Function at 0x40a870
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48f150
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4b59f4]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov eax, dword [0x4b59f4]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, ecx
xor edi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], edi
mov byte [esp + 0x50], 0
mov dword [esp + 0x78], edi
lea eax, [esp + 0x4c]
mov ecx, ebx
call fcn.0040e970
cmp dword [eax + 0x1048], edi
je 0x40a907
movzx ecx, word [eax + 0x103c]
movzx edx, word [eax + 0x103e]
add ecx, 1
cmp ecx, edx
jle 0x40a8fd
mov dword [0], 0x7d0
add word [eax + 0x103c], 1
jmp 0x40a911
lea ecx, [esp + 0x1b]
push ecx
call fcn.0040e340
mov ecx, dword [ebx + 0x1060]
mov eax, dword [0x4cb9f4]
mov dword [eax + 0x30], ecx
cmp dword [esp + 0x64], 0x10
mov dword [esi + 0x54], 1
mov esi, dword [esp + 0x50]
jae 0x40a935
lea esi, [esp + 0x50]
mov edi, str.GatewayServer
mov ecx, 0xe
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a9e4
mov dword [eax + 0x2c], 1
mov eax, dword [0x4cb9fc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
push 1
push eax
call edx
mov esi, eax
mov eax, dword [esi + 0x1050]
mov word [eax], 0x6100
mov eax, dword [0x4cb9f4]
cmp dword [eax + 0x1c], 0x10
jb 0x40a97c
mov ebx, dword [eax + 8]
jmp 0x40a97f
lea ebx, [eax + 8]
push eax
mov edi, 1
mov eax, esi
call fcn.00406520
mov edi, dword [0x4cb9f4]
add edi, 0x20
call fcn.00406590
push edi
mov edi, 4
call fcn.00406520
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x1060]
mov ecx, dword [0x4cb9fc]
mov edx, dword [ecx]
push esi
push eax
mov eax, dword [edx + 0x50]
push ecx
call eax
mov eax, dword [0x4cb9fc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x4c]
push esi
push eax
call edx
mov esi, dword [0x4cb9f4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x100], eax
jmp 0x40aee4
cmp dword [esp + 0x64], 0x10
mov esi, dword [esp + 0x50]
jae 0x40a9f3
lea esi, [esp + 0x50]
mov edi, str.AgentServer
mov ecx, 0xc
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40ab14
xor ecx, ecx
mov dword [eax + 0x2c], 2
mov eax, dword [eax + 0x30]
mov dword [esp + 0x44], ecx
mov word [esp + 0x48], cx
mov ecx, dword [0x4cb9fc]
mov edx, dword [ecx]
lea esi, [esp + 0x44]
push esi
push eax
push ecx
mov ecx, dword [edx + 0x88]
call ecx
mov eax, dword [0x4cb9fc]
mov edx, dword [eax]
push 1
push eax
mov eax, dword [edx + 0x48]
call eax
mov esi, eax
mov ecx, dword [esi + 0x1050]
mov eax, dword [0x4cb9f4]
mov word [ecx], 0x6103
mov ecx, 0x10
cmp dword [eax + 0xd0], ecx
mov dword [esp + 0x10], esi
jb 0x40aa6d
mov edx, dword [eax + 0xbc]
jmp 0x40aa73
lea edx, [eax + 0xbc]
cmp dword [eax + 0xb4], ecx
mov dword [esp + 0x14], edx
jb 0x40aa87
mov ebx, dword [eax + 0xa0]
jmp 0x40aa8d
lea ebx, [eax + 0xa0]
add eax, 0x38
push eax
mov edi, 4
mov eax, esi
call fcn.00406520
mov edi, dword [0x4cb9f4]
call fcn.00406590
mov ebx, dword [esp + 0x14]
mov esi, eax
call fcn.00406590
push edi
mov edi, 1
mov esi, eax
call fcn.00406520
lea eax, [esp + 0x44]
push eax
mov edi, 6
mov eax, esi
call fcn.00406520
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x1060]
mov ecx, dword [0x4cb9fc]
mov esi, dword [esp + 0x10]
mov edx, dword [ecx]
push esi
push eax
mov eax, dword [edx + 0x50]
push ecx
call eax
mov eax, dword [0x4cb9fc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x4c]
push esi
push eax
call edx
mov esi, dword [0x4cb9f4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x100], eax
jmp 0x40aee4
cmp dword [esp + 0x64], 0x10
mov esi, dword [esp + 0x50]
jae 0x40ab23
lea esi, [esp + 0x50]
mov edi, str.DownloadServer
mov ecx, 0xf
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40aec2
xor ebx, ebx
push 0xffffffffffffffff
add eax, 0x13c
push ebx
push eax
mov ecx, 0x50ca74
mov dword [0x50ca70], 1
mov dword [0x50ca90], ebx
mov byte [0x50ca94], bl
mov dword [0x50ca9c], ebx
mov byte [0x50caa0], bl
call fcn.004067c0
call fcn.00404640
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov byte [esp + 0x78], 1
mov ecx, dword [0x4cb9f4]
mov edx, dword [ecx + 0xe0]
mov edx, dword [edx]
lea eax, [ecx + 0xdc]
mov esi, eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], edx
cmp esi, ebx
mov edx, dword [eax + 4]
je 0x40aebd
cmp esi, eax
jne 0x40aebd
cmp dword [esp + 0x48], edx
sete al
test al, al
sete al
test al, al
je 0x40adb8
lea ecx, [esp + 0x44]
call fcn.00404260
mov esi, dword [eax]
push 0x104
lea edi, [esi + 0x220]
push ebx
push edi
call fcn.004704b0
add esp, 0xc
cmp byte [esi + 0x210], 0
je 0x40ac3f
lea eax, [esi + 0x108]
push eax
push 0x104
push edi
call fcn.00472f6e
mov eax, edi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40ac08
sub eax, edx
je 0x40ac28
push 0x49bc08
push 0x104
push edi
call fcn.00472f6e
add esp, 0xc
lea ecx, [esi + 4]
push ecx
push 0x104
push edi
call fcn.00472f6e
add esp, 0xc
jmp 0x40ad44
cmp dword [0x50ca88], ebx
jbe 0x40ac69
cmp dword [0x50ca8c], 0x10
mov eax, dword [0x50ca78]
jae 0x40ac5a
mov eax, 0x50ca78
push eax
push 0x104
push edi
call fcn.00472f6e
add esp, 0xc
lea ebx, [esi + 0x108]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40ac74
sub eax, edx
je 0x40aca9
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40ac86
sub eax, edx
je 0x40aca6
push 0x49bc08
push 0x104
push edi
call fcn.00472f6e
add esp, 0xc
push ebx
jmp 0x40acfa
lea ebx, [esi + 4]
push str.Replacer.exe
push ebx
call fcn.00470008
add esp, 8
test eax, eax
je 0x40ad08
push str.SMCReplacer.exe
push ebx
call fcn.00470008
add esp, 8
test eax, eax
je 0x40ad08
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40acd5
sub eax, edx
je 0x40acf5
push 0x49bc08
push 0x104
push edi
call fcn.00472f6e
add esp, 0xc
push str.TempPath
push 0x104
push edi
call fcn.00472f6e
add esp, 0xc
mov eax, edi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40ad10
sub eax, edx
je 0x40ad30
push 0x49bc08
push 0x104
push edi
call fcn.00472f6e
add esp, 0xc
lea edx, [esi + 4]
push edx
push 0x104
push edi
call fcn.00472f6e
add esp, 0xc
xor ebx, ebx
mov al, byte [esi + 0x210]
mov ecx, dword [esi + 0x20c]
mov edx, dword [esi]
neg al
sbb al, al
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], ecx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x40], esi
and eax, 2
or al, 1
mov byte [esp + 0x38], al
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 4]
lea edi, [eax + 4]
push ecx
push eax
lea ecx, [esp + 0x34]
call fcn.0040d160
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0040d220
mov dword [edi], esi
mov edx, dword [esi + 4]
lea ecx, [esp + 0x44]
mov dword [edx], esi
call fcn.00404290
mov ecx, dword [0x4cb9f4]
mov esi, dword [esp + 0x44]
lea eax, [ecx + 0xdc]
jmp 0x40ab9e
cmp dword [esp + 0x28], ebx
jne 0x40ae14
lea esi, [ecx + 0x104]
call fcn.00404000
mov eax, dword [esp + 0x14]
push ebx
push 2
push eax
mov eax, 0x13f9
call fcn.0040c240
mov byte [esp + 0x78], 0
lea esi, [esp + 0x20]
call fcn.004046d0
mov dword [esp + 0x78], 0xffffffff
mov eax, dword [esp + 0x64]
cmp eax, 0x10
jb 0x40ae0b
mov ecx, dword [esp + 0x50]
add eax, 1
push eax
push ecx
call fcn.00406020
add esp, 8
mov dword [esp + 0x60], ebx
jmp 0x40af0e
mov eax, dword [ecx + 0x30]
lea edx, [ecx + 0x104]
push edx
lea ebx, [esp + 0x24]
call fcn.0040c940
mov edi, dword [0x4cb9f4]
lea esi, [edi + 0x104]
xor ebx, ebx
cmp dword [esi + 0x14], ebx
je 0x40ae86
mov eax, dword [esi + 0x10]
mov eax, dword [eax]
cmp eax, dword [esi + 0x10]
jne 0x40ae49
call fcn.0040de00
lea ecx, [eax + 8]
cmp ecx, ebx
je 0x40ae86
mov esi, dword [edi + 0xe4]
mov eax, 0x64
xor edx, edx
div esi
mov byte [0x50ca94], al
mov eax, dword [edi + 0xe4]
mov dword [0x50ca90], eax
mov dword [0x50ca98], ebx
mov ecx, dword [ecx + 0x14]
mov dword [0x50ca9c], ecx
mov byte [0x50caa0], bl
jmp 0x40ae9d
call fcn.00404000
mov edx, dword [esp + 0x14]
push ebx
push 2
push edx
mov eax, 0x13f9
call fcn.0040c240
mov eax, dword [esp + 0x14]
push ebx
push ebx
push eax
mov eax, 0x13f5
call fcn.0040c240
mov byte [esp + 0x78], bl
lea esi, [esp + 0x20]
call fcn.004046d0
jmp 0x40aee4
call fcn.00404860
mov eax, dword [0x4cb9fc]
mov ebx, dword [ebx + 0x1060]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x5c]
push 1
push ebx
push eax
call edx
mov eax, dword [0x4cb9f4]
mov byte [eax + 0x158], 1
mov dword [esp + 0x78], 0xffffffff
mov eax, dword [esp + 0x64]
cmp eax, 0x10
jb 0x40af06
mov ecx, dword [esp + 0x50]
add eax, 1
push eax
push ecx
call fcn.00406020
add esp, 8
mov dword [esp + 0x60], 0
mov byte [esp + 0x50], 0
mov dword [esp + 0x64], 0xf
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.0046fe25
mov esp, ebp
pop ebp
ret 8