Function at 0x473428
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov esi, eax
xor eax, eax
push ebp
push 0x474399
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x47b924], 0
je 0x47346a
mov eax, esi
call fcn.00477d78
jmp 0x47436e
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x304]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx + 0x1c]
mov eax, dword [esi + 0x308]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx + 0x1c]
xor ebx, ebx
mov eax, 0x47d660
mov edx, dword [esi + 0x304]
mov edx, dword [edx + 0x34]
mov ecx, ebx
cmp cl, 0x27
ja 0x4734af
and ecx, 0x7f
bt dword [edx + 0x2038], ecx
setb dl
mov byte [eax], dl
inc ebx
inc eax
cmp ebx, 0x24
jne 0x473495
lea edx, [ebp - 0x28]
mov eax, 0x47d658
call fcn.00471fc4
mov edx, dword [ebp - 0x28]
mov eax, dword [esi + 0x318]
call fcn.0042f5c0
xor ebx, ebx
mov eax, 0x47d68c
mov edx, dword [esi + 0x308]
mov edx, dword [edx + 0x34]
mov ecx, ebx
cmp cl, 0x27
ja 0x4734f7
and ecx, 0x7f
bt dword [edx + 0x2038], ecx
setb dl
mov byte [eax], dl
inc ebx
inc eax
cmp ebx, 0x24
jne 0x4734dd
mov eax, dword [esi + 0x4a4]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473553
cmp byte [0x47d244], 0
jne 0x473553
push 0x4743a8
push 0x4743a8
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jbe 0x47354c
lea edx, [ebp - 0x2c]
mov eax, esi
call fcn.0042f590
mov eax, dword [ebp - 0x2c]
call fcn.00403fac
push eax
push ebx
call sub.user32.dll_SetWindowTextA
mov byte [0x47d244], 1
call sub.kernel32.dll_GetTickCount
sub eax, dword [0x47b920]
cmp eax, 0xea60
jbe 0x4735b5
call sub.kernel32.dll_GetTickCount
mov dword [0x47b920], eax
push 0
push 0x4743a8
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jbe 0x4735ae
mov eax, dword [0x47d248]
mov edx, dword [eax]
call dword [edx + 0x14]
call fcn.00402b28
mov edx, eax
lea ecx, [ebp - 0x30]
mov eax, dword [0x47d248]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x30]
call fcn.00403fac
push eax
push ebx
call sub.user32.dll_SetWindowTextA
mov byte [0x47d244], 1
mov eax, dword [0x47d140]
cmp byte [eax + 8], 0
jne 0x4736a4
mov eax, dword [0x47d140]
call fcn.0045d6e8
xor ebx, ebx
jmp 0x47361d
lea ecx, [ebp - 0x38]
mov eax, dword [esi + 0x458]
mov eax, dword [eax + 0x208]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00408684
cmp dword [ebp - 0x34], 0
je 0x47361c
lea ecx, [ebp - 0x3c]
mov eax, dword [esi + 0x458]
mov eax, dword [eax + 0x208]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x47d140]
call fcn.0045d598
inc ebx
mov eax, dword [0x47d140]
cmp byte [eax + 8], 0
jne 0x47363d
mov eax, dword [esi + 0x458]
mov eax, dword [eax + 0x208]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp ebx, eax
jl 0x4735d2
mov eax, dword [esi + 0x3a0]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x47369d
xor ebx, ebx
mov eax, dword [esi + 0x3a4]
call fcn.004278b4
test eax, eax
jne 0x473667
mov ebx, 0x40
jmp 0x473691
mov eax, dword [esi + 0x3a4]
call fcn.004278b4
dec eax
jne 0x47367c
mov ebx, 0x80
jmp 0x473691
mov eax, dword [esi + 0x3a4]
call fcn.004278b4
cmp eax, 2
jne 0x473691
mov ebx, pe_nt_image_headers32
mov edx, ebx
mov eax, dword [0x47d140]
call fcn.0045d574
mov byte [0x47d244], 0
mov eax, dword [0x47d140]
mov al, byte [eax + 8]
mov edx, eax
xor dl, byte [0x47b93c]
je 0x4736c2
mov byte [0x47b93c], al
mov eax, esi
call fcn.00472640
mov eax, dword [0x47d140]
cmp byte [eax + 8], 0
je 0x474307
xor eax, eax
mov dword [ebp - 0x14], eax
push 4
lea ecx, [ebp - 0x14]
mov edx, dword [0x47b944]
mov eax, dword [0x47d140]
call fcn.0045d734
cmp dword [ebp - 0x14], 1
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
jne 0x473700
mov byte [0x47b968], 1
mov al, byte [0x47b968]
and al, byte [ebp - 1]
je 0x47371b
call sub.kernel32.dll_GetTickCount
mov dword [0x47b92c], eax
mov byte [0x47d254], 0
cmp byte [ebp - 1], 0
je 0x473756
mov eax, dword [esi + 0x3b4]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473756
mov eax, dword [esi + 0x3b8]
call fcn.00458b24
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47b948]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp byte [ebp - 1], 0
je 0x473791
mov eax, dword [esi + 0x3f0]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473791
mov eax, dword [esi + 0x3f4]
call fcn.00458b24
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47b94c]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp byte [ebp - 1], 0
je 0x4737cc
mov eax, dword [esi + 0x3c0]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x4737cc
mov eax, dword [esi + 0x3c4]
call fcn.00458b24
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d6f0]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp byte [ebp - 1], 0
je 0x473807
mov eax, dword [esi + 0x3fc]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473807
mov eax, dword [esi + 0x400]
call fcn.00458b24
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d6f4]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp byte [ebp - 1], 0
je 0x473849
mov eax, dword [esi + 0x530]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473849
mov eax, dword [esi + 0x534]
call fcn.00458b24
mov edx, 0x2710
sub edx, eax
mov dword [ebp - 8], edx
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d758]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp byte [ebp - 1], 0
je 0x47388b
mov eax, dword [esi + 0x538]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x47388b
mov eax, dword [esi + 0x53c]
call fcn.00458b24
mov edx, 0x2710
sub edx, eax
mov dword [ebp - 8], edx
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d75c]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp byte [ebp - 1], 0
je 0x4738d4
mov eax, dword [esi + 0x3d4]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x4738d4
mov eax, dword [esi + 0x3d8]
call fcn.004278b4
dec eax
jne 0x4738b8
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4738bf
mov dword [ebp - 8], 0xffff
push 2
lea ecx, [ebp - 8]
mov edx, dword [0x47d72c]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp byte [ebp - 1], 0
je 0x47391d
mov eax, dword [esi + 0x40c]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x47391d
mov eax, dword [esi + 0x410]
call fcn.004278b4
dec eax
jne 0x473901
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x473908
mov dword [ebp - 8], 0xffff
push 2
lea ecx, [ebp - 8]
mov edx, dword [0x47d730]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp byte [ebp - 1], 0
je 0x47398e
mov eax, dword [esi + 0x3d0]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x47398e
mov eax, dword [esi + 0x3dc]
call fcn.004278b4
dec eax
jne 0x47394c
mov dword [ebp - 8], 0x80
jmp 0x473979
mov eax, dword [esi + 0x3dc]
call fcn.004278b4
test eax, eax
jne 0x473964
mov dword [ebp - 8], 0x82
jmp 0x473979
mov eax, dword [esi + 0x3dc]
call fcn.004278b4
cmp eax, 2
jne 0x473979
xor eax, eax
mov dword [ebp - 8], eax
push 1
lea ecx, [ebp - 8]
mov edx, dword [0x47d734]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp byte [ebp - 1], 0
je 0x4739ff
mov eax, dword [esi + 0x414]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x4739ff
mov eax, dword [esi + 0x418]
call fcn.004278b4
dec eax
jne 0x4739bd
mov dword [ebp - 8], 0x80
jmp 0x4739ea
mov eax, dword [esi + 0x418]
call fcn.004278b4
test eax, eax
jne 0x4739d5
mov dword [ebp - 8], 0x82
jmp 0x4739ea
mov eax, dword [esi + 0x418]
call fcn.004278b4
cmp eax, 2
jne 0x4739ea
xor eax, eax
mov dword [ebp - 8], eax
push 1
lea ecx, [ebp - 8]
mov edx, dword [0x47d738]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp byte [ebp - 1], 0
je 0x473a33
mov eax, dword [esi + 0x3c8]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473a33
mov dword [ebp - 8], 1
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d6f8]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp byte [ebp - 1], 0
je 0x473a67
mov eax, dword [esi + 0x404]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473a67
mov dword [ebp - 8], 1
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d6fc]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp byte [ebp - 1], 0
je 0x473aa2
mov eax, dword [esi + 0x43c]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473aa2
mov eax, dword [esi + 0x440]
call fcn.004278b4
mov dword [ebp - 8], eax
push 1
lea ecx, [ebp - 8]
mov edx, dword [0x47d720]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp byte [ebp - 1], 0
je 0x473add
mov eax, dword [esi + 0x444]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473add
mov eax, dword [esi + 0x448]
call fcn.004278b4
mov dword [ebp - 8], eax
push 1
lea ecx, [ebp - 8]
mov edx, dword [0x47d724]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp byte [ebp - 1], 0
je 0x473b3a
mov eax, dword [esi + 0x44c]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473b3a
mov eax, dword [esi + 0x484]
call fcn.00458b24
mov ebx, eax
mov eax, dword [esi + 0x468]
call fcn.00458b24
shl eax, 8
add ebx, eax
mov eax, dword [esi + 0x46c]
call fcn.00458b24
shl eax, 0x10
add ebx, eax
mov dword [ebp - 8], ebx
push 3
lea ecx, [ebp - 8]
mov edx, dword [0x47d744]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp byte [ebp - 1], 0
je 0x473b97
mov eax, dword [esi + 0x450]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473b97
mov eax, dword [esi + 0x488]
call fcn.00458b24
mov ebx, eax
mov eax, dword [esi + 0x470]
call fcn.00458b24
shl eax, 8
add ebx, eax
mov eax, dword [esi + 0x474]
call fcn.00458b24
shl eax, 0x10
add ebx, eax
mov dword [ebp - 8], ebx
push 3
lea ecx, [ebp - 8]
mov edx, dword [0x47d748]
mov eax, dword [0x47d140]
call fcn.0045d700
cmp dword [ebp - 0x14], 0
jne 0x473bf8
mov eax, dword [esi + 0x368]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473bf8
mov eax, dword [esi + 0x36c]
call fcn.004278b4
test eax, eax
jge 0x473bd5
mov eax, dword [esi + 0x36c]
mov eax, dword [eax + 0x1f0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
mov dword [ebp - 8], eax
jmp 0x473be3
mov eax, dword [esi + 0x36c]
call fcn.004278b4
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d728]
mov eax, dword [0x47d140]
call fcn.0045d700
mov eax, dword [esi + 0x3a8]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473c24
xor eax, eax
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d73c]
mov eax, dword [0x47d140]
call fcn.0045d700
mov eax, dword [esi + 0x4c0]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473dee
call sub.kernel32.dll_GetTickCount
sub eax, dword [0x47d760]
cmp eax, 0x64
jbe 0x473dee
mov eax, dword [esi + 0x3bc]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473d19
xor ebx, ebx
mov eax, dword [esi + 0x3cc]
call fcn.004278b4
call fcn.00472bd4
mov edi, eax
mov eax, dword [ebp - 0x14]
dec eax
je 0x473c8a
sub eax, 4
je 0x473cd4
sub eax, 3
je 0x473cbb
jmp 0x473ceb
mov dword [ebp - 8], 0x63
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d754]
mov eax, dword [0x47d140]
call fcn.0045d700
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 0x63
mov dword [ebp - 0x10], 0x63
mov bl, 1
jmp 0x473ceb
mov dword [ebp - 8], 0x63
mov dword [ebp - 0xc], 0x63
mov dword [ebp - 0x10], 0x63
mov bl, 1
jmp 0x473ceb
mov dword [ebp - 8], 0x63
mov dword [ebp - 0xc], 0x63
mov dword [ebp - 0x10], 0x63
mov bl, 1
test bl, bl
je 0x473d19
push 1
lea ecx, [ebp - 0xc]
mov edx, dword [0x47b954]
mov eax, dword [0x47d140]
call fcn.0045d700
push 1
lea ecx, [ebp - 0x10]
mov edx, dword [0x47b958]
mov eax, dword [0x47d140]
call fcn.0045d700
mov eax, dword [esi + 0x3f8]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473de4
xor ebx, ebx
mov eax, dword [esi + 0x408]
call fcn.004278b4
call fcn.00472bd4
mov edi, eax
mov eax, dword [ebp - 0x14]
dec eax
je 0x473d55
sub eax, 4
je 0x473d9f
sub eax, 3
je 0x473d86
jmp 0x473db6
mov dword [ebp - 8], 0x63
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d754]
mov eax, dword [0x47d140]
call fcn.0045d700
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 0x63
mov dword [ebp - 0x10], 0x63
mov bl, 1
jmp 0x473db6
mov dword [ebp - 8], 0x63
mov dword [ebp - 0xc], 0x63
mov dword [ebp - 0x10], 0x63
mov bl, 1
jmp 0x473db6
mov dword [ebp - 8], 0x63
mov dword [ebp - 0xc], 0x63
mov dword [ebp - 0x10], 0x63
mov bl, 1
test bl, bl
je 0x473de4
push 1
lea ecx, [ebp - 0xc]
mov edx, dword [0x47b960]
mov eax, dword [0x47d140]
call fcn.0045d700
push 1
lea ecx, [ebp - 0x10]
mov edx, dword [0x47b964]
mov eax, dword [0x47d140]
call fcn.0045d700
call sub.kernel32.dll_GetTickCount
mov dword [0x47d760], eax
cmp byte [ebp - 1], 0
je 0x473edd
call sub.kernel32.dll_GetTickCount
sub eax, dword [0x47b92c]
cmp eax, 0x3e8
jbe 0x473edd
cmp byte [0x47d254], 0
jne 0x473edd
mov eax, dword [esi + 0x4ac]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
jne 0x473e51
mov eax, dword [esi + 0x3bc]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473e77
mov eax, dword [esi + 0x4c0]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473e77
xor eax, eax
mov dword [ebp - 8], eax
push 1
lea ecx, [ebp - 8]
mov edx, dword [0x47b954]
mov eax, dword [0x47d140]
call fcn.0045d734
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004757d8
mov eax, dword [esi + 0x4b0]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
jne 0x473ead
mov eax, dword [esi + 0x3f8]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473ed6
mov eax, dword [esi + 0x4c0]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473ed6
xor eax, eax
mov dword [ebp - 8], eax
push 1
lea ecx, [ebp - 8]
mov edx, dword [0x47b960]
mov eax, dword [0x47d140]
call fcn.0045d734
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004757d8
mov byte [0x47d254], 1
mov eax, dword [esi + 0x430]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x473fe9
mov eax, dword [esi + 0x304]
mov eax, dword [eax + 0x34]
test byte [eax + 0x2039], 1
je 0x473fe9
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d708]
mov eax, dword [0x47d140]
call fcn.0045d734
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d710]
mov eax, dword [0x47d140]
call fcn.0045d734
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x304]
mov eax, dword [eax + 0x34]
test byte [eax + 0x2038], 4
je 0x473f5f
mov eax, dword [esi + 0x434]
call fcn.00458b24
sub dword [ebp - 0xc], eax
mov eax, dword [esi + 0x304]
mov eax, dword [eax + 0x34]
test byte [eax + 0x2038], 8
je 0x473f7f
mov eax, dword [esi + 0x434]
call fcn.00458b24
add dword [ebp - 0xc], eax
mov eax, dword [esi + 0x304]
mov eax, dword [eax + 0x34]
test byte [eax + 0x2038], 1
je 0x473f9f
mov eax, dword [esi + 0x434]
call fcn.00458b24
sub dword [ebp - 0x10], eax
mov eax, dword [esi + 0x304]
mov eax, dword [eax + 0x34]
test byte [eax + 0x2038], 2
je 0x473fbf
mov eax, dword [esi + 0x434]
call fcn.00458b24
add dword [ebp - 0x10], eax
push 4
lea ecx, [ebp - 0xc]
mov edx, dword [0x47d708]
mov eax, dword [0x47d140]
call fcn.0045d700
push 4
lea ecx, [ebp - 0x10]
mov edx, dword [0x47d710]
mov eax, dword [0x47d140]
call fcn.0045d700
mov eax, dword [esi + 0x41c]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x4740f5
mov eax, dword [esi + 0x308]
mov eax, dword [eax + 0x34]
test byte [eax + 0x2039], 1
je 0x4740f5
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d70c]
mov eax, dword [0x47d140]
call fcn.0045d734
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d714]
mov eax, dword [0x47d140]
call fcn.0045d734
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x308]
mov eax, dword [eax + 0x34]
test byte [eax + 0x2038], 4
je 0x47406b
mov eax, dword [esi + 0x420]
call fcn.00458b24
sub dword [ebp - 0xc], eax
mov eax, dword [esi + 0x308]
mov eax, dword [eax + 0x34]
test byte [eax + 0x2038], 8
je 0x47408b
mov eax, dword [esi + 0x420]
call fcn.00458b24
add dword [ebp - 0xc], eax
mov eax, dword [esi + 0x308]
mov eax, dword [eax + 0x34]
test byte [eax + 0x2038], 1
je 0x4740ab
mov eax, dword [esi + 0x420]
call fcn.00458b24
sub dword [ebp - 0x10], eax
mov eax, dword [esi + 0x308]
mov eax, dword [eax + 0x34]
test byte [eax + 0x2038], 2
je 0x4740cb
mov eax, dword [esi + 0x420]
call fcn.00458b24
add dword [ebp - 0x10], eax
push 4
lea ecx, [ebp - 0xc]
mov edx, dword [0x47d70c]
mov eax, dword [0x47d140]
call fcn.0045d700
push 4
lea ecx, [ebp - 0x10]
mov edx, dword [0x47d714]
mov eax, dword [0x47d140]
call fcn.0045d700
mov eax, dword [esi + 0x2d0]
mov eax, dword [eax + 0x244]
cmp eax, dword [esi + 0x30c]
jne 0x474112
xor edx, edx
mov eax, esi
call fcn.004785a0
mov eax, dword [esi + 0x42c]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x474206
xor eax, eax
mov dword [ebp - 0x1c], eax
push 4
lea ecx, [ebp - 0x1c]
mov edx, dword [0x47b950]
mov eax, dword [0x47d140]
call fcn.0045d734
cmp dword [ebp - 0x1c], 0xff
jle 0x474152
mov dword [ebp - 0x1c], 0xff
mov eax, dword [esi + 0x3bc]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x47417d
mov eax, dword [esi + 0x4c0]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x47417d
mov dword [ebp - 0x1c], 0x63
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax*4 + 0x47d258]
call fcn.00405254
dec eax
test eax, eax
jl 0x474206
inc eax
mov dword [ebp - 0x24], eax
xor ebx, ebx
mov byte [ebp - 2], 1
xor eax, eax
mov edx, 0x47d660
mov dword [ebp - 0x18], eax
imul ecx, ebx, 0xb
mov edi, dword [ebp - 0x1c]
mov edi, dword [edi*4 + 0x47d258]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0x18]
mov cl, byte [ecx + edi + 8]
cmp cl, byte [edx]
je 0x4741c4
mov byte [ebp - 2], 0
inc eax
inc edx
cmp eax, 0x24
jne 0x4741a2
cmp byte [ebp - 2], 0
je 0x474200
imul eax, ebx, 0xb
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx*4 + 0x47d258]
mov eax, dword [edx + eax*4]
call fcn.00471b4c
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d718]
mov eax, dword [0x47d140]
call fcn.0045d700
jmp 0x474206
inc ebx
dec dword [ebp - 0x24]
jne 0x474197
mov eax, dword [esi + 0x428]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x4742fa
xor eax, eax
mov dword [ebp - 0x1c], eax
push 4
lea ecx, [ebp - 0x1c]
mov edx, dword [0x47b95c]
mov eax, dword [0x47d140]
call fcn.0045d734
cmp dword [ebp - 0x1c], 0xff
jle 0x474246
mov dword [ebp - 0x1c], 0xff
mov eax, dword [esi + 0x3f8]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x474271
mov eax, dword [esi + 0x4c0]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x474271
mov dword [ebp - 0x1c], 0x63
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax*4 + 0x47d258]
call fcn.00405254
dec eax
test eax, eax
jl 0x4742fa
inc eax
mov dword [ebp - 0x24], eax
xor ebx, ebx
mov byte [ebp - 2], 1
xor eax, eax
mov edx, 0x47d68c
mov dword [ebp - 0x18], eax
imul ecx, ebx, 0xb
mov edi, dword [ebp - 0x1c]
mov edi, dword [edi*4 + 0x47d258]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0x18]
mov cl, byte [ecx + edi + 8]
cmp cl, byte [edx]
je 0x4742b8
mov byte [ebp - 2], 0
inc eax
inc edx
cmp eax, 0x24
jne 0x474296
cmp byte [ebp - 2], 0
je 0x4742f4
imul eax, ebx, 0xb
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx*4 + 0x47d258]
mov eax, dword [edx + eax*4]
call fcn.00471b4c
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 8]
mov edx, dword [0x47d71c]
mov eax, dword [0x47d140]
call fcn.0045d700
jmp 0x4742fa
inc ebx
dec dword [ebp - 0x24]
jne 0x47428b
cmp byte [ebp - 1], 0
je 0x474307
mov byte [0x47b968], 0
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0x20]
mov edx, dword [0x47b940]
mov dword [edx*4 + 0x47d6b8], eax
cmp dword [0x47b940], 0xa
jne 0x474368
mov dword [0x47b940], 1
mov eax, dword [esi + 0x2d0]
mov eax, dword [eax + 0x244]
cmp eax, dword [esi + 0x2d4]
jne 0x47436e
mov eax, 0x47d6bc
mov edx, 9
call fcn.00420728
mov ecx, 0xa
cdq
idiv ecx
mov dword [0x47d6e4], eax
mov eax, esi
call fcn.00472640
jmp 0x47436e
inc dword [0x47b940]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4743a0
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.00403b8c
lea eax, [ebp - 0x2c]
call fcn.00403b68
lea eax, [ebp - 0x28]
call fcn.00403b68
ret