Function at 0x4967a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1030], edx
mov dword [ebp - 0x102c], edx
mov dword [ebp - 0x1024], edx
mov dword [ebp - 0x1028], edx
mov dword [ebp - 0x1020], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
mov ebx, 0x4b6b2c
mov esi, 0x4b69ec
xor eax, eax
push ebp
push 0x496fe5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp byte [0x4b69cd], 0
jne 0x496fba
mov edx, 0x4b69e4
mov eax, 0x4b69e0
call fcn.004930cc
test al, al
je 0x496fba
cmp dword [0x4b69e0], 0
je 0x496fba
lea eax, [ebp - 0x18]
mov edx, 0x497000
call fcn.00404938
xor edx, edx
push ebp
push 0x496fa9
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x18]
mov edx, dword [0x4b69e4]
call fcn.00404938
mov byte [0x4b69cd], 1
mov byte [0x4b69e8], 0
mov byte [0x4b69cc], 0
mov eax, 0x47c5
call fcn.00496690
call fcn.00496700
lea eax, [ebp - 0xc]
mov edx, 0x497018
call fcn.00404938
mov eax, dword [ebp - 0xc]
call fcn.00404b60
mov edi, eax
lea eax, [ebp - 0x1019]
mov ecx, edi
mov edx, dword [ebp - 0xc]
call fcn.00409960
lea eax, [ebp - 0x1019]
push eax
push edi
mov ecx, 0x76c
mov edx, dword [ebp - 0x18]
mov eax, dword [0x4b6b48]
call fcn.0047a8f0
call sub.kernel32.dll_GetTickCount
mov edi, eax
jmp 0x4968d0
mov eax, dword [0x4b4074]
mov eax, dword [eax]
call fcn.004549ec
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp eax, 0x157c
jae 0x4968e7
cmp byte [0x4b69cc], 0
je 0x4968c4
cmp dword [0x4b6b30], 0
sete al
or al, byte [0x4b69cc]
je 0x49690d
mov byte [0x4b69cd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496fba
mov dword [ebx], 1
mov eax, dword [ebx]
cmp eax, dword [0x4b6b30]
jg 0x496bf1
mov byte [0x4b69cd], 3
mov byte [0x4b69ce], 0
mov byte [0x4b6b3c], 0
push 0x497088
mov edi, dword [ebx]
shl edi, 2
push dword [esi + edi*8 - 0x20]
push 0x497098
push 0x4970ac
push dword [esi + edi*8 - 0x1c]
push 0x4970bc
push dword [esi + edi*8 - 0x18]
push 0x4970c8
mov eax, 0x4b6b38
mov edx, 8
call fcn.00404c20
mov edx, dword [esi + edi*8 - 0x1c]
mov eax, dword [0x4b6b4c]
call fcn.00494e70
mov eax, dword [ebx]
shl eax, 2
mov eax, dword [esi + eax*8 - 0x18]
call fcn.00409144
mov edx, eax
mov eax, dword [0x4b6b4c]
call fcn.00494ef0
mov dl, 1
mov eax, dword [0x4b6b4c]
call fcn.00494da0
call sub.kernel32.dll_GetTickCount
mov edi, eax
jmp 0x4969b8
mov eax, dword [0x4b4074]
mov eax, dword [eax]
call fcn.004549ec
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp eax, 0x157c
jae 0x4969e4
cmp byte [0x4b69cc], 0
jne 0x4969e4
mov eax, dword [ebx]
shl eax, 2
cmp byte [esi + eax*8 - 4], 0
je 0x4969e4
cmp byte [0x4b69ce], 0
je 0x4969ac
mov eax, dword [0x4b6b4c]
call fcn.00494f9c
cmp byte [0x4b69ce], 0
jne 0x496a01
mov eax, dword [ebx]
shl eax, 2
mov byte [esi + eax*8 - 4], 0
cmp byte [0x4b69cc], 0
je 0x496a1e
mov byte [0x4b69cd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496fba
mov byte [0x4b69cd], 4
mov edi, dword [ebx]
shl edi, 2
cmp byte [esi + edi*8 - 4], 0
je 0x496be1
mov byte [0x4b69ce], 0
mov byte [0x4b6b3c], 0
push 0x4970d8
push dword [esi + edi*8 - 0xc]
push 0x4971a4
push 0x4971b4
push 0x4971d8
push 0x4971ec
lea eax, [ebp - 0x10]
mov edx, 6
call fcn.00404c20
lea eax, [ebp - 0x14]
mov edx, dword [esi + edi*8 - 0x10]
call fcn.00404938
lea eax, [ebp - 0x14]
mov ecx, 7
mov edx, 1
call fcn.00404e00
mov edx, dword [ebp - 0x14]
mov eax, 0x497204
call fcn.00404ea4
mov edi, eax
mov ecx, edi
dec ecx
lea eax, [ebp - 0x14]
mov edx, 1
call fcn.00404e00
push 0x497210
push dword [ebp - 0x14]
push 0x497220
push 0x4970ac
mov edi, dword [ebx]
shl edi, 2
push dword [esi + edi*8 - 0x1c]
push 0x4970bc
push dword [esi + edi*8 - 0x18]
push 0x497234
push 0x497240
push dword [esi + edi*8 - 0xc]
push 0x497258
push 0x49727c
push 0x4972b0
mov eax, dword [ebp - 0x10]
call fcn.00404b60
lea edx, [ebp - 0x1020]
call fcn.00409008
push dword [ebp - 0x1020]
push 0x4970c8
push dword [ebp - 0x10]
mov eax, 0x4b6b38
mov edx, 0x10
call fcn.00404c20
mov eax, dword [ebx]
shl eax, 2
mov edx, dword [esi + eax*8 - 0x1c]
mov eax, dword [0x4b6b4c]
call fcn.00494e70
mov eax, dword [ebx]
shl eax, 2
mov eax, dword [esi + eax*8 - 0x18]
call fcn.00409144
mov edx, eax
mov eax, dword [0x4b6b4c]
call fcn.00494ef0
mov dl, 1
mov eax, dword [0x4b6b4c]
call fcn.00494da0
call sub.kernel32.dll_GetTickCount
mov edi, eax
jmp 0x496b69
mov eax, dword [0x4b4074]
mov eax, dword [eax]
call fcn.004549ec
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp eax, 0x157c
jae 0x496b9e
cmp byte [0x4b69cc], 0
jne 0x496b9e
cmp dword [0x4b6b34], 0
jne 0x496b9e
mov eax, dword [ebx]
shl eax, 2
cmp byte [esi + eax*8 - 4], 0
je 0x496b9e
cmp byte [0x4b69ce], 0
je 0x496b5d
mov eax, dword [0x4b6b4c]
call fcn.00494f9c
cmp dword [0x4b6b34], 0
jne 0x496bf1
cmp byte [0x4b69ce], 0
jne 0x496bc4
mov eax, dword [ebx]
shl eax, 2
mov byte [esi + eax*8 - 4], 0
cmp byte [0x4b69cc], 0
je 0x496be1
mov byte [0x4b69cd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496fba
inc dword [ebx]
mov eax, dword [ebx]
cmp eax, dword [0x4b6b30]
jle 0x496921
xor eax, eax
mov dword [ebx], 1
mov edx, dword [ebx]
cmp edx, dword [0x4b6b30]
jg 0x496c1f
mov edx, dword [ebx]
shl edx, 2
cmp byte [esi + edx*8 - 4], 0
je 0x496c13
mov al, 1
jmp 0x496c1f
inc dword [ebx]
mov edx, dword [ebx]
cmp edx, dword [0x4b6b30]
jle 0x496c03
test al, al
jne 0x496c37
mov byte [0x4b69cd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496fba
mov byte [0x4b69cd], 5
cmp dword [0x4b6b34], 0
jne 0x496c4f
mov dword [ebx], 1
jmp 0x496c56
mov eax, dword [0x4b6b34]
mov dword [ebx], eax
mov edi, dword [ebx]
shl edi, 2
cmp byte [esi + edi*8 - 4], 0
je 0x496eaa
mov byte [0x4b69ce], 0
mov byte [0x4b6b3c], 0
push 0x4972cc
push dword [esi + edi*8 - 0xc]
push 0x4971a4
push 0x497390
push 0x4973bc
lea edx, [ebp - 0x1024]
mov eax, dword [ebp - 4]
call fcn.00409008
push dword [ebp - 0x1024]
push 0x4973d8
push 0x4973f8
push 0x497410
push 0x49741c
push 0x497438
lea edx, [ebp - 0x1028]
mov eax, dword [ebp - 4]
call fcn.00409008
push dword [ebp - 0x1028]
push 0x497454
push 0x497474
push dword [0x4b69e0]
push 0x497490
push 0x4974b0
push 0x4974d8
push 0x4974fc
push 0x49750c
push 0x497534
push 0x497568
push 0x4971d8
push 0x4971ec
lea eax, [ebp - 0x10]
mov edx, 0x18
call fcn.00404c20
lea eax, [ebp - 0x14]
mov edx, dword [ebx]
shl edx, 2
mov edx, dword [esi + edx*8 - 0x10]
call fcn.00404938
lea eax, [ebp - 0x14]
mov ecx, 7
mov edx, 1
call fcn.00404e00
mov edx, dword [ebp - 0x14]
mov eax, 0x497204
call fcn.00404ea4
mov edi, eax
mov ecx, edi
dec ecx
lea eax, [ebp - 0x14]
mov edx, 1
call fcn.00404e00
push 0x497210
push dword [ebp - 0x14]
push 0x497098
push 0x4970ac
mov eax, dword [ebx]
shl eax, 2
push dword [esi + eax*8 - 0x1c]
push 0x4970bc
mov eax, dword [ebx]
shl eax, 2
push dword [esi + eax*8 - 0x18]
push 0x497234
push 0x497240
mov eax, dword [ebx]
shl eax, 2
push dword [esi + eax*8 - 0xc]
push 0x497588
push 0x49727c
push 0x4972b0
mov eax, dword [ebp - 0x10]
call fcn.00404b60
lea edx, [ebp - 0x102c]
call fcn.00409008
push dword [ebp - 0x102c]
push 0x4970c8
push dword [ebp - 0x10]
mov eax, 0x4b6b38
mov edx, 0x10
call fcn.00404c20
mov eax, dword [ebx]
shl eax, 2
mov edx, dword [esi + eax*8 - 0x1c]
mov eax, dword [0x4b6b4c]
call fcn.00494e70
mov eax, dword [ebx]
shl eax, 2
mov eax, dword [esi + eax*8 - 0x18]
call fcn.00409144
mov edx, eax
mov eax, dword [0x4b6b4c]
call fcn.00494ef0
mov dl, 1
mov eax, dword [0x4b6b4c]
call fcn.00494da0
call sub.kernel32.dll_GetTickCount
mov edi, eax
jmp 0x496e22
mov eax, dword [0x4b4074]
mov eax, dword [eax]
call fcn.004549ec
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp eax, 0x157c
jae 0x496e57
cmp byte [0x4b69cc], 0
jne 0x496e57
cmp byte [0x4b69e8], 0
jne 0x496e57
mov eax, dword [ebx]
shl eax, 2
cmp byte [esi + eax*8 - 4], 0
je 0x496e57
cmp byte [0x4b69ce], 0
je 0x496e16
mov eax, dword [0x4b6b4c]
call fcn.00494f9c
cmp byte [0x4b69e8], 0
je 0x496e71
mov dword [ebp - 8], 0x63
mov al, byte [0x4b69e8]
or al, byte [0x4b69cc]
je 0x496e92
mov byte [0x4b69cd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496fba
cmp byte [0x4b69ce], 0
je 0x496ea0
inc dword [ebp - 8]
jmp 0x496eaa
mov eax, dword [ebx]
shl eax, 2
mov byte [esi + eax*8 - 4], 0
inc dword [ebx]
mov eax, dword [ebx]
cmp eax, dword [0x4b6b30]
jg 0x496ec3
cmp dword [0x4b6b34], 0
je 0x496c56
mov byte [0x4b69cd], 0
xor eax, eax
mov dword [ebx], 1
mov edx, dword [ebx]
cmp edx, dword [0x4b6b30]
jg 0x496f83
mov edi, dword [ebx]
shl edi, 2
cmp byte [esi + edi*8 - 4], 0
je 0x496f73
mov eax, 0x4b69e0
mov edx, dword [esi + edi*8 - 8]
call fcn.004048f4
mov eax, 0x4b69e4
call fcn.004048a0
lea eax, [ebp - 0xc]
mov edx, dword [0x4b69e0]
call fcn.00404938
mov edx, dword [ebp - 0xc]
mov eax, 0x4975a4
call fcn.00404ea4
mov edi, eax
test edi, edi
jle 0x496f60
lea eax, [ebp - 0x1030]
push eax
mov ecx, edi
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404dc0
mov edx, dword [ebp - 0x1030]
mov eax, 0x4b69e4
call fcn.00404b68
lea eax, [ebp - 0xc]
mov ecx, edi
mov edx, 1
call fcn.00404e00
jmp 0x496f16
mov eax, 0x4b69e4
mov edx, 0x4975b0
call fcn.00404b68
mov al, 1
jmp 0x496f83
inc dword [ebx]
mov edx, dword [ebx]
cmp edx, dword [0x4b6b30]
jle 0x496ee0
test al, al
jne 0x496848
mov byte [0x4b69cd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496fba
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496fec
lea eax, [ebp - 0x1030]
mov edx, 5
call fcn.004048c4
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004048c4
ret