Function at 0x4ef1f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
sub esp, 0xc44
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0xc44], eax
push 0x68
mov eax, 0x5e9f22
call fcn.0059ca57
mov eax, dword [ebp + 0xc54]
mov edi, dword [ebp + 0xc50]
mov esi, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc58]
xor ebx, ebx
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x14], eax
mov dword [esi + 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 1
call fcn.0048f7c7
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.00427139
push 0x22
pop eax
push 0x3fe
mov word [ebp + 0x844], ax
lea eax, [ebp + 0x846]
push ebx
push eax
mov byte [ebp - 4], 2
call fcn.0059cb30
add esp, 0xc
mov ecx, esi
call fcn.004ef134
cmp eax, ebx
jne 0x4ef2d2
lea ecx, [ebp]
mov dword [esi + 0x18], 0x13
mov byte [ebp - 4], 1
call fcn.0042719c
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], bl
call fcn.0048ea4e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc44]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0xc48
leave
ret 0xc
push 2
push ebx
push ebx
call dword [esi + 0x228]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x4ef316
lea ecx, [ebp - 0x74]
call fcn.0048ed38
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 6
mov dword [esi + 0x18], eax
cmp dword [ebp - 0x14], ebx
je 0x4ef571
mov ecx, dword [ebp - 0x14]
call fcn.0046e2fb
mov ecx, dword [ebp - 0x14]
call fcn.0046e2fb
jmp 0x4ef549
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x4ef322
call fcn.0046e2fb
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x844]
push eax
call edi
push 0x6107ac
lea eax, [ebp + 0x844]
push eax
call edi
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x844]
push eax
push ebx
push 3
push 0x10
push 0xf01ff
push str.Passcape_Loader_Service
mov edi, str.PasscapeLoader
push edi
push dword [ebp - 0x20]
call dword [esi + 0x224]
mov dword [ebp - 0x18], eax
cmp eax, ebx
jne 0x4ef45f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4ef3d8
lea ecx, [ebp + 0x438]
call fcn.004aafa5
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0x438]
mov byte [ebp - 4], 3
call fcn.004aafcd
push str.SYSTEMCurrentControlSetServicesPasscapeLoader
lea ecx, [ebp + 0x438]
call fcn.004ac1aa
mov ecx, dword [ebp - 0x14]
mov dword [esi + 0x18], 4
cmp ecx, ebx
je 0x4ef3c4
call fcn.0046e2fb
lea ecx, [ebp + 0x438]
mov byte [ebp - 4], 2
call fcn.004ac1a5
jmp 0x4ef549
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x4ef3fc
mov dword [esi + 0x18], 4
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x4ef555
jmp 0x4ef30c
push dword [ebp - 0x20]
call dword [esi + 0x23c]
push 0xf01ff
push edi
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
call dword [esi + 0x220]
mov dword [ebp - 0x18], eax
cmp eax, ebx
jne 0x4ef435
cmp dword [ebp - 0x1c], ebx
je 0x4ef42c
push dword [ebp - 0x1c]
call dword [esi + 0x240]
mov dword [esi + 0x18], 5
jmp 0x4ef3ec
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x844]
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [esi + 0x244]
cmp dword [ebp - 0x1c], ebx
je 0x4ef45f
push dword [ebp - 0x1c]
call dword [esi + 0x240]
mov edi, dword [ebp - 0x24]
push edi
mov dword [ebp - 0x38], edi
call fcn.0059bf90
lea eax, [eax + edi + 1]
pop ecx
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
push eax
push 2
push dword [ebp - 0x18]
call dword [esi + 0x22c]
mov ecx, dword [ebp - 0x14]
cmp eax, ebx
jne 0x4ef495
mov dword [esi + 0x18], 7
jmp 0x4ef3ef
cmp ecx, ebx
je 0x4ef49e
call fcn.0046e2fb
lea eax, [ebp - 0x2c]
push eax
push 0x24
lea eax, [ebp - 0x5c]
push eax
push ebx
push dword [ebp - 0x18]
call dword [esi + 0x238]
cmp eax, ebx
jne 0x4ef4c2
mov dword [esi + 0x18], 8
jmp 0x4ef549
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x58], 2
mov eax, dword [ebp - 0x44]
push 0xa
xor edx, edx
pop ecx
div ecx
cmp eax, 0x3e8
jae 0x4ef4f2
mov eax, 0x7d0
jmp 0x4ef4fd
mov ecx, 0x2710
cmp eax, ecx
jbe 0x4ef4fd
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2c]
push eax
push 0x24
lea eax, [ebp - 0x5c]
push eax
push ebx
push dword [ebp - 0x18]
call dword [esi + 0x238]
cmp eax, ebx
je 0x4ef549
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x48], eax
jbe 0x4ef531
call edi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
jmp 0x4ef540
cmp dword [ebp - 0x44], ebx
je 0x4ef540
call edi
sub eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x44]
ja 0x4ef549
cmp dword [ebp - 0x58], 2
je 0x4ef4da
mov dword [ebp - 0x28], ebx
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x4ef555
call fcn.0046e2fb
cmp dword [ebp - 0x18], ebx
je 0x4ef563
push dword [ebp - 0x18]
call dword [esi + 0x230]
cmp dword [ebp - 0x20], ebx
je 0x4ef571
push dword [ebp - 0x20]
call dword [esi + 0x230]
xor eax, eax
cmp dword [ebp - 0x28], ebx
lea ecx, [ebp]
sete al
mov byte [ebp - 4], 1
mov esi, eax
call fcn.0042719c
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], bl
call fcn.0048ea4e
mov eax, esi
jmp 0x4ef2ad