Function at 0x40e270
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0xfc]
add eax, 0x800
mov ecx, 0x8000
mov dword [ebp + 0x100], eax
mov edi, dword [ebp + 0x65c]
or eax, 0xffffffff
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xfc]
mov edi, dword [ebp + 0x65c]
mov esi, dword [ebp + 0x664]
mov edx, ecx
add edi, 0x800
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xfc]
xor ecx, ecx
test eax, eax
jle 0x40e2f7
mov edx, dword [ebp + 0x664]
cmp byte [edx + ecx], 0xff
jne 0x40e2e7
inc ecx
cmp ecx, eax
jl 0x40e2dc
cmp ecx, 0x10000
mov dword [esp + 0x14], 0x10000
jg 0x40e2fb
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 0x65c]
mov edi, eax
mov eax, 0x1b4e81b5
mov dword [esp + 0x18], edi
mov word [ebx], 0xa55a
mov ecx, dword [ebp + 0xe4]
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov byte [ebx + 0xa], dl
mov cl, byte [ebp + 0xec]
mov byte [ebx + 0xb], cl
mov edx, dword [ebp + 0x11c]
shl edx, 5
mov ax, word [edx + 0x41e688]
push eax
call fcn.0041bde0
mov word [ebx + 0xc], ax
mov ecx, dword [ebp + 0x11c]
shl ecx, 5
mov dx, word [ecx + 0x41e68a]
push edx
call fcn.0041bde0
mov word [ebx + 0xe], ax
mov byte [ebx + 0x10], 0
mov byte [ebx + 0x11], 0
mov byte [ebx + 0x12], 0
mov byte [ebx + 0x13], 0
mov eax, dword [ebp + 0xf8]
push eax
call fcn.0041bdc0
mov dword [ebx + 0x14], eax
mov ecx, dword [ebp + 0x114]
push ecx
call fcn.0041bdc0
mov dword [ebx + 0x18], eax
fild dword [ebp + 0xf8]
fmul dword [ebp + 0x1e0]
call sub.MSVCRT.dll__ftol
push eax
call fcn.0041bdc0
mov dword [ebx + 0x1a3], eax
mov edx, dword [ebp + 0x698]
push edx
call fcn.0041bdc0
mov dword [ebx + 0x1a9], eax
mov al, byte [ebp + 0x69c]
mov byte [ebx + 0x1ad], al
mov cl, byte [ebp + 0x69d]
mov byte [ebx + 0x1ae], cl
mov dl, byte [ebp + 0x69e]
mov byte [ebx + 0x1af], dl
mov al, byte [ebp + 0x69f]
mov byte [ebx + 0x1b0], al
mov cl, byte [ebp + 0x6a0]
mov byte [ebx + 0x1b1], cl
mov dl, byte [ebp + 0x6a1]
mov byte [ebx + 0x1b2], dl
mov al, byte [ebp + 0x6a2]
mov byte [ebx + 0x1b3], al
mov cl, byte [ebp + 0x6a3]
mov byte [ebx + 0x1b4], cl
mov al, byte [ebx + 0x10]
or al, 0x20
mov byte [ebx + 0x10], al
mov edx, dword [ebp + 0x168]
push edx
call fcn.0041bdc0
mov dword [ebx + 0x1c], eax
mov ecx, dword [ebp + 0x670]
lea eax, [ebx + 0x20]
add esp, 0x1c
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp + 0x11c]
shl edx, 5
mov eax, dword [edx + 0x41e680]
mov ecx, eax
and ecx, 0x7f8000
cmp ecx, 0x168000
jb 0x40e480
test al, 8
jne 0x40e480
mov byte [ebx + 0x23], 0xff
mov al, byte [ebp + 0x2f]
test al, al
je 0x40e4a6
mov al, byte [ebx + 0x10]
lea edi, [ebx + 0x300]
or al, 1
mov ecx, 0x40
mov byte [ebx + 0x10], al
mov esi, dword [ebp + 0x66c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x18]
mov al, byte [ebp + 0x27]
test al, al
je 0x40e4b1
or byte [ebx + 0x10], 2
mov edx, dword [ebp + 0x670]
test byte [edx + 0x10], 1
jne 0x40e51b
mov al, byte [ebx + 0x10]
or al, 4
mov byte [ebx + 0x10], al
mov ecx, dword [ebp + 0x670]
test byte [ecx + 0x10], 2
jne 0x40e4da
and eax, 0xff
or al, 8
jmp 0x40e4e1
and eax, 0xff
and al, 0xf7
mov byte [ebx + 0x10], al
mov edx, dword [ebp + 0x670]
test byte [edx + 0x10], 4
jne 0x40e4f9
and eax, 0xff
or al, 0x10
jmp 0x40e500
and eax, 0xff
and al, 0xef
mov byte [ebx + 0x10], al
mov eax, dword [ebp + 0x670]
mov cl, byte [eax + 0x11]
mov byte [ebx + 0x30], cl
mov edx, dword [ebp + 0x670]
mov al, byte [edx + 0x12]
mov byte [ebx + 0x31], al
mov eax, dword [ebp + 0xf0]
test eax, eax
je 0x40e529
or byte [ebx + 0x10], 0x40
mov ecx, dword [ebp + 0x11c]
shl ecx, 5
test byte [ecx + 0x41e680], 0x20
je 0x40e53f
or byte [ebx + 0x10], 0x80
mov dl, byte [ebp + 0x10c]
mov byte [ebx + 0x32], dl
mov eax, dword [ebp + 0x11c]
shl eax, 5
mov ecx, dword [eax + 0x41e680]
shr ecx, 0xf
mov byte [ebx + 0x33], cl
mov al, byte [ebp + 0x31]
test al, al
je 0x40e5d7
mov eax, dword [ebp + 0x88]
mov esi, dword [esp + 0x14]
cmp esi, eax
jl 0x40e578
mov esi, eax
mov dword [esp + 0x14], esi
mov edx, dword [ebp + 0x90]
add eax, edx
cmp edi, eax
jg 0x40e58a
mov edi, eax
mov dword [esp + 0x18], edi
mov dl, byte [ebx + 0x11]
or dl, 1
mov byte [ebx + 0x11], dl
mov eax, dword [ebp + 0x88]
push eax
call fcn.0041bdc0
mov dword [ebx + 0x34], eax
mov cl, byte [ebp + 0x90]
lea edx, [ebp + 0x48]
push 0x10
lea eax, [ebx + 0x40]
push edx
push eax
mov byte [ebx + 0x3c], cl
call fcn.0041bd90
lea ecx, [ebp + 0x68]
push 0x10
lea edx, [ebx + 0x60]
push ecx
push edx
call fcn.0041bd90
mov al, byte [ebp + 0x98]
add esp, 0x1c
mov byte [ebx + 0x3e], al
jmp 0x40e5db
mov esi, dword [esp + 0x14]
mov al, byte [ebp + 0x32]
test al, al
je 0x40e64f
mov eax, dword [ebp + 0x8c]
cmp esi, eax
jl 0x40e5f2
mov esi, eax
mov dword [esp + 0x14], esi
mov ecx, dword [ebp + 0x94]
add eax, ecx
cmp edi, eax
jg 0x40e604
mov edi, eax
mov dword [esp + 0x18], edi
mov cl, byte [ebx + 0x11]
or cl, 2
mov byte [ebx + 0x11], cl
mov edx, dword [ebp + 0x8c]
push edx
call fcn.0041bdc0
lea ecx, [ebp + 0x58]
mov dword [ebx + 0x38], eax
mov al, byte [ebp + 0x94]
push 0x10
lea edx, [ebx + 0x50]
push ecx
push edx
mov byte [ebx + 0x3d], al
call fcn.0041bd90
lea eax, [ebp + 0x78]
push 0x10
lea ecx, [ebx + 0x70]
push eax
push ecx
call fcn.0041bd90
mov dl, byte [ebp + 0x9c]
add esp, 0x1c
mov byte [ebx + 0x3f], dl
mov al, byte [ebp + 0x29]
test al, al
je 0x40e65a
or byte [ebx + 0x11], 4
mov al, byte [ebp + 0x2a]
test al, al
jne 0x40e665
or byte [ebx + 0x12], 4
mov al, byte [ebp + 0x2b]
test al, al
je 0x40e670
or byte [ebx + 0x12], 8
mov al, byte [ebp + 0x2c]
test al, al
jne 0x40e67b
or byte [ebx + 0x12], 0x10
mov eax, dword [ebp + 0x11c]
shl eax, 5
test byte [eax + 0x41e680], 4
je 0x40e691
or byte [ebx + 0x12], 0x20
mov cl, byte [ebp + 0xd8]
mov dl, byte [ebx + 0x12]
shl cl, 6
or dl, cl
mov byte [ebx + 0x12], dl
mov dl, byte [ebp + 0xf4]
mov byte [ebx + 0x80], dl
mov al, byte [ebp + 0x38]
test al, al
je 0x40e7ab
mov eax, dword [ebp + 0xd0]
cmp esi, eax
jl 0x40e6c7
mov dword [esp + 0x14], eax
mov ecx, dword [ebp + 0xcc]
add eax, ecx
cmp edi, eax
jg 0x40e6d7
mov dword [esp + 0x18], eax
mov al, byte [ebx + 0x11]
or al, 0x40
mov byte [ebx + 0x11], al
mov ecx, dword [ebp + 0xb8]
mov eax, 0x1b4e81b5
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov byte [ebx + 0xa3], dl
mov ecx, dword [ebp + 0xc4]
cmp ecx, 0x20
jle 0x40e70c
mov ecx, 0x20
mov byte [ebx + 0xa4], cl
mov esi, dword [ebp + 0x674]
and ecx, 0xff
lea edi, [ebx + 0xa5]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xcc]
cmp eax, 0x800
jle 0x40e744
mov eax, 0x800
push eax
mov word [ebx + 0xe5], ax
call fcn.0041bde0
mov word [ebx + 0xe5], ax
mov eax, dword [ebp + 0xd0]
push eax
call fcn.0041bdc0
mov dword [ebx + 0xe7], eax
mov ecx, dword [ebp + 0xc8]
add esp, 8
cmp ecx, 0x1f
jle 0x40e77d
mov ecx, 0x1f
mov byte [ebx + 0xc5], cl
mov esi, dword [ebp + 0x678]
and ecx, 0xff
lea edi, [ebx + 0xc6]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov al, byte [ebp + 0xed8]
test al, al
jne 0x40e7d7
mov al, byte [ebp + 0xed9]
test al, al
jne 0x40e7d7
mov al, byte [ebp + 0xeda]
test al, al
jne 0x40e7d7
mov al, byte [ebp + 0xedb]
test al, al
je 0x40e915
mov cl, byte [ebx + 0x11]
or cl, 8
mov byte [ebx + 0x11], cl
mov al, byte [ebp + 0xedc]
mov byte [ebx + 0xeb], al
mov cl, byte [ebp + 0xedd]
mov byte [ebx + 0xec], cl
mov dl, byte [ebp + 0xede]
mov byte [ebx + 0xed], dl
mov al, byte [ebp + 0xedf]
lea ecx, [ebp + 0xee0]
mov byte [ebx + 0xee], al
lea edx, [ebx + 0xef]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp + 0xef0]
push edx
call fcn.0041bdc0
mov dword [ebx + 0xff], eax
mov eax, dword [ebp + 0xef4]
push eax
call fcn.0041bdc0
mov dword [ebx + 0x103], eax
mov ecx, dword [ebp + 0xef8]
push ecx
call fcn.0041bdc0
mov dword [ebx + 0x107], eax
mov edx, dword [ebp + 0xefc]
push edx
call fcn.0041bdc0
mov dword [ebx + 0x10b], eax
mov al, byte [ebp + 0xed8]
add esp, 0x10
test al, al
je 0x40e8a4
mov eax, dword [ebp + 0xef0]
cmp esi, eax
jl 0x40e897
mov esi, eax
mov dword [esp + 0x14], esi
add eax, 7
cmp edi, eax
jg 0x40e8a4
mov edi, eax
mov dword [esp + 0x18], edi
mov al, byte [ebp + 0xed9]
test al, al
je 0x40e8cb
mov eax, dword [ebp + 0xef4]
cmp esi, eax
jl 0x40e8be
mov esi, eax
mov dword [esp + 0x14], esi
add eax, 7
cmp edi, eax
jg 0x40e8cb
mov edi, eax
mov dword [esp + 0x18], edi
mov al, byte [ebp + 0xeda]
test al, al
je 0x40e8f2
mov eax, dword [ebp + 0xef8]
cmp esi, eax
jl 0x40e8e5
mov esi, eax
mov dword [esp + 0x14], esi
add eax, 7
cmp edi, eax
jg 0x40e8f2
mov edi, eax
mov dword [esp + 0x18], edi
mov al, byte [ebp + 0xedb]
test al, al
je 0x40e915
mov eax, dword [ebp + 0xefc]
cmp esi, eax
jl 0x40e90a
mov dword [esp + 0x14], eax
add eax, 7
cmp edi, eax
jg 0x40e915
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x11c]
shl eax, 5
mov ecx, dword [eax + 0x41e68c]
push ecx
call fcn.0041bdc0
mov dword [ebx + 0x10f], eax
mov eax, dword [ebp + 0x11c]
shl eax, 5
mov edx, dword [eax + 0x41e690]
mov edi, dword [eax + 0x41e68c]
add edx, edi
push edx
call fcn.0041bdc0
mov dword [ebx + 0x113], eax
mov eax, dword [ebp + 0x16c]
add esp, 8
cmp eax, 0x10
jle 0x40e966
mov eax, 0x10
mov cl, 0xa
imul cl
test al, al
mov byte [ebx + 0x117], al
jne 0x40e97b
mov byte [ebx + 0x117], 0x32
mov al, byte [ebp + 0xf00]
test al, al
je 0x40e9df
mov dl, byte [ebp + 0xf04]
lea esi, [ebp + 0xf0c]
mov byte [ebx + 0x118], dl
mov al, byte [ebp + 0xf08]
mov byte [ebx + 0x119], al
mov ecx, dword [ebp + 0xf04]
mov edx, ecx
lea edi, [ebx + 0x11a]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xf08]
lea esi, [ebp + 0x100c]
mov eax, ecx
lea edi, [ebx + 0x15a]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x40e9ed
mov byte [ebx + 0x118], 0
mov byte [ebx + 0x119], 0
mov ecx, dword [ebp + 0x670]
test byte [ecx + 0xf], 2
je 0x40ea3a
mov eax, dword [ebp + 0x11c]
shl eax, 5
mov ecx, dword [eax + 0x41e680]
and ecx, 0x7f8000
cmp ecx, 0x168000
jae 0x40ea28
mov eax, dword [eax + 0x41e68c]
mov edx, dword [esp + 0x18]
cmp edx, eax
jg 0x40ea28
mov dword [esp + 0x18], eax
cmp ecx, 0xc8000
jb 0x40ea36
or byte [ebx + 0x11], 0x80
jmp 0x40ea3a
or byte [ebx + 0x12], 1
mov al, byte [ebp + 0x39]
test al, al
je 0x40ea69
mov eax, dword [ebp + 0x11c]
shl eax, 5
test byte [eax + 0x41e680], 8
je 0x40ea65
mov edx, dword [eax + 0x41e698]
sub edx, 0x800
mov dword [ebx + 0x113], edx
or byte [ebx + 0x12], 2
mov al, byte [ebp + 0x188]
mov esi, dword [esp + 0x18]
mov byte [ebx + 0x19a], al
mov cl, byte [ebp + 0x18c]
mov byte [ebx + 0x19b], cl
mov dl, byte [ebp + 0x190]
mov byte [ebx + 0x19c], dl
mov eax, dword [ebp + 0x664]
push 0
push esi
push eax
mov ecx, ebp
call fcn.004020a0
push eax
call fcn.0041bde0
mov word [ebx + 4], ax
mov ecx, dword [ebp + 0x11c]
lea eax, [esi + 0x7f]
mov edi, dword [esp + 0x18]
cdq
and edx, 0x7f
push 3
add eax, edx
push 0x4317e8
mov esi, eax
and edi, 0xfffffe00
shl ecx, 5
sar esi, 7
mov edx, dword [ecx + 0x41e684]
shl esi, 7
push edx
mov dword [esp + 0x28], esi
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0x10
test eax, eax
je 0x40eb03
mov eax, dword [ebp + 0x11c]
shl eax, 5
cmp word [eax + 0x41e688], 0xf55f
jne 0x40eb26
mov eax, dword [ebp + 0x11c]
xor ecx, ecx
shl eax, 5
mov cl, byte [eax + 0x41e69c]
mov eax, dword [eax + 0x41e68c]
sub eax, ecx
cmp esi, eax
jl 0x40eb26
mov esi, eax
mov dword [esp + 0x18], esi
push esi
call fcn.0041bdc0
push edi
mov dword [ebx + 6], eax
call fcn.0041bdc0
mov dword [ebx + 0x19d], eax
mov al, byte [ebp + 0x25]
add esp, 8
test al, al
je 0x40ecc1
mov edx, dword [ebp + 0xf0]
mov al, byte [ebp + 0x10c]
neg edx
sbb dl, dl
lea ecx, [esp + 0x15]
and dl, 2
push ecx
push 2
add dl, 3
push 0
push 0x40
mov ecx, ebp
mov byte [esp + 0x24], 0xff
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], al
call fcn.00410b40
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x13]
mov ecx, ebp
push edx
push 1
push 0
push 1
mov byte [esp + 0x23], 4
call fcn.00410b40
mov eax, dword [ebp + 0x16c]
mov ecx, ebp
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
push eax
call fcn.00402970
push 1
push 0
mov ecx, ebp
call fcn.00402700
mov al, byte [ebp + 0x23]
test al, al
je 0x40eed6
mov ecx, ebp
call fcn.00402990
test al, al
jne 0x40eee3
lea ecx, [ebp + 0x6aa]
push 1
push ecx
mov ecx, ebp
call fcn.00402700
test al, al
je 0x40ebc2
mov al, byte [ebp + 0x25]
test al, al
je 0x40ec0e
mov eax, dword [ebp + 0x1c4]
test eax, eax
je 0x40ec0e
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
lea edi, [ebp + 0x6aa]
xor eax, eax
lea esi, [ebx + 0x1a1]
mov ah, byte [edi]
mov al, byte [ebp + 0x6ab]
push eax
call fcn.0041bde0
add esp, 4
mov word [esi], ax
mov dl, byte [ebp + 0x170]
mov ecx, ebp
push esi
mov byte [ebx + 0x1a7], dl
mov al, byte [ebp + 0x174]
push 2
push 0
push 2
mov byte [ebx + 0x1a8], al
call fcn.00410b40
mov eax, dword [ebp + 0x16c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
shl ecx, 3
push ecx
mov ecx, ebp
call fcn.00402970
push 1
push 0
mov ecx, ebp
call fcn.00402700
mov al, byte [ebp + 0x23]
test al, al
je 0x40eed6
mov ecx, ebp
call fcn.00402990
test al, al
jne 0x40eee3
push 1
push edi
mov ecx, ebp
call fcn.00402700
test al, al
je 0x40ec7b
mov al, byte [ebp + 0x25]
test al, al
je 0x40ecc1
mov eax, dword [ebp + 0x1c4]
test eax, eax
je 0x40ecc1
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
mov edx, dword [ebp + 0x65c]
push 4
push 0x3fc
push edx
mov ecx, ebp
call fcn.004020a0
push eax
call fcn.0041bde0
mov word [ebx + 2], ax
mov eax, dword [esp + 0x1c]
add esp, 4
add eax, 0x800
mov ecx, ebp
mov dword [ebp + 0x100], eax
push 0x32e2
call fcn.00401ed0
push eax
push ebp
call fcn.00401f10
add esp, 8
mov ecx, ebp
push 0
push 0
call fcn.00402040
mov eax, dword [ebp + 0x100]
xor ebx, ebx
test eax, eax
mov dword [esp + 0x14], eax
mov byte [ebp + 0xaaa], 0xf4
jle 0x40ee83
jmp 0x40ed34
mov eax, dword [esp + 0x14]
mov cl, byte [ebp + 0x25]
test cl, cl
je 0x40ed4d
cmp eax, 0x38
jge 0x40ed46
mov byte [esp + 0x18], al
jmp 0x40ed5d
mov byte [esp + 0x18], 0x38
jmp 0x40ed5d
cmp eax, 0x80
mov byte [esp + 0x18], al
jl 0x40ed5d
mov byte [esp + 0x18], 0x80
test cl, cl
je 0x40ed7b
mov ecx, dword [ebp + 0x65c]
mov esi, dword [esp + 0x18]
add ecx, ebx
push ecx
push esi
push ebx
push 0x49
mov ecx, ebp
call fcn.00410b40
jmp 0x40edc9
mov esi, dword [ebp + 0x65c]
mov edx, ebx
xor eax, eax
add esi, ebx
shr edx, 0x10
mov al, bh
lea edi, [ebp + 0xaae]
mov ecx, 0x20
mov byte [ebp + 0xaab], dl
mov byte [ebp + 0xaac], al
mov byte [ebp + 0xaad], bl
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x18]
lea eax, [ebp + 0xaaa]
mov ecx, esi
and ecx, 0xff
add ecx, 4
push ecx
push eax
mov ecx, ebp
call fcn.00402560
push 0x7d0
mov ecx, ebp
call fcn.00402970
push 1
push 0
mov ecx, ebp
call fcn.00402700
mov al, byte [ebp + 0x23]
test al, al
je 0x40eed6
mov ecx, ebp
call fcn.00402990
test al, al
jne 0x40eee3
lea edx, [ebp + 0x6aa]
push 1
push edx
mov ecx, ebp
call fcn.00402700
test al, al
je 0x40ede0
mov al, byte [ebp + 0x25]
test al, al
je 0x40ee38
mov ecx, dword [ebp + 0x1c4]
test ecx, ecx
jne 0x40ecb4
test al, al
je 0x40ee38
cmp byte [ebp + 0x6aa], 0x54
je 0x40ee59
test al, al
jne 0x40ecb4
mov al, byte [ebp + 0x6aa]
mov cl, byte [ebp + 0xaaa]
cmp al, cl
jne 0x40ecb4
cmp byte [ebp + 0x6ab], 0x54
jne 0x40ecb4
mov ecx, dword [ebp + 0x100]
push ecx
push ebx
mov ecx, ebp
call fcn.00402040
mov ecx, dword [esp + 0x14]
mov eax, esi
and eax, 0xff
sub ecx, eax
add ebx, eax
test ecx, ecx
mov dword [esp + 0x14], ecx
jg 0x40ed30
push 0
push 0
mov ecx, ebp
call fcn.00402040
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
sub eax, ebx
sub esp, 8
mov dword [esp + 0x24], eax
mov ecx, ebp
fild qword [esp + 0x24]
fmul dword [0x427718]
fstp qword [esp]
push 0x32df
call fcn.00401ed0
push eax
push ebp
call fcn.00401f10
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x14
ret