Function at 0x410040
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x47c4b3
mov eax, dword fs:[0]
push eax
mov eax, 0x119c
call fcn.0045e3b0
mov eax, dword [0x4a05d0]
xor eax, esp
mov dword [esp + 0x1198], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a05d0]
xor eax, esp
push eax
lea eax, [esp + 0x11b0]
mov dword fs:[0], eax
mov edi, dword [esp + 0x11c4]
mov ebp, dword [esp + 0x11c0]
test edi, edi
jl 0x410559
cmp edi, dword [ebp + 0xf98]
jge 0x410559
mov eax, dword [ebp + 0xf94]
lea ecx, [edi*4]
add eax, ecx
mov eax, dword [eax]
sub eax, 0x10
push eax
mov dword [esp + 0x2c], ecx
call fcn.00409fc0
lea esi, [eax + 0x10]
add esp, 4
mov dword [esp + 0x24], esi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x4c]
push 0x486bdc
push ecx
mov dword [esp + 0x11c4], 0
call fcn.00408d30
add esp, 0xc
push 0x486bd4
push eax
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0x11c4], 1
call fcn.00408c50
add esp, 0xc
mov byte [esp + 0x11b8], 3
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41012e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x4a9600]
shr ecx, 5
test cl, 1
je 0x41058d
mov ebx, dword [esp + 0x2c]
push 0
mov eax, 4
mov ecx, 0x4a1ac0
call fcn.00406880
add esp, 4
cmp eax, 6
jne 0x41055e
lea eax, [ebp + 0xfc0]
mov ebx, edi
call fcn.004117d0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [ebx]
mov eax, 0x10624dd3
mul edx
mov ebx, edx
shr ebx, 6
cmp dword [esi - 0xc], 0
jge 0x410191
or eax, 0xffffffff
jmp 0x4101ac
push 0x486384
push esi
call fcn.00459abe
add esp, 8
test eax, eax
jne 0x4101a8
or eax, 0xffffffff
jmp 0x4101ac
sub eax, esi
sar eax, 1
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
call fcn.004116c0
push 0x200
mov byte [esp + 0x11bc], 4
call fcn.00439af0
add esp, 4
push str.http:__record.4399.com_d.php_aweb.onlinegame_sserverS_slength_ldcid
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
call fcn.0040a630
mov esi, eax
mov byte [esp + 0x11b8], 5
call fcn.00413640
push eax
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.00408c50
add esp, 0xc
mov esi, eax
lea eax, [ebp + 0xfd8]
push edi
mov byte [esp + 0x11bc], 6
call fcn.00411910
add eax, 0x38
cmp dword [eax + 0x18], 8
jb 0x410224
mov eax, dword [eax + 4]
jmp 0x410227
add eax, 4
mov edx, dword [esp + 0x20]
mov ecx, dword [esi]
push ebx
push edx
push eax
mov eax, dword [esp + 0x20]
push ecx
push pe_nt_image_headers32
push eax
call fcn.00459cf8
mov byte [esp + 0x11d0], 5
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
add esp, 0x18
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41026b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x11b8], 4
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410293
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp + 0xfcc]
cmp esi, dword [ebp + 0xfd0]
jbe 0x4102a6
call fcn.0045bac4
mov edi, dword [ebp + 0xfc0]
mov ebx, edi
mov dword [esp + 0x1c], esi
test edi, edi
jne 0x4102d0
call fcn.0045bac4
xor eax, eax
mov ecx, dword [esp + 0x28]
add esi, ecx
cmp esi, dword [eax + 0x10]
ja 0x4102db
test edi, edi
je 0x4102d4
mov edi, dword [edi]
jmp 0x4102d6
mov eax, dword [edi]
jmp 0x4102bd
xor edi, edi
cmp esi, dword [edi + 0xc]
jae 0x4102e0
call fcn.0045bac4
push esi
push ebx
lea edi, [esp + 0x20]
lea esi, [ebp + 0xfc0]
call fcn.00411850
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push edx
push 0x40db10
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
xor eax, eax
push 0x2e
push eax
lea ecx, [esp + 0x56]
push ecx
mov word [esp + 0x58], ax
call fcn.0045db90
add esp, 0xc
lea esi, [esp + 0x4c]
call fcn.00408080
xor edx, edx
push 0x7e
push edx
lea eax, [esp + 0xb6]
push eax
mov word [esp + 0xb8], dx
call fcn.0045db90
add esp, 0xc
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x1b6]
push edx
mov word [esp + 0x1b8], cx
call fcn.0045db90
add esp, 0xc
push 0x800
call fcn.00439af0
add esp, 4
mov esi, eax
lea eax, [esp + 0xac]
push 0x400
push eax
mov ecx, 0x48642c
call fcn.004068f0
add esp, 8
lea ecx, [esp + 0x1ac]
push 0x400
push ecx
call fcn.00413410
mov ecx, eax
call fcn.004068f0
add esp, 8
lea edx, [esp + 0x1ac]
push edx
lea eax, [esp + 0x50]
push 0x48538c
push eax
call fcn.004136b0
push eax
call fcn.00413640
push eax
call fcn.00413800
push eax
call fcn.00413790
push eax
call fcn.00413720
push eax
call fcn.004134f0
push eax
lea ecx, [esp + 0xd0]
push ecx
push 0x486438
push 0x485398
push 0x400
push esi
call fcn.00459cf8
add esp, 0x38
push 0
push 0
push esi
push 0x40db10
push 0
push 0
call edi
push eax
call ebx
mov esi, dword [esp + 0x11c4]
cmp esi, dword [ebp + 0xf84]
lea ebx, [ebp + 0xf7c]
jge 0x410559
mov edx, dword [ebx + 4]
mov eax, dword [edx + esi*4]
push 1
push esi
mov ecx, ebx
mov dword [esp + 0x1c], eax
call fcn.0043cafa
push 1
push esi
lea ecx, [ebp + 0xf90]
call fcn.0043cd56
mov edi, dword [ebp + 0xfe4]
cmp edi, dword [ebp + 0xfe8]
jbe 0x41046d
call fcn.0045bac4
mov ecx, dword [ebp + 0xfd8]
lea edx, [esp + 0x30]
mov dword [esp + 0x18], ecx
push edx
mov ecx, esi
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], edi
call fcn.00411ae0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x20]
push eax
lea edi, [ebp + 0xfd8]
call fcn.00411a50
mov eax, dword [ebp + 0xf84]
cmp esi, eax
jl 0x4104af
lea esi, [eax - 1]
test esi, esi
jge 0x410512
mov ecx, dword [esp + 0x14]
push ecx
or esi, 0xffffffff
mov dword [ebp + 0xfbc], esi
mov dword [ebp + 0xfb8], esi
call fcn.00443a23
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x60]
call eax
mov edx, dword [ebp]
mov eax, dword [edx + 0x15c]
mov ecx, ebp
call eax
mov byte [esp + 0x11b8], 3
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov edx, esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4109e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4109e2
cmp esi, dword [ebx + 8]
jge 0x410559
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + esi*4]
push eax
mov edi, ebp
call fcn.00410b70
mov eax, dword [ebp + 0xf98]
imul eax, eax, 0xb0
push 1
push 0x10
push 0x1c
push 5
add eax, 0x82
push eax
lea ecx, [ebp + 0x6d0]
mov dword [ebp + 0xfb4], esi
call fcn.0043fb81
mov edx, dword [esp + 0x14]
jmp 0x41095e
call fcn.00439d70
imul edi, edi, 0xb0
lea ecx, [edi + 0x82]
add edi, 0x132
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 3
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], 0x19
jmp 0x4109c2
lea eax, [ebp + 0xfc0]
mov ebx, edi
call fcn.004117d0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [ebx]
mov eax, 0x10624dd3
mul edx
mov ebx, edx
shr ebx, 6
cmp dword [esi - 0xc], 0
jge 0x4105bd
or eax, 0xffffffff
jmp 0x4105d8
push 0x486384
push esi
call fcn.00459abe
add esp, 8
test eax, eax
jne 0x4105d4
or eax, 0xffffffff
jmp 0x4105d8
sub eax, esi
sar eax, 1
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
call fcn.004116c0
push 0x200
mov byte [esp + 0x11bc], 7
call fcn.00439af0
add esp, 4
push str.http:__record.4399.com_d.php_aweb.onlinegame_sserverS_slength_ldcid
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], eax
call fcn.0040a630
mov esi, eax
mov byte [esp + 0x11b8], 8
call fcn.00413640
push eax
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.00408c50
add esp, 0xc
mov esi, eax
lea eax, [ebp + 0xfd8]
push edi
mov byte [esp + 0x11bc], 9
call fcn.00411910
add eax, 0x38
cmp dword [eax + 0x18], 8
jb 0x410650
mov eax, dword [eax + 4]
jmp 0x410653
add eax, 4
mov edx, dword [esp + 0x20]
mov ecx, dword [esi]
push ebx
push edx
push eax
mov eax, dword [esp + 0x20]
push ecx
push pe_nt_image_headers32
push eax
call fcn.00459cf8
mov byte [esp + 0x11d0], 8
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x18
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410697
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x11b8], 7
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4106bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp + 0xfcc]
cmp esi, dword [ebp + 0xfd0]
jbe 0x4106d2
call fcn.0045bac4
mov edi, dword [ebp + 0xfc0]
mov ebx, edi
mov dword [esp + 0x1c], esi
test edi, edi
jne 0x4106fc
call fcn.0045bac4
xor eax, eax
mov ecx, dword [esp + 0x28]
add esi, ecx
cmp esi, dword [eax + 0x10]
ja 0x410707
test edi, edi
je 0x410700
mov edi, dword [edi]
jmp 0x410702
mov eax, dword [edi]
jmp 0x4106e9
xor edi, edi
cmp esi, dword [edi + 0xc]
jae 0x41070c
call fcn.0045bac4
push esi
push ebx
lea edi, [esp + 0x20]
lea esi, [ebp + 0xfc0]
call fcn.00411850
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push edx
push 0x40db10
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
xor eax, eax
push 0x2e
push eax
lea ecx, [esp + 0x86]
push ecx
mov word [esp + 0x88], ax
call fcn.0045db90
add esp, 0xc
lea esi, [esp + 0x7c]
call fcn.00408080
xor edx, edx
push 0x7e
push edx
lea eax, [esp + 0x136]
push eax
mov word [esp + 0x138], dx
call fcn.0045db90
add esp, 0xc
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x9b6]
push edx
mov word [esp + 0x9b8], cx
call fcn.0045db90
add esp, 0xc
push 0x800
call fcn.00439af0
add esp, 4
mov esi, eax
lea eax, [esp + 0x12c]
push 0x400
push eax
mov ecx, 0x48642c
call fcn.004068f0
add esp, 8
lea ecx, [esp + 0x9ac]
push 0x400
push ecx
call fcn.00413410
mov ecx, eax
call fcn.004068f0
add esp, 8
lea edx, [esp + 0x9ac]
push edx
lea eax, [esp + 0x80]
push 0x48538c
push eax
call fcn.004136b0
push eax
call fcn.00413640
push eax
call fcn.00413800
push eax
call fcn.00413790
push eax
call fcn.00413720
push eax
call fcn.004134f0
push eax
lea ecx, [esp + 0x150]
push ecx
push 0x486438
push 0x485398
push 0x400
push esi
call fcn.00459cf8
add esp, 0x38
push 0
push 0
push esi
push 0x40db10
push 0
push 0
call edi
push eax
call ebx
mov esi, dword [esp + 0x11c4]
cmp esi, dword [ebp + 0xf84]
lea ebx, [ebp + 0xf7c]
jge 0x410559
mov edx, dword [ebx + 4]
mov eax, dword [edx + esi*4]
push 1
push esi
mov ecx, ebx
mov dword [esp + 0x30], eax
call fcn.0043cafa
push 1
push esi
lea ecx, [ebp + 0xf90]
call fcn.0043cd56
mov edi, dword [ebp + 0xfe4]
cmp edi, dword [ebp + 0xfe8]
jbe 0x4108a2
call fcn.0045bac4
mov eax, dword [ebp + 0xfd8]
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
test eax, eax
jne 0x4108d7
call fcn.0045bac4
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov edx, esi
imul edx, edx, 0x54
add edi, edx
cmp edi, dword [ecx + 0x10]
ja 0x4108e2
test eax, eax
je 0x4108db
mov eax, dword [eax]
jmp 0x4108dd
mov ecx, dword [eax]
jmp 0x4108c3
xor eax, eax
cmp edi, dword [eax + 0xc]
jae 0x4108e7
call fcn.0045bac4
mov eax, dword [esp + 0x18]
push edi
push eax
lea ecx, [esp + 0x20]
push ecx
lea edi, [ebp + 0xfd8]
call fcn.00411a50
mov eax, dword [ebp + 0xf84]
cmp esi, eax
jl 0x41090a
lea esi, [eax - 1]
test esi, esi
jge 0x410918
mov edx, dword [esp + 0x28]
push edx
jmp 0x4104b8
cmp esi, dword [ebx + 8]
jge 0x410559
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + esi*4]
push eax
mov edi, ebp
call fcn.00410b70
mov eax, dword [ebp + 0xf98]
imul eax, eax, 0xb0
push 1
push 0x10
push 0x1c
push 5
add eax, 0x82
push eax
lea ecx, [ebp + 0x6d0]
mov dword [ebp + 0xfb4], esi
call fcn.0043fb81
mov edx, dword [esp + 0x28]
mov eax, dword [ebp + 0xf84]
imul eax, eax, 0xb0
add eax, 0x132
mov ebx, 3
push edx
mov dword [esp + 0x3c], 0x82
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 0x19
call fcn.00443a23
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x60]
call eax
mov byte [esp + 0x11b8], bl
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4109c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebp + 0x20]
push 1
lea ecx, [esp + 0x3c]
or esi, 0xffffffff
push ecx
push edx
mov dword [ebp + 0xfbc], esi
mov dword [ebp + 0xfb8], esi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [esp + 0x11b8], 0
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov edx, esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410a09
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x11b8], esi
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x410a2d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x11b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1198]
xor ecx, esp
call fcn.004597c7
add esp, 0x11a8
ret 8