Function at 0x4aa9e4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4aad7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4baf70]
call fcn.00405248
cmp ebx, eax
jg 0x4aad54
cmp byte [0x4b97d4], 0
je 0x4aaa4f
push 0x4aad94
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004087d0
push dword [ebp - 0xc]
push 0x4aadb0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403f78
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004ac77c
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [0x4baf70]
lea edi, [edx + eax*4]
cmp byte [edi], 0
je 0x4aab27
mov eax, dword [0x4baf90]
call fcn.00405248
test eax, eax
jl 0x4aaae6
inc eax
mov dword [ebp - 4], eax
xor ebx, ebx
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [0x4baf90]
mov eax, dword [eax + ebx*4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov edx, dword [edx + eax*8 + 8]
mov eax, dword [0x4baf90]
mov eax, dword [eax + ebx*4]
mov ecx, eax
shl eax, 3
sub eax, ecx
mov ecx, dword [0x4bae08]
mov eax, dword [ecx + eax*8 + 4]
lea ecx, [ebp - 0x14]
call fcn.004103a0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, 0x4aadbc
mov edx, 0x4aadbc
mov eax, esi
call fcn.004a8ef4
mov eax, dword [0x4baf90]
mov edx, dword [eax + ebx*4]
mov eax, esi
call fcn.004a09a8
inc ebx
dec dword [ebp - 4]
jne 0x4aaa7c
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, 0x4aadd4
mov edx, 0x4aadd4
mov eax, esi
call fcn.004a8ef4
push 0
mov eax, 0x4baf90
mov ecx, 1
mov edx, dword [0x46fe28]
call fcn.004053fc
add esp, 4
mov eax, dword [edi + 4]
test eax, eax
jle 0x4aab77
add dword [0x4baea8], eax
lea edx, [ebp - 0x18]
mov eax, dword [0x4baea8]
call fcn.004087d0
mov ecx, dword [ebp - 0x18]
mov edx, 0x4aadf0
mov eax, esi
call fcn.004935c8
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, 0x4aae0c
mov edx, 0x4aae0c
mov eax, esi
call fcn.004a8ef4
mov eax, dword [edi + 8]
test eax, eax
jle 0x4aabc7
add dword [0x4baea4], eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x4baea4]
call fcn.004087d0
mov ecx, dword [ebp - 0x1c]
mov edx, 0x4aae20
mov eax, esi
call fcn.004935c8
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, 0x4aae3c
mov edx, 0x4aae3c
mov eax, esi
call fcn.004a8ef4
mov eax, dword [edi + 0xc]
test eax, eax
jle 0x4aac26
cmp byte [0x4b97a0], 0
jne 0x4aabdd
add dword [0x4baeac], eax
lea edx, [ebp - 0x20]
mov eax, dword [0x4bafc4]
add eax, dword [0x4baeac]
call fcn.004087d0
mov ecx, dword [ebp - 0x20]
mov edx, 0x4aae50
mov eax, esi
call fcn.004935c8
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, 0x4aae6c
mov edx, 0x4aae6c
mov eax, esi
call fcn.004a8ef4
cmp dword [edi + 0x10], 0
jle 0x4aac60
call sub.kernel32.dll_GetTickCount
add eax, dword [edi + 0x10]
mov dword [0x4baebc], eax
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, 0x4aae80
mov edx, 0x4aae80
mov eax, esi
call fcn.004a8ef4
cmp byte [edi + 0x14], 0
je 0x4aad1a
mov eax, dword [0x4baf90]
call fcn.00405248
test eax, eax
jl 0x4aacf3
inc eax
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, dword [0x4baf90]
mov eax, dword [eax + ebx*4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov byte [edx + eax*8 + 0x15], 1
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [0x4baf90]
mov eax, dword [eax + ebx*4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov edx, dword [edx + eax*8 + 8]
mov eax, dword [0x4baf90]
mov eax, dword [eax + ebx*4]
mov ecx, eax
shl eax, 3
sub eax, ecx
mov ecx, dword [0x4bae08]
mov eax, dword [ecx + eax*8 + 4]
lea ecx, [ebp - 0x14]
call fcn.004103a0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, 0x4aae98
mov edx, 0x4aae98
mov eax, esi
call fcn.004a8ef4
inc ebx
dec dword [ebp - 4]
jne 0x4aac7e
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, 0x4aaeb4
mov edx, 0x4aaeb4
mov eax, esi
call fcn.004a8ef4
cmp dword [edi + 0x18], 0
jle 0x4aad54
call sub.kernel32.dll_GetTickCount
add eax, dword [edi + 0x18]
mov dword [0x4baeb8], eax
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, 0x4aaecc
mov edx, 0x4aaecc
mov eax, esi
call fcn.004a8ef4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aad83
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403c5c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403c5c
ret