Function at 0x40dca0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x47aa03
mov eax, dword fs:[0]
push eax
mov eax, 0x1070
call fcn.004460e0
mov eax, dword [0x49c550]
xor eax, esp
mov dword [esp + 0x106c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49c550]
xor eax, esp
push eax
lea eax, [esp + 0x1084]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x1098]
mov esi, dword [esp + 0x1094]
mov dword [esp + 0x2c], ebx
xor ebp, ebp
lea ecx, [esp + 0x30]
mov dword [esp + 0x108c], ebp
call fcn.0042978e
mov edi, dword [esp + 0x109c]
push ebp
push 0x9001
push edi
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1098], 1
call fcn.00429cab
test eax, eax
jne 0x40dd5b
push edi
push str.Create__s_Failed_
call fcn.0040a510
add esp, 8
push 0x2000
push 0x3e9
push str..PatchThread.cpp
lea ecx, [esp + 0x4c]
call fcn.0040dc00
push 0x49205c
lea eax, [esp + 0x44]
push eax
call fcn.00444403
call fcn.004014e0
sub eax, ebp
je 0x40dd6e
sub eax, 1
jne 0x40dd9d
mov edi, dword [ebx + 0x24]
jmp 0x40dd99
mov eax, dword [ebx + 0x10]
push 1
push 2
push SysReAllocStringLen
push eax
push ebp
push 0x49a900
push 0x49a8dc
push ebp
push esi
call fcn.004482ee
add esp, 0x14
mov ecx, eax
call fcn.0042fed1
mov edi, eax
cmp edi, ebp
jne 0x40dddf
sub esp, 0x40
mov edi, esp
mov ecx, 0x10
mov esi, ebx
push str.Get__s_Failed_
rep movsd dword es:[edi], dword [esi]
call fcn.0040a510
add esp, 0x44
push 0x400
push 0x3fc
push str..PatchThread.cpp
lea ecx, [esp + 0x4c]
call fcn.0040dc00
push 0x49205c
lea ecx, [esp + 0x44]
push ecx
call fcn.00444403
mov eax, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 8]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esp + 0x1c], edx
cdq
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
call ebx
mov ebp, eax
mov edx, dword [edi]
mov edx, dword [edx + 0x34]
push 0x1000
lea eax, [esp + 0x84]
push eax
mov ecx, edi
call edx
xor ecx, ecx
add dword [esp + 0x14], eax
push eax
lea eax, [esp + 0x84]
adc dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x38]
call fcn.004294dc
call ebx
sub eax, ebp
cmp eax, 0x32
jb 0x40de90
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x3e8
push edx
push eax
add ebp, 0x32
call fcn.00446db0
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push ecx
push edx
push eax
call fcn.00446d40
movzx edx, ax
mov eax, dword [0x4a0cb8]
or edx, 0x3e80000
push edx
push 0xfc5
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x1c]
jne 0x40dea4
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x20]
je 0x40decb
mov ecx, 0x4a0bd8
call fcn.0040a260
mov esi, dword [0x49f3cc]
push 0x4a0be0
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
test esi, 0xfff02
je 0x40de0b
mov eax, dword [0x4a0cb8]
push 0
push 0
push 0xfc5
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [edi]
mov eax, dword [edx + 0x4c]
mov ecx, edi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 4]
push 1
mov ecx, edi
call eax
call fcn.004014e0
cmp eax, 1
jne 0x40df0d
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x28]
mov eax, dword [edx + 0xc]
add ecx, 0x28
call eax
lea ecx, [esp + 0x30]
call fcn.0042972c
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x1c]
jne 0x40df31
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x20]
jne 0x40df31
mov esi, 1
jmp 0x40df33
xor esi, esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x108c], 0
call fcn.00429915
mov eax, dword [esp + 0x109c]
add eax, 0xfffffff0
mov dword [esp + 0x108c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40df72
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1084]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x106c]
xor ecx, esp
call fcn.00443fd7
add esp, 0x107c
ret