Function at 0x495684
Capabilities:
Access peb ldr_data
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
call fcn.00403fd8
mov eax, dword [ebp - 0xc]
call fcn.00403fd8
xor eax, eax
push ebp
push 0x496056
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x438], 0
mov eax, dword [ebp - 4]
mov dl, byte [ebp + 0x14]
mov byte [eax + 0x418], dl
mov eax, dword [ebp - 4]
mov byte [eax + 0x378], 0
mov byte [ebp - 0x19], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x331], 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
call fcn.0048bfb8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x370], 0
je 0x49602e
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00494ad0
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x310]
test edi, edi
je 0x49573e
mov eax, edi
mov dl, 1
mov ecx, dword [eax]
call dword [ecx - 4]
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x310], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x43a], 2
jne 0x49578c
cmp byte [esi], 0
je 0x49578c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x370], 0
je 0x49578c
mov ecx, 0x496070
mov dl, 0x14
mov eax, dword [ebp - 4]
call fcn.0048e7b0
mov eax, dword [ebp - 4]
mov dword [eax + 0x408], 0
mov dword [eax + 0x40c], 0
mov eax, dword [ebp - 0xc]
call fcn.004092d0
mov byte [esi], 0
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x48a09c]
call fcn.0048a478
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x310], ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2d0]
mov eax, ebx
call fcn.0048ebec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov byte [eax + 0x318], 2
mov byte [eax + 0x30c], 0
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x31b]
mov byte [eax + 0x31b], dl
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x320]
mov dword [eax + 0x320], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x440]
mov dword [eax + 0xd0], edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x30], edx
mov dword [eax + 0x2c], 0x497e24
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x94]
mov dword [eax + 0x94], ecx
mov ecx, dword [edx + 0x98]
mov dword [eax + 0x98], ecx
mov edx, dword [ebp - 4]
mov dword [eax + 0x28], edx
mov dword [eax + 0x24], 0x497f68
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [eax + 0x100], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x104], edx
xor edx, edx
push ebp
push 0x496024
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
call fcn.004091c4
test al, al
jne 0x49587a
mov eax, dword [ebp - 0xc]
call fcn.0045770c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
call fcn.004092e8
xor eax, eax
push ebp
push 0x4958a6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x22
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x40f614]
call fcn.00413c4c
mov dword [ebp - 0x20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4958e6
cmp byte [ebp + 0x14], 1
je 0x49591c
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe8], 0xa
je 0x49591c
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe8], 0x10
je 0x49591c
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe8], 0xb
je 0x49591c
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe8], 0xd
jne 0x495954
mov byte [ebp + 0x14], 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0049736c
test al, al
je 0x495950
mov eax, dword [ebp - 4]
cmp byte [eax + 0x370], 0
je 0x495950
mov eax, dword [ebp - 0x18]
mov edx, dword [0x5536c4]
mov edx, dword [edx]
call fcn.00403f34
jne 0x495954
mov byte [ebp + 0x14], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x370], 0
jne 0x495974
mov eax, dword [ebp - 4]
mov byte [eax + 0x438], 2
call fcn.004036bc
jmp 0x49602e
cmp byte [ebp + 0x14], 0
je 0x4959b4
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00494d60
test al, al
jne 0x495a26
mov eax, dword [ebp - 4]
mov byte [eax + 0x438], 2
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x491eac]
call fcn.0040ba70
call fcn.0040361c
jmp 0x495a26
mov eax, dword [0x5535d4]
mov eax, dword [eax]
call fcn.0043b2ec
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x420]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x41c]
mov eax, dword [ebp - 4]
call fcn.00499c14
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x310]
mov dword [ebx + 0xf8], eax
mov eax, ebx
mov dl, 1
call fcn.0048d050
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0048fbe4
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
call fcn.0048ed18
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00403e2c
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0049778c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x331], 0
jne 0x495a3e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x332], 0
je 0x495a48
call fcn.004036bc
jmp 0x49602e
mov dl, 0xe
mov eax, dword [ebp - 4]
call fcn.00497f10
test al, al
je 0x495a60
call fcn.004036bc
jmp 0x49602e
mov eax, dword [ebp - 4]
cmp word [eax + 0x11a], 0
je 0x495a91
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x118]
mov dword [eax + 0x118], ecx
mov ecx, dword [edx + 0x11c]
mov dword [eax + 0x11c], ecx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x370], 0
jne 0x495ab1
mov eax, dword [ebp - 4]
mov byte [eax + 0x438], 2
call fcn.004036bc
jmp 0x49602e
cmp byte [esi], 0
je 0x495b0b
cmp dword [ebp - 0x20], 0
je 0x495b0b
cmp byte [esi], 0
je 0x495af4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x424], 0
je 0x495af4
mov eax, dword [ebp - 0x20]
call fcn.004136b0
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x428]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, dword [ebp - 0x20]
call fcn.00413700
mov eax, dword [ebp - 0x20]
call fcn.004136b0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x408], eax
mov dword [ecx + 0x40c], edx
cmp byte [esi], 0
je 0x495c2b
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40c], 0
jne 0x495b27
cmp dword [eax + 0x408], 0
je 0x495c2b
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x432]
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x432], 0
xor eax, eax
push ebp
push 0x495c24
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push dword [eax + 0x40c]
push dword [eax + 0x408]
lea eax, [ebp - 0x2c]
call fcn.00408e6c
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x4960b4
call fcn.00403e70
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.00494234
mov eax, dword [ebp - 4]
cmp word [eax + 0x2e0], 0x1a5
jne 0x495bac
mov eax, dword [ebp - 4]
mov byte [eax + 0x438], 2
call fcn.004036bc
call fcn.004036bc
jmp 0x49602e
mov eax, dword [ebp - 4]
cmp word [eax + 0x2e0], 0x15e
je 0x495bf8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x370], 0
je 0x495bf8
mov ecx, 0x496070
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.0048e7b0
mov eax, dword [ebp - 4]
mov dword [eax + 0x408], 0
mov dword [eax + 0x40c], 0
push 0
push 0
mov eax, dword [ebp - 0x20]
call fcn.00413700
push 0
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004971fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495c42
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0x21]
mov byte [eax + 0x432], dl
ret
mov eax, dword [ebp - 4]
mov dword [eax + 0x408], 0
mov dword [eax + 0x40c], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x331], 0
jne 0x495c5a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x332], 0
je 0x495c64
call fcn.004036bc
jmp 0x49602e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x370], 0
jne 0x495c84
mov eax, dword [ebp - 4]
mov byte [eax + 0x438], 2
call fcn.004036bc
jmp 0x49602e
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov dword [eax + 0x2e8], edx
mov dword [eax + 0x2e4], 0x494b50
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov edx, 0x4960c4
call fcn.00403e70
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.00494234
mov dl, 0xe
mov eax, dword [ebp - 4]
call fcn.00497f10
test al, al
je 0x495ccf
call fcn.004036bc
jmp 0x49602e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x370], 0
jne 0x495ce5
call fcn.004036bc
jmp 0x49602e
mov eax, dword [ebp - 4]
test byte [eax + 0x2f1], 2
jne 0x495d01
cmp byte [ebp + 0x14], 0
jne 0x495d01
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004984c4
mov eax, dword [ebp - 4]
cmp word [eax + 0x39a], 0
je 0x495d20
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x39c]
call dword [ebx + 0x398]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x100]
mov dword [eax + 0x100], ecx
mov ecx, dword [edx + 0x104]
mov dword [eax + 0x104], ecx
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x334], eax
cmp dword [ebp - 0x20], 0
je 0x495d60
lea eax, [ebp - 0x20]
call fcn.004556ac
mov eax, dword [ebp - 4]
cmp byte [eax + 0x331], 0
jne 0x495d89
mov eax, dword [ebp - 4]
cmp byte [eax + 0x332], 0
jne 0x495d89
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov edx, dword [ebp - 0xc]
call fcn.0048cba0
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a2], 0
je 0x495da8
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x3a4]
call dword [ebx + 0x3a0]
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x334]
mov edx, dword [ebp - 4]
mov dword [edx + 0x334], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x310]
mov ecx, dword [edx + 0x110]
mov dword [eax + 0x100], ecx
mov ecx, dword [edx + 0x114]
mov dword [eax + 0x104], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
xor ecx, ecx
xor edx, edx
call fcn.0048e504
mov eax, dword [ebp - 4]
cmp byte [eax + 0x331], 0
jne 0x495e27
mov eax, dword [ebp - 4]
cmp byte [eax + 0x332], 0
jne 0x495e27
mov eax, dword [ebp - 4]
cmp word [eax + 0x2e0], 0xc7
jge 0x495e27
mov dx, 5
mov eax, dword [ebp - 4]
call fcn.0048ece8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x331], 0
jne 0x495eda
mov eax, dword [ebp - 4]
cmp byte [eax + 0x332], 0
jne 0x495eda
mov eax, dword [ebp - 4]
cmp word [eax + 0x2e0], 0xc7
jge 0x495eda
mov edx, 0x2710
mov eax, dword [ebp - 4]
call fcn.0048d358
mov eax, dword [ebp - 4]
mov byte [eax + 0x330], 1
xor edx, edx
push ebp
push 0x495ed3
push dword fs:[edx]
mov dword fs:[edx], esp
jmp 0x495e92
push 0
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004971fc
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x2e0]
cmp ax, 0xc7
jge 0x495eb3
test ax, ax
je 0x495eb3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x370], 0
jne 0x495e80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495eda
mov eax, dword [ebp - 4]
call fcn.0048d3a8
mov eax, dword [ebp - 4]
mov byte [eax + 0x330], 0
ret
mov byte [ebp - 0x19], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49602e
cmp dword [ebp - 0x20], 0
je 0x495ef9
lea eax, [ebp - 0x20]
call fcn.004556ac
mov eax, dword [ebp - 4]
cmp byte [eax + 0x331], 0
je 0x495f17
push 0
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004971fc
mov eax, dword [ebp - 4]
cmp byte [eax + 0x438], 0
jne 0x495f69
mov eax, dword [ebp - 4]
cmp word [eax + 0x2e0], 0x12c
jle 0x495f69
mov eax, dword [ebp - 4]
cmp word [eax + 0x2e0], 0x258
jge 0x495f69
mov eax, dword [ebp - 0xc]
call fcn.00457740
cmp edx, dword [ebp + 0xc]
jne 0x495f5f
cmp eax, dword [ebp + 8]
jne 0x495f5f
mov eax, dword [ebp - 4]
mov word [eax + 0x2e0], 0xc8
jmp 0x495f69
mov eax, dword [ebp - 4]
mov byte [eax + 0x438], 2
cmp byte [ebp - 0x19], 0
jne 0x495f8e
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a2], 0
je 0x495f8e
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x3a4]
call dword [ebx + 0x3a0]
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x310]
test esi, esi
je 0x495faf
mov eax, esi
mov dl, 1
mov ecx, dword [eax]
call dword [ecx - 4]
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x310], edx
mov eax, dword [ebp - 4]
cmp word [eax + 0x2e0], 0x96
jne 0x495ffc
mov eax, dword [ebp - 4]
cmp byte [eax + 0x370], 0
je 0x495ffc
mov eax, dword [ebp - 4]
cmp byte [eax + 0x331], 0
jne 0x495ffc
mov eax, dword [ebp - 4]
cmp byte [eax + 0x332], 0
jne 0x495ffc
mov eax, dword [ebp - 4]
cmp byte [eax + 0x378], 0
jne 0x495ffc
mov cl, 1
mov edx, 0x4960d4
mov eax, dword [ebp - 4]
call fcn.00497080
cmp byte [ebp - 0x19], 0
je 0x496023
mov eax, dword [ebp - 4]
cmp word [eax + 0x3c2], 0
je 0x496023
mov ebx, dword [ebp - 4]
mov cl, 0xe
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x3c4]
call dword [ebx + 0x3c0]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49605d
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00403bcc
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00403bcc
ret