp word [eax + 0x13b6], 0
je 0x4956b3
mov ebx, dword [ebp - 4]
mov cl, 0xe
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x13b8]
call dword [ebx + 0x13b4]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4956ed
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00403bcc
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00403bcc
ret