Function at 0x10066740
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x1009c9b2
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100b8070]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x597c4]
cmp ecx, 2
je 0x1006679c
xor eax, eax
mov dword [ebp + 0x90], eax
mov dword [ebp + 0x98], eax
mov dword [ebp + 0x9c], eax
jmp 0x10067d3e
mov ebx, dword [eax + 0x5975c]
push eax
call fcn.1001ad10
push ebp
call fcn.10003bc0
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x59798]
xor edi, edi
cmp eax, edi
ja 0x100667fc
mov ecx, dword [0x100bb2cc]
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebx + 0xec], edi
mov eax, dword [ebp + 0x14]
add eax, 0x597d0
lea ebx, [esp + 0x3c]
mov dword [esp + 0x3c], 2
call fcn.1001d970
fld qword [0x100a97d8]
mov dword [eax], edi
fstp qword [ebp + 0x88]
jmp 0x10067d39
mov eax, ebp
call fcn.100015c0
mov esi, dword [ebp + 0x14]
add esi, 0x59790
cmp dword [esi + 8], edi
mov dword [esp + 0x40], esi
jne 0x1006682d
mov ecx, dword [0x100bb2cc]
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebx + 0xec], edi
jmp 0x10067d39
mov eax, dword [esi + 4]
mov edi, dword [eax]
cmp edi, eax
jne 0x1006683b
call fcn.10080d40
add edi, 8
mov ecx, edi
mov dword [esp + 0x1c], edi
call fcn.1007d1d0
fld dword [edi + 0xc]
fstp dword [esp + 0x60]
neg eax
fld dword [edi + 8]
sbb eax, eax
fstp dword [esp + 0x5c]
add eax, 1
fld dword [edi + 0x10]
mov dword [edi + 0x84], eax
fstp dword [esp + 0x64]
lea eax, [esp + 0x70]
fld dword [edi + 0x14]
lea ecx, [esp + 0x5c]
fstp dword [esp + 0x68]
fld dword [ebx + 0x34]
fstp dword [esp + 0x74]
fld dword [ebx + 0x30]
fstp dword [esp + 0x70]
fld dword [ebx + 0x38]
fstp dword [esp + 0x78]
fld dword [ebx + 0x3c]
fstp dword [esp + 0x7c]
call fcn.10003a50
fst qword [esp + 0x44]
fcomp qword [0x100a9868]
fnstsw ax
test ah, 0x41
jp 0x1006693d
fld dword [esp + 0x5c]
sub esp, 0x10
fsub dword [esp + 0x80]
fstp qword [esp + 8]
fld dword [esp + 0x70]
fsub dword [esp + 0x84]
fstp qword [esp]
call fcn.1006ddc0
fstp dword [esp + 0x34]
add esp, 4
fld dword [0x100a982c]
fstp dword [esp + 8]
fld dword [esp + 0x88]
fstp dword [esp + 4]
fld dword [esp + 0x30]
fstp dword [esp]
call fcn.100218b0
add esp, 0xc
test eax, eax
jne 0x10066911
fld dword [esp + 0x24]
push ecx
fstp dword [esp]
call fcn.10021920
call fcn.10055280
test eax, eax
jne 0x1006693d
mov eax, edi
call fcn.10003b20
cmp eax, 1
jbe 0x1006693d
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, edi
call fcn.1001b910
mov eax, esi
call fcn.10004a60
jmp 0x10067d39
call fcn.1007e120
test eax, eax
je 0x1006696d
mov eax, edi
call fcn.10003ac0
test eax, eax
jne 0x1006696d
mov al, 0
mov ecx, dword [0x100bb500]
mov byte [ecx], al
mov edx, dword [ebp + 0x14]
push edx
mov eax, edi
call fcn.1001b910
mov eax, esi
call fcn.10004a60
lea eax, [esp + 0x28]
push eax
mov ecx, str.Gouge
call fcn.10003700
lea ecx, [esp + 0x28]
lea edi, [ebp + 4]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x40], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov dword [esp + 0x3c], eax
mov dword [esp + 0xc0], 0xffffffff
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100669e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, str.CheapShot
call fcn.10003700
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 1
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x3c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov dword [esp + 0x20], eax
mov dword [esp + 0xc0], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10066a54
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, str.KidneyShot
call fcn.10003700
lea edx, [esp + 0x24]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 2
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x3c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov dword [esp + 0x34], eax
mov dword [esp + 0xc0], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10066ac6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, str.Backstab
call fcn.10003700
lea edx, [esp + 0x30]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 3
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x3c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov dword [esp + 0x18], eax
mov dword [esp + 0xc0], 0xffffffff
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10066b38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x6c]
push ecx
sub eax, 0x10
mov dword [esp + 0x3c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
cmp dword [esp + 0x18], 0
mov dword [esp + 0x38], eax
je 0x10066b7e
mov edx, dword [ebx]
mov eax, dword [edx + 0x7c]
mov ecx, ebx
call eax
cmp eax, 0x64
jne 0x10066b85
mov ecx, dword [esp + 0x18]
mov esi, dword [ecx]
call fcn.1007e040
test eax, eax
jne 0x10066b85
mov dword [ebp + 0x68], 0
cmp dword [esp + 0x18], 0
je 0x10066ba2
mov edx, dword [esp + 0x18]
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x10066ba2
mov dword [ebp + 0x68], 1
cmp dword [ebp + 0x68], 0
je 0x10066be6
cmp dword [esp + 0x20], 0
je 0x10066bc2
mov eax, dword [esp + 0x20]
mov esi, dword [eax]
mov eax, dword [esp + 0x1c]
call fcn.1006f610
test eax, eax
jne 0x10066bdc
cmp dword [esp + 0x34], 0
je 0x10066be6
mov ecx, dword [esp + 0x34]
mov esi, dword [ecx]
mov eax, dword [esp + 0x1c]
call fcn.1006f610
test eax, eax
je 0x10066be6
mov dword [esp + 0x24], 1
jmp 0x10066bee
mov dword [esp + 0x24], 0
cmp dword [esp + 0x24], 0
fld dword [ebx + 0x34]
fstp dword [ebp + 0x28]
fld dword [ebx + 0x30]
fstp dword [ebp + 0x24]
fld dword [ebx + 0x38]
fstp dword [ebp + 0x2c]
mov dword [ebp + 0x34], 0x211
jne 0x10066ea1
mov esi, dword [esp + 0x1c]
mov eax, esi
call fcn.10003ac0
fld qword [0x100a98a0]
test eax, eax
jne 0x10066ce2
fld qword [0x100a9870]
fld qword [esp + 0x44]
fcom st(1)
fnstsw ax
test ah, 1
jne 0x10066c74
fstp st(2)
mov dword [ebp + 0x34], 0x211
fld dword [esp + 0x60]
fld dword [esp + 0x74]
fsubr st(1)
fmul st(2)
fdiv st(3)
fsubp st(1)
fstp dword [ebp + 0x28]
fld dword [esp + 0x5c]
fld dword [esp + 0x70]
fsubr st(1)
fmulp st(2)
fxch st(1)
fdivrp st(2)
fsubrp st(1)
fstp dword [ebp + 0x24]
jmp 0x10066e6b
fstp st(1)
fld qword [0x100a9978]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x10066c92
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 1
je 0x10066cb4
jmp 0x10066c94
fstp st(1)
cmp dword [esp + 0x38], 0
je 0x10066cb4
mov edx, dword [esp + 0x38]
fstp st(0)
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
jne 0x10066e6b
fld qword [esp + 0x44]
fld dword [esp + 0x60]
mov dword [ebp + 0x34], 0x211
fld dword [esp + 0x74]
fsubr st(1)
fdiv st(2)
fsubp st(1)
fstp dword [ebp + 0x28]
fld dword [esp + 0x5c]
fld dword [esp + 0x70]
fsubr st(1)
fdivrp st(2)
fsubrp st(1)
fstp dword [ebp + 0x24]
jmp 0x10066e6b
fcomp qword [esp + 0x44]
fnstsw ax
test ah, 0x41
jp 0x10066e6b
mov eax, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x70]
push eax
push ecx
mov eax, esi
call fcn.10038030
test eax, eax
je 0x10066d4b
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ebp + 0x70], ecx
mov dword [ebp + 0x74], eax
fld dword [esi + 0xc]
fstp dword [esp + 0x50]
mov eax, dword [esp + 0x50]
fld dword [esi + 8]
fstp dword [esp + 0x4c]
mov edx, dword [esp + 0x4c]
fld dword [esi + 0x10]
mov dword [ebp + 0x78], edx
mov edx, dword [esp + 0x58]
fstp dword [esp + 0x54]
mov ecx, dword [esp + 0x54]
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x80], ecx
mov dword [ebp + 0x84], edx
jmp 0x10066e6b
fld qword [ebp + 0x88]
fld qword [esp + 0x44]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 1
je 0x10066d98
fstp st(0)
lea eax, [ebp + 0x78]
fld dword [esi + 0xc]
lea ecx, [esp + 0x4c]
fstp dword [esp + 0x50]
fld dword [esi + 8]
fstp dword [esp + 0x4c]
fld dword [esi + 0x10]
fstp dword [esp + 0x54]
call fcn.10003a50
fcomp qword [0x100a97b0]
fnstsw ax
test ah, 5
jp 0x10066e61
fld qword [esp + 0x44]
fld dword [esp + 0x60]
mov dword [ebp + 0x34], 0x211
fld dword [esp + 0x74]
fsubr st(1)
fdiv st(2)
fsubp st(1)
fstp dword [ebp + 0x28]
fld dword [esp + 0x5c]
fld dword [esp + 0x70]
fsubr st(1)
fdivrp st(2)
fsubrp st(1)
fstp dword [ebp + 0x24]
mov eax, dword [esi + 0x44]
mov esi, dword [esi + 0x48]
push esi
push eax
mov eax, ebx
call fcn.10003b80
test eax, eax
je 0x10066e26
mov eax, dword [esp + 0x1c]
call fcn.10003b20
cmp eax, 0x32
jb 0x10066e1f
cmp eax, 0x64
jne 0x10066e26
mov esi, dword [esp + 0x1c]
call fcn.1006f850
test eax, eax
jne 0x10066e26
fld dword [0x100a9970]
sub esp, 0xc
fstp dword [esp + 8]
fld dword [esp + 0x88]
fstp dword [esp + 4]
fld dword [esp + 0x74]
fstp dword [esp]
call fcn.100218b0
add esp, 0xc
test eax, eax
je 0x10066e26
mov dword [ebp + 0x34], 0x221
mov eax, dword [esp + 0x1c]
fld dword [eax + 0xc]
fstp dword [esp + 0x50]
mov ecx, dword [esp + 0x50]
fld dword [eax + 8]
fstp dword [esp + 0x4c]
fld dword [eax + 0x10]
mov eax, dword [esp + 0x4c]
mov dword [ebp + 0x78], eax
fstp dword [esp + 0x54]
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x58]
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x80], edx
mov dword [ebp + 0x84], eax
fld qword [esp + 0x44]
fstp qword [ebp + 0x88]
mov edx, dword [ebp + 0x34]
mov ecx, 2
lea eax, [ebp + 0x24]
mov esi, ebx
call fcn.10056b10
cmp eax, 2
jne 0x10066f58
mov ecx, dword [ebp + 0x14]
mov eax, dword [esp + 0x1c]
push ecx
call fcn.1001b910
mov eax, dword [esp + 0x40]
call fcn.10004a60
jmp 0x10066f58
fld qword [0x100a98a0]
fcomp qword [esp + 0x44]
fnstsw ax
test ah, 0x41
jnp 0x10066ec3
lea esi, [esp + 0x5c]
lea eax, [esp + 0x70]
call fcn.10067d60
test eax, eax
jne 0x10066f12
fld dword [esp + 0x68]
call fcn.10094310
fstp dword [esp + 0x40]
fld dword [esp + 0x40]
fstp dword [esp + 0x40]
fld dword [esp + 0x60]
fld dword [esp + 0x40]
fadd st(0), st(0)
fsubp st(1)
fstp dword [ebp + 0x28]
fld dword [esp + 0x68]
call fcn.10094440
fstp dword [esp + 0x40]
fld dword [esp + 0x40]
mov dword [ebp + 0x34], 0x111
fstp dword [esp + 0x40]
fld dword [esp + 0x5c]
fld dword [esp + 0x40]
fadd st(0), st(0)
fsubp st(1)
fstp dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [esp + 0x40], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x28a
jae 0x10066f58
mov edx, dword [ebp + 0x34]
mov ecx, 2
lea eax, [ebp + 0x24]
mov esi, ebx
call fcn.10056b10
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x40]
cmp eax, 0x28a
jb 0x10066f2d
call fcn.1007ec20
test eax, eax
je 0x10066f72
mov al, 0
mov ecx, dword [0x100bb500]
mov byte [ecx], al
add dword [ebp + 0x94], 1
cmp dword [ebp + 0x94], 1
jle 0x10066f8a
call fcn.10024010
mov dword [ebp + 0x94], 0
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x44]
mov eax, dword [eax + 0x48]
cmp eax, dword [ebx + 0x2c]
jne 0x10066fb5
cmp ecx, dword [ebx + 0x28]
jne 0x10066fb5
fld qword [0x100a98a0]
fcomp qword [esp + 0x44]
fnstsw ax
test ah, 0x41
jne 0x10066fb5
push ebx
call fcn.10021900
fld dword [esp + 0x5c]
sub esp, 0x10
fsub dword [esp + 0x80]
fstp qword [esp + 8]
fld dword [esp + 0x70]
fsub dword [esp + 0x84]
fstp qword [esp]
call fcn.1006ddc0
fstp dword [esp + 0x48]
add esp, 4
fld dword [0x100a982c]
fstp dword [esp + 8]
fld dword [esp + 0x88]
fstp dword [esp + 4]
fld dword [esp + 0x44]
fstp dword [esp]
call fcn.100218b0
add esp, 0xc
test eax, eax
jne 0x1006701e
mov ecx, dword [0x100bb2cc]
fld dword [esp + 0x38]
mov edx, dword [ecx]
mov eax, dword [edx + 0x44]
push ecx
fstp dword [esp]
call eax
push 0x11
call fcn.100579d0
test eax, eax
je 0x10067053
mov eax, dword [ebp + 0x14]
mov edx, dword [ebx]
add eax, 0xc
push eax
mov eax, dword [edx + 0x38]
mov ecx, ebx
call eax
test eax, eax
je 0x10067053
mov edx, dword [ebx]
mov eax, dword [edx + 0x4c]
mov ecx, ebx
call eax
test eax, eax
jle 0x10067053
mov edx, dword [ebx]
mov eax, dword [edx + 0x58]
mov ecx, ebx
call eax
push 0x12
call fcn.100579d0
test eax, eax
je 0x10067088
mov eax, dword [ebp + 0x14]
mov edx, dword [ebx]
add eax, 0xc
push eax
mov eax, dword [edx + 0x3c]
mov ecx, ebx
call eax
test eax, eax
je 0x10067088
mov edx, dword [ebx]
mov eax, dword [edx + 0x50]
mov ecx, ebx
call eax
test eax, eax
jle 0x10067088
mov edx, dword [ebx]
mov eax, dword [edx + 0x5c]
mov ecx, ebx
call eax
push 0x19
call fcn.100579d0
test eax, eax
je 0x100670ad
mov edx, dword [ebx]
mov eax, dword [edx + 0x54]
push 0x19
mov ecx, ebx
call eax
test eax, eax
jle 0x100670ad
mov edx, dword [ebx]
mov eax, dword [edx + 0x64]
push 0x19
mov ecx, ebx
call eax
push 0x1a
call fcn.100579d0
test eax, eax
je 0x100670d2
mov edx, dword [ebx]
mov eax, dword [edx + 0x54]
push 0x1a
mov ecx, ebx
call eax
test eax, eax
jle 0x100670d2
mov edx, dword [ebx]
mov eax, dword [edx + 0x64]
push 0x1a
mov ecx, ebx
call eax
fld qword [0x100a9870]
fld qword [esp + 0x44]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jp 0x10067164
fcomp qword [0x100a9800]
fnstsw ax
test ah, 1
jne 0x10067166
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0x3c]
cmp eax, 0x7d0
jbe 0x10067166
push ebx
call fcn.10021900
mov eax, dword [ebp + 0x6c]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
test eax, eax
mov dword [esp + 0x18], eax
je 0x10067166
mov ecx, eax
cmp dword [ecx + 0x10], 0
jne 0x10067166
mov edx, eax
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x10067166
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov edx, dword [ebx]
push eax
mov eax, dword [edx + 0x18]
push ecx
mov ecx, ebx
call eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x3c], eax
jmp 0x10067166
fstp st(0)
fld qword [0x100a98b0]
fcomp qword [esp + 0x44]
fnstsw ax
test ah, 1
jne 0x10067d39
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0x3c]
cmp eax, 0x3e8
jbe 0x10067d39
mov eax, dword [esp + 0x1c]
call fcn.10003ac0
test eax, eax
jne 0x10067245
fld dword [0x100a97c8]
sub esp, 0xc
fstp dword [esp + 8]
fld dword [esp + 0x74]
fstp dword [esp + 4]
fld dword [esp + 0x88]
fstp dword [esp]
call fcn.100218b0
add esp, 0xc
test eax, eax
je 0x10067245
lea ecx, [esp + 0x38]
push ecx
mov ecx, str.Backstab
call fcn.10003700
lea edx, [esp + 0x38]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 4
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x10067245
mov eax, esi
cmp dword [eax + 0x10], 0
jne 0x10067245
mov ecx, esi
mov esi, dword [ecx]
call fcn.1007e040
test eax, eax
jne 0x1006780d
mov eax, ebp
call fcn.10004640
cmp eax, 2
jne 0x100672f4
lea eax, [esp + 0x38]
push eax
mov ecx, str.BladeFlurry
call fcn.10003700
lea ecx, [esp + 0x38]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 5
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x100672f4
mov edx, esi
cmp dword [edx + 0x10], 0
jne 0x100672f4
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x100672f4
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ebx]
mov eax, dword [eax + 4]
mov edx, dword [edx + 0x18]
push ecx
push eax
mov ecx, ebx
call edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x90], 1
jmp 0x10067d36
lea eax, [esp + 0x38]
push eax
mov ecx, str.Riposte
call fcn.10003700
lea ecx, [esp + 0x38]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 6
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1006736e
mov edx, esi
cmp dword [edx + 0x10], 0
jne 0x1006736e
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
jne 0x1006780d
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x50], 0
jne 0x10067382
cmp dword [eax + 0x54], 0
je 0x10067476
lea eax, [esp + 0x38]
push eax
mov ecx, str.Kick
call fcn.10003700
lea ecx, [esp + 0x38]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 7
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x100673fc
mov edx, esi
cmp dword [edx + 0x10], 0
jne 0x100673fc
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
jne 0x1006780d
lea eax, [esp + 0x38]
push eax
mov ecx, str.Gouge
call fcn.10003700
lea ecx, [esp + 0x38]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 8
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x10067476
mov edx, esi
cmp dword [edx + 0x10], 0
jne 0x10067476
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
jne 0x1006780d
mov eax, dword [esp + 0x1c]
call fcn.10003b20
cmp eax, 0x14
jbe 0x10067534
mov ecx, ebx
call fcn.10060430
test eax, eax
jle 0x10067534
mov ecx, ebx
call fcn.10060430
cmp eax, 4
jge 0x10067534
lea eax, [esp + 0x38]
push eax
mov ecx, str.Expose_Armor
call fcn.10003700
lea ecx, [esp + 0x38]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 9
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x10067534
mov edx, esi
cmp dword [edx + 0x10], 0
jne 0x10067534
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x10067534
mov ecx, dword [esp + 0x18]
mov esi, dword [ecx]
mov eax, dword [esp + 0x1c]
call fcn.1006f610
test eax, eax
je 0x1006780d
lea eax, [esp + 0x38]
push eax
mov ecx, str.SliceandDice
call fcn.10003700
lea ecx, [esp + 0x38]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0xa
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x100675eb
mov eax, esi
call fcn.1006e760
mov eax, dword [esp + 0x1c]
call fcn.10003b20
cmp eax, 0x23
jbe 0x100675eb
mov ecx, ebx
call fcn.10060430
test eax, eax
jle 0x100675eb
mov ecx, ebx
call fcn.10060430
cmp eax, 4
jge 0x100675eb
mov edx, esi
mov esi, dword [edx]
mov eax, ebx
call fcn.10056f10
test eax, eax
jne 0x100675eb
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x10], 0
jne 0x100675eb
mov ecx, eax
mov esi, dword [ecx]
call fcn.1007e040
test eax, eax
jne 0x1006780d
mov eax, dword [esp + 0x1c]
call fcn.10003b20
cmp eax, 0x23
jb 0x10067605
mov ecx, ebx
call fcn.10060430
cmp eax, 4
jne 0x1006767f
lea eax, [esp + 0x38]
push eax
mov ecx, str.Eviscerate
call fcn.10003700
lea ecx, [esp + 0x38]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0xb
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1006767f
mov edx, esi
cmp dword [edx + 0x10], 0
jne 0x1006767f
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
jne 0x1006780d
mov eax, dword [esp + 0x1c]
call fcn.10003b20
cmp eax, 0x2d
jbe 0x10067742
mov ecx, ebx
call fcn.10060430
cmp eax, 3
jl 0x10067742
cmp dword [esp + 0x20], 0
je 0x100676bf
mov eax, dword [esp + 0x20]
mov esi, dword [eax]
mov eax, dword [esp + 0x1c]
call fcn.1006f610
test eax, eax
jne 0x10067742
cmp dword [ebp + 0x90], 0
jne 0x10067742
lea ecx, [esp + 0x38]
push ecx
mov ecx, str.KidneyShot
call fcn.10003700
lea edx, [esp + 0x38]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 0xc
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x10067742
mov eax, esi
cmp dword [eax + 0x10], 0
jne 0x10067742
mov ecx, esi
mov esi, dword [ecx]
call fcn.1007e040
test eax, eax
jne 0x1006780d
cmp dword [esp + 0x24], 0
je 0x10067826
fld dword [0x100a97c8]
sub esp, 0xc
fstp dword [esp + 8]
fld dword [esp + 0x74]
fstp dword [esp + 4]
fld dword [esp + 0x88]
fstp dword [esp]
call fcn.100218b0
add esp, 0xc
test eax, eax
je 0x100678d6
lea eax, [esp + 0x38]
push eax
mov ecx, str.Backstab
call fcn.10003700
lea ecx, [esp + 0x38]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0xd
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x100678d6
mov edx, esi
cmp dword [edx + 0x10], 0
jne 0x100678d6
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x100678d6
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x100678d6
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ebx]
mov eax, dword [eax + 4]
mov edx, dword [edx + 0x18]
push ecx
push eax
mov ecx, ebx
call edx
jmp 0x10067d30
lea eax, [esp + 0x38]
push eax
mov ecx, str.SinisterStrike
call fcn.10003700
lea ecx, [esp + 0x38]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0xe
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x100678d6
mov eax, esi
call fcn.1006e760
mov edx, dword [ebx]
mov eax, dword [edx + 0x7c]
mov ecx, ebx
call eax
cmp eax, 0x28
jl 0x100678d6
mov ecx, esi
cmp dword [ecx + 0x10], 0
jne 0x100678d6
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x100678d6
mov ecx, ebx
call fcn.10060430
cmp eax, 5
je 0x100678d6
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ebx]
mov eax, dword [eax + 4]
mov edx, dword [edx + 0x18]
push ecx
push eax
mov ecx, ebx
call edx
jmp 0x10067d30
lea eax, [esp + 0x38]
push eax
mov ecx, str.Killing_Spree
call fcn.10003700
lea ecx, [esp + 0x38]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0xf
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1006795c
mov edx, esi
cmp dword [edx + 0x10], 0
jne 0x1006795c
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x1006795c
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 0x274], 0
jne 0x1006780d
lea eax, [esp + 0x38]
push eax
mov ecx, str.Fan_of_Knives
call fcn.10003700
lea ecx, [esp + 0x38]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0x10
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x10067a03
mov edx, esi
cmp dword [edx + 0x10], 0
jne 0x10067a03
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x10067a03
mov esi, dword [ebp + 0x14]
cmp dword [esi + 0x278], 0
je 0x10067a03
mov eax, ebp
call fcn.10004640
cmp eax, dword [esi + 0x280]
jb 0x10067a03
mov eax, ebx
call fcn.10003b60
mov ecx, dword [ebp + 0x14]
cmp eax, dword [ecx + 0x27c]
jae 0x1006780d
mov eax, ebx
call fcn.10003b60
cmp eax, 0x32
jbe 0x10067a1f
mov eax, ebp
call fcn.10004640
cmp eax, 2
jb 0x10067b37
lea eax, [esp + 0x38]
push eax
mov ecx, str.Evasion
call fcn.10003700
lea ecx, [esp + 0x38]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0x11
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x10067abd
mov edx, esi
cmp dword [edx + 0x10], 0
jne 0x10067abd
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x10067abd
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov edx, dword [ebx]
push eax
mov eax, dword [edx + 0x18]
push ecx
mov ecx, ebx
call eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x320
mov dword [ebp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x38]
push ecx
mov ecx, str.Adrenaline_Rush
call fcn.10003700
lea edx, [esp + 0x38]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 0x12
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x10067b37
mov eax, esi
cmp dword [eax + 0x10], 0
jne 0x10067b37
mov ecx, esi
mov esi, dword [ecx]
call fcn.1007e040
test eax, eax
jne 0x1006780d
mov eax, ebx
call fcn.10003b60
cmp eax, 0x23
ja 0x10067bd9
mov eax, ebp
call fcn.10004640
cmp eax, 2
jae 0x10067b61
mov eax, dword [esp + 0x1c]
call fcn.10003b20
cmp eax, 0x14
jb 0x10067bd9
lea eax, [esp + 0x38]
push eax
mov ecx, str.Adrenaline_Rush
call fcn.10003700
lea ecx, [esp + 0x38]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0x13
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x10067bd9
cmp dword [esi + 0x10], 0
jne 0x10067bd9
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
jne 0x1006780d
mov eax, ebx
call fcn.10003b60
cmp eax, 0xa
ja 0x10067c98
lea eax, [esp + 0x38]
push eax
mov ecx, str.Vanish
call fcn.10003700
lea ecx, [esp + 0x38]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0x14
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x10067c98
cmp dword [esi + 0x10], 0
jne 0x10067c98
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x10067c98
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ebx]
mov eax, dword [eax + 4]
mov edx, dword [edx + 0x18]
push ecx
push eax
mov ecx, ebx
call edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [ebp + 0x14]
add ebx, 0x59790
mov dword [ebp + 0x3c], eax
call fcn.1001d830
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10067d39
lea eax, [esp + 0x34]
push eax
mov ecx, str.Attack
call fcn.10003700
lea ecx, [esp + 0x34]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0x15
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov edi, eax
lea eax, [esp + 0x34]
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test edi, edi
je 0x10067d39
mov eax, edi
call fcn.10023fd0
test eax, eax
jne 0x10067d39
cmp dword [esp + 0x3c], eax
je 0x10067d19
mov edx, dword [esp + 0x3c]
mov esi, dword [edx]
mov eax, dword [esp + 0x1c]
call fcn.1006f610
test eax, eax
jne 0x10067d39
mov eax, edi
call fcn.1002ebf0
test eax, eax
jne 0x10067d39
mov ecx, dword [edi]
mov eax, dword [ebx]
mov edx, dword [eax + 0x14]
push ecx
mov ecx, ebx
call edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x3c], eax
mov eax, 1
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 4