Function at 0x495bb8
Capabilities:
Access peb ldr_data
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x495bc1
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00403fd8
mov eax, dword [ebp - 8]
call fcn.00403fd8
xor eax, eax
push ebp
push 0x4964ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x430], 0
mov byte [ebp - 0x21], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x410], bl
mov eax, dword [ebp - 4]
mov byte [eax + 0x329], 0
mov eax, dword [ebp - 4]
call fcn.0048b978
mov eax, dword [ebp - 4]
cmp byte [eax + 0x368], 0
je 0x4964c5
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004943ec
xor eax, eax
push ebp
push 0x495c67
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x40f600]
call fcn.00413c38
mov dword [ebp - 0x20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495ca7
mov eax, dword [ebp - 0x20]
call fcn.0041369c
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xf8], eax
mov dword [ecx + 0xfc], edx
lea eax, [ebp - 0x20]
call fcn.00455580
xor edx, edx
push ebp
push 0x4964bb
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x489a94]
call fcn.00489e4c
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x308], esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2c8]
mov eax, esi
call fcn.0048e538
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x438]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov dword [eax + 0xc8], edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x30], edx
mov dword [eax + 0x2c], 0x4976f8
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x8c]
mov dword [eax + 0x8c], ecx
mov ecx, dword [edx + 0x90]
mov dword [eax + 0x90], ecx
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x314]
mov byte [eax + 0x314], dl
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x31c]
mov dword [eax + 0x31c], edx
mov byte [eax + 0x310], 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x364]
call fcn.0048a250
mov eax, dword [ebp - 4]
mov dword [eax + 0x400], 0
mov dword [eax + 0x404], 0
cmp bl, 1
je 0x495dc6
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe0], 0xa
je 0x495dc6
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe0], 0x10
je 0x495dc6
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe0], 0xb
je 0x495dc6
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe0], 0xd
jne 0x495e32
mov bl, 1
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00496c38
test al, al
je 0x495df8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x368], 0
je 0x495df8
mov eax, dword [ebp - 0x14]
mov edx, dword [0x54e6e4]
mov edx, dword [edx]
call fcn.00403f34
jne 0x495e32
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x2d8]
cmp ax, 0xe2
je 0x495e0d
test ax, ax
jne 0x495e30
mov eax, dword [ebp - 4]
mov byte [eax + 0x430], 1
mov ecx, dword [0x54e6e4]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x407d18]
call fcn.0040ba5c
call fcn.0040361c
xor ebx, ebx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x368], 0
jne 0x495e52
mov eax, dword [ebp - 4]
mov byte [eax + 0x430], 2
call fcn.004036bc
jmp 0x4964c5
test bl, bl
je 0x495ee5
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.004088d0
mov edx, dword [ebp - 0x28]
mov eax, 0x496524
call fcn.0040410c
test eax, eax
jle 0x495e99
push ebp
call fcn.004959a8
pop ecx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x430], 2
jne 0x495e99
call fcn.004036bc
jmp 0x4964c5
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0049467c
test al, al
jne 0x495f7c
mov eax, dword [ebp - 4]
mov byte [eax + 0x430], 2
mov eax, dword [ebp - 4]
mov byte [eax + 0x329], 1
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4917bc]
call fcn.0040ba5c
call fcn.0040361c
call fcn.004036bc
jmp 0x4964c5
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x418]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x414]
mov eax, dword [ebp - 4]
call fcn.00499518
mov edx, dword [ebp - 4]
mov esi, dword [edx + 0x308]
mov dword [esi + 0xf0], eax
mov eax, esi
mov dl, 1
call fcn.0048ca10
mov eax, dword [ebp - 4]
cmp word [eax + 0x11a], 0
je 0x495f48
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x118]
mov dword [eax + 0x118], ecx
mov ecx, dword [edx + 0x11c]
mov dword [eax + 0x11c], ecx
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0048f4e4
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.0048e67c
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00403e2c
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0049709c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x368], 0
jne 0x495f9c
mov eax, dword [ebp - 4]
mov byte [eax + 0x430], 2
call fcn.004036bc
jmp 0x4964c5
mov dl, 0xf
mov eax, dword [ebp - 4]
call fcn.00497808
test al, al
je 0x495fb4
call fcn.004036bc
jmp 0x4964c5
mov eax, dword [ebp - 4]
cmp word [eax + 0x11a], 0
je 0x495fe5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x118]
mov dword [eax + 0x118], ecx
mov ecx, dword [edx + 0x11c]
mov dword [eax + 0x11c], ecx
test bl, bl
je 0x49600b
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.004088d0
mov edx, dword [ebp - 0x28]
mov eax, 0x496524
call fcn.0040410c
test eax, eax
jne 0x496028
push ebp
call fcn.004959a8
pop ecx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x430], 2
jne 0x496028
call fcn.004036bc
jmp 0x4964c5
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x2d8]
cmp ax, 0x12c
jle 0x49608a
cmp ax, 0x258
jge 0x49608a
mov eax, dword [ebp - 4]
mov byte [eax + 0x430], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x3c2], 0
jne 0x49605f
call fcn.004036bc
jmp 0x4964c5
mov byte [ebp - 0x22], 0
push 0xf
lea ecx, [ebp - 0x22]
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x3c4]
call dword [esi + 0x3c0]
cmp byte [ebp - 0x22], 0
jne 0x49608a
call fcn.004036bc
jmp 0x4964c5
mov eax, dword [ebp - 4]
test byte [eax + 0x2e9], 2
jne 0x4960a4
test bl, bl
jne 0x4960a4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00497dbc
mov eax, dword [ebp - 4]
cmp word [eax + 0x392], 0
je 0x4960c3
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x394]
call dword [ebx + 0x390]
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x32c], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x329], 0
jne 0x496100
mov eax, dword [ebp - 4]
cmp byte [eax + 0x32a], 0
jne 0x496100
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov edx, dword [ebp - 0xc]
call fcn.0048c130
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
xor ecx, ecx
xor edx, edx
call fcn.0048de54
mov eax, dword [ebp - 4]
cmp byte [eax + 0x329], 0
jne 0x496251
mov eax, dword [ebp - 4]
cmp byte [eax + 0x32a], 0
jne 0x496251
mov eax, dword [ebp - 4]
cmp word [eax + 0x2d8], 0xc7
jge 0x496251
mov edx, 0x1d4c0
mov eax, dword [ebp - 4]
call fcn.0048cd30
mov eax, dword [ebp - 4]
mov byte [eax + 0x328], 1
xor edx, edx
push ebp
push 0x49624a
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x334]
call fcn.00403c40
jmp 0x4961f9
push 0
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00496ac8
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x334]
call fcn.00403f34
je 0x4961f9
mov eax, dword [ebp - 0x1c]
mov edx, dword [0x54e6e4]
mov edx, dword [edx]
call fcn.00403f34
je 0x4961f9
lea eax, [ebp - 0x1c]
mov edx, dword [0x54e6e4]
mov edx, dword [edx]
call fcn.00403c40
mov eax, dword [ebp - 4]
cmp word [eax + 0x39a], 0
je 0x4961e2
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x39c]
call dword [ebx + 0x398]
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x32c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x32c], eax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x2d8]
cmp ax, 0xc7
jge 0x49622a
test ax, ax
je 0x49622a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x368], 0
je 0x49622a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x32a], 0
je 0x49617c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496287
mov eax, dword [ebp - 4]
call fcn.0048cd80
mov eax, dword [ebp - 4]
mov byte [eax + 0x328], 0
ret
mov eax, dword [ebp - 4]
cmp word [eax + 0x39a], 0
je 0x496270
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x39c]
call dword [ebx + 0x398]
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x32c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x32c], eax
mov byte [ebp - 0x21], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4964c5
cmp byte [ebp - 0x21], 0
jne 0x4962b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
xor ecx, ecx
xor edx, edx
call fcn.0048de54
cmp byte [ebp - 0x21], 0
jne 0x4963b5
mov edx, dword [ebp - 4]
cmp byte [edx + 0x329], 0
jne 0x4963b5
mov edx, dword [ebp - 4]
cmp byte [edx + 0x32a], 0
jne 0x4963b5
mov edx, dword [ebp - 4]
cmp word [edx + 0x2d8], 0xc7
jge 0x4963b5
mov edx, dword [ebp - 4]
cmp dword [edx + 0x308], 0
je 0x496316
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
test eax, eax
je 0x4963b5
cmp byte [eax + 0x329], 0
jne 0x4963b5
mov edx, 0x1d4c0
mov eax, dword [ebp - 4]
call fcn.0048cd30
mov eax, dword [ebp - 4]
mov byte [eax + 0x328], 1
xor eax, eax
push ebp
push 0x4963ae
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x49634f
push 0
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00496ac8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x329], 0
jne 0x49638e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x32a], 0
jne 0x49638e
mov eax, dword [ebp - 4]
cmp word [eax + 0x2d8], 0xc7
jge 0x49638e
mov eax, dword [ebp - 4]
cmp word [eax + 0x2d8], 0
je 0x49638e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x368], 0
jne 0x49633d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4963b5
mov eax, dword [ebp - 4]
call fcn.0048cd80
mov eax, dword [ebp - 4]
mov byte [eax + 0x328], 0
ret
mov eax, dword [ebp - 4]
cmp byte [eax + 0x430], 0
jne 0x49644d
mov eax, dword [ebp - 4]
mov bx, word [eax + 0x2d8]
cmp bx, 0x12c
jle 0x49642d
cmp bx, 0x258
jge 0x49642d
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
call fcn.004088d0
mov edx, dword [ebp - 0x28]
mov eax, 0x496534
call fcn.0040410c
test eax, eax
jg 0x496421
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
call fcn.004088d0
mov edx, dword [ebp - 0x28]
mov eax, 0x496548
call fcn.0040410c
test eax, eax
jle 0x49642d
mov eax, dword [ebp - 4]
mov byte [eax + 0x430], 1
jmp 0x49644d
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x2d8]
cmp ax, 0x12c
jle 0x49644d
cmp ax, 0x258
jge 0x49644d
mov eax, dword [ebp - 4]
mov byte [eax + 0x430], 2
cmp byte [ebp - 0x21], 0
jne 0x496472
mov eax, dword [ebp - 4]
cmp word [eax + 0x39a], 0
je 0x496472
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x39c]
call dword [ebx + 0x398]
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x308]
test esi, esi
je 0x496493
mov eax, esi
mov dl, 1
mov ecx, dword [eax]
call dword [ecx - 4]
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x308], edx
cmp byte [ebp - 0x21], 0
je 0x4964ba
mov eax, dword [ebp - 4]
cmp word [eax + 0x3ba], 0
je 0x4964ba
mov ebx, dword [ebp - 4]
mov cl, 0xf
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x3bc]
call dword [ebx + 0x3b8]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4964f4
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00403bcc
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00403bcc
ret