Function at 0x541ae0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x28]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
lea eax, [ebp - 0x28]
mov edx, dword [0x47bce0]
call fcn.00406420
xor eax, eax
push ebp
push 0x541f30
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x4bc], eax
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x4c0], eax
cmp dword [ebp - 0x28], 0x1b
jne 0x541b33
mov byte [ebx + 0x3c], 0
mov byte [ebx + 0x3d], 0
cmp byte [ebx + 0x3c], 0
jne 0x541ecd
mov eax, dword [ebp - 0x28]
add eax, 0xfffffffb
cmp eax, 0x16
ja case.0x541b4f.8
movzx eax, byte [eax + 0x541b56]
jmp dword [eax*4 + 0x541b6d]
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x29], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x2d], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl case.0x541b4f.8
mov dword [ebx + 0x38], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0x17
mov edx, dword [0x5673b0]
cmp ebx, dword [edx]
jne 0x541df8
cmp eax, 0xbc3
jne 0x541bc0
mov eax, dword [0x566ba4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
call fcn.00532fd0
test al, al
je 0x541f14
cmp dword [ebp - 0x28], 0xbc5
jne 0x541bf9
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [0x5673b0]
mov eax, dword [eax]
mov ecx, dword [eax + 0x14]
mov eax, dword [0x5673b0]
mov eax, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [0x566ba4]
mov eax, dword [eax]
call fcn.00532e1c
test al, al
je 0x541f14
cmp dword [ebp - 0x28], 0xbc1
jne 0x541c32
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [0x5673b0]
mov eax, dword [eax]
mov ecx, dword [eax + 0x14]
mov eax, dword [0x5673b0]
mov eax, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [0x566ba4]
mov eax, dword [eax]
call fcn.00532e1c
test al, al
je 0x541f14
mov eax, dword [ebp - 0x28]
cmp eax, 0xbd0
jg 0x541c93
je case.0x541c50.3010
add eax, 0xfffff443
cmp eax, 0xe
ja case.0x541c50.3006
jmp dword [eax*4 + 0x541c57]
cmp eax, 0xbdd
jg 0x541cb9
je 0x541d98
sub eax, 0xbd1
je 0x541d5e
sub eax, 0xb
je 0x541d7b
jmp case.0x541c50.3006
add eax, 0xfffff406
sub eax, 3
jb case.0x541c50.3010
add eax, 0xffffff19
sub eax, 4
jae case.0x541c50.3006
lea eax, [ebx + 0x504]
lea edx, [ebp - 0x28]
mov ecx, dword [0x47bce0]
call fcn.00406540
sub dword [ebp - 0x28], 0xbb8
jmp case.0x541c50.3006
lea eax, [ebx + 0x504]
lea edx, [ebp - 0x28]
mov ecx, dword [0x47bce0]
call fcn.00406540
mov dword [ebp - 0x28], 5
jmp case.0x541c50.3006
cmp dword [ebx + 0x29], 0
je 0x541d41
cmp dword [ebx + 0x2d], 0
je 0x541d41
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
mov dword [ebx + 0x168], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
mov dword [ebx + 0x16c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x170], eax
lea eax, [ebx + 0x504]
lea edx, [ebp - 0x28]
mov ecx, dword [0x47bce0]
call fcn.00406540
mov dword [ebp - 0x28], 0xfe2d
jmp case.0x541c50.3006
lea eax, [ebx + 0x504]
lea edx, [ebp - 0x28]
mov ecx, dword [0x47bce0]
call fcn.00406540
mov dword [ebp - 0x28], 8
jmp case.0x541c50.3006
lea eax, [ebx + 0x504]
lea edx, [ebp - 0x28]
mov ecx, dword [0x47bce0]
call fcn.00406540
mov dword [ebp - 0x28], 0x19
jmp case.0x541c50.3006
lea eax, [ebx + 0x504]
lea edx, [ebp - 0x28]
mov ecx, dword [0x47bce0]
call fcn.00406540
mov dword [ebp - 0x28], 0x1a
jmp case.0x541c50.3006
lea eax, [ebx + 0x504]
lea edx, [ebp - 0x28]
mov ecx, dword [0x47bce0]
call fcn.00406540
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
mov dword [ebx + 0x510], eax
sub dword [ebp - 0x28], 0xbb8
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x4b0], eax
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x4b4], eax
movzx eax, byte [ebx + 0x18]
mov dword [ebx + 0x4b8], eax
mov eax, dword [ebp - 0x28]
sub eax, 0x11
je 0x541e4e
sub eax, 0xe
jne 0x541e93
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x258], eax
mov eax, dword [ebx + 0x44]
lea eax, [eax + eax*4]
mov edx, 0xc8
sub edx, eax
mov dword [ebp - 0x2c], edx
fild dword [ebp - 0x2c]
call fcn.00403670
cmp eax, 0x50
jle 0x541e37
mov dword [ebx + 0x494], eax
jmp 0x541e41
mov dword [ebx + 0x494], 0x50
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x24c], eax
jmp 0x541eb7
movzx eax, byte [ebp - 0x1c]
mov byte [ebx + 0x18], al
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x541eb7
mov esi, eax
lea edi, [ebx + 0x1bc]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x1bc], 0xffffffff
mov edx, dword [ebp - 0x24]
mov dword [ebx + 0x1d0], edx
mov edx, dword [ebp - 0x20]
mov dword [ebx + 0x1d4], edx
mov edx, 0x28
call fcn.00403120
jmp 0x541eb7
mov eax, dword [ebp - 0x28]
cmp eax, 0x27e
je 0x541eb7
cmp eax, 0x27f
je 0x541eb7
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x14], eax
movzx eax, byte [ebp - 0x1c]
mov byte [ebx + 0x18], al
mov eax, dword [ebp - 0x28]
mov dword [ebx + 0x22c], eax
mov eax, ebx
mov si, 0xffff
call fcn.00404844
jmp 0x541eea
mov eax, dword [ebp - 0x28]
cmp eax, 0x21
jne 0x541eea
mov dword [ebx + 0x22c], eax
mov eax, ebx
mov si, 0xffff
call fcn.00404844
mov byte [ebx + 0x3d], 1
mov eax, dword [ebp - 0x28]
cmp eax, 0x20
je 0x541ef7
cmp eax, 0x22
jne 0x541f09
mov byte [ebx + 0x3c], 1
mov eax, dword [0x566ba4]
mov eax, dword [eax]
mov edx, ebx
call fcn.00533c58
mov eax, ebx
mov si, 0xfff9
call fcn.00404844
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x541f37
lea eax, [ebp - 0x28]
mov edx, dword [0x47bce0]
call fcn.004062dc
ret