Function at 0x4b9218
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x230], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov edi, eax
mov ebx, 0x4d10a8
xor eax, eax
push ebp
push 0x4b984f
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4b9265
mov edx, 0x4b9868
mov eax, dword [0x4d1aa8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4b97f8
mov eax, dword [0x4d0134]
mov eax, dword [eax + 0xab0]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4b93bf
mov eax, dword [ebx]
cmp byte [eax + 0x178c], 0
je 0x4b92ae
mov eax, dword [ebx]
cmp dword [eax + 0x178d], 0
jne 0x4b93bf
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0x14], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0x18], eax
jmp 0x4b9324
mov eax, 0x3e8
call fcn.00499780
push 0
push 0x3e8
mov eax, dword [0x4d044c]
cdq
push edx
push eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
call fcn.00405564
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.00409010
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x4b9880
call fcn.00404918
mov edx, dword [ebp - 0x28]
mov eax, dword [0x4d0134]
mov eax, dword [eax + 0xab4]
call fcn.004594cc
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [0x4d044c]
cdq
cmp edx, dword [esp + 4]
jne 0x4b9342
cmp eax, dword [esp]
seta al
jmp 0x4b9345
setg al
add esp, 8
and al, byte [0x4d1174]
jne 0x4b92c0
push 0x4d0244
push 0x4d0344
lea eax, [ebp - 0x12c]
mov edx, dword [0x4d0448]
mov ecx, 0xff
call fcn.004048a8
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x22c]
mov edx, dword [0x4d0444]
mov ecx, 0xff
call fcn.004048a8
lea edx, [ebp - 0x22c]
mov eax, 0x4d0144
pop ecx
call fcn.004ca9a8
mov edi, dword [0x4d10b0]
mov eax, dword [0x4cdab4]
mov dword [eax + 0x1e], ebx
mov eax, 0x3e8
call fcn.00499780
jmp 0x4b97f8
push edi
mov eax, dword [ebx]
push eax
call fcn.0049983c
test al, al
je 0x4b973b
mov ecx, 0xd18
mov edx, edi
mov eax, dword [ebx]
call fcn.00499d20
test al, al
je 0x4b973b
mov eax, dword [ebx]
cmp byte [eax + 0x178c], 0
je 0x4b973b
mov eax, dword [ebx]
cmp dword [eax + 0x178d], 0
je 0x4b973b
mov eax, dword [0x4d0134]
mov eax, dword [eax + 0x57c]
mov edx, 0xff000005
call fcn.0045963c
mov eax, dword [0x4d0134]
mov eax, dword [eax + 0x694]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4b9441
mov edx, 0x4d1480
mov ecx, 1
mov eax, edi
call fcn.004c4eb0
mov eax, dword [0x4d0134]
mov eax, dword [eax + 0x590]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4b9469
mov edx, 0x4d1188
mov ecx, 1
mov eax, edi
call fcn.004c4718
mov eax, dword [0x4d116c]
call fcn.00405804
test eax, eax
jle 0x4b9727
mov eax, dword [0x4d116c]
call fcn.0040580c
test eax, eax
jl 0x4b97ee
inc eax
mov dword [ebp - 0x1c], eax
xor esi, esi
cmp byte [0x4d1174], 0
je 0x4b97ee
push edi
mov eax, dword [ebx]
push eax
call fcn.0049983c
mov ecx, 0xd18
mov edx, edi
mov eax, dword [ebx]
call fcn.00499d20
imul eax, esi, 0x4d
mov edx, dword [0x4d116c]
imul eax, dword [edx + eax + 0x14], 0x4d
mov edx, dword [ebx]
mov edx, dword [edx + 0x1908]
cmp dword [edx + eax + 0xc], 0
jne 0x4b94f0
imul eax, esi, 0x4d
mov edx, dword [0x4d116c]
imul eax, dword [edx + eax + 0x14], 0x4d
mov edx, dword [ebx]
mov edx, dword [edx + 0x1908]
cmp dword [edx + eax], 0
je 0x4b94ff
mov eax, dword [ebx]
cmp dword [eax + 0x618], 2
je 0x4b95c0
imul eax, esi, 0x4d
mov edx, dword [0x4d116c]
imul eax, dword [edx + eax + 0x14], 0x4d
mov edx, dword [ebx]
mov edx, dword [edx + 0x1908]
cmp dword [edx + eax + 0xc], 0
jne 0x4b957c
push 0x4b989c
imul eax, esi, 0x4d
mov edx, dword [0x4d116c]
push dword [edx + eax + 4]
push 0x4b98a8
push 0x4b98c4
call fcn.0040ab08
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x234]
call fcn.0040b79c
push dword [ebp - 0x234]
push 0x4b98d0
lea eax, [ebp - 0x230]
mov edx, 6
call fcn.0040498c
mov edx, dword [ebp - 0x230]
mov eax, dword [0x4d1aa8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4b9596
mov eax, dword [ebx]
cmp dword [eax + 0x618], 2
je 0x4b9596
mov edx, 0x4b98dc
mov eax, dword [0x4d1aa8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d1168
push 0x4d1170
mov ecx, 0x4d116c
mov edx, 0x4d1164
mov eax, edi
call fcn.004b8104
mov eax, 0x1f4
call fcn.00499780
jmp 0x4b97ee
imul eax, esi, 0x4d
mov edx, dword [0x4d116c]
imul eax, dword [edx + eax + 0x14], 0x4d
mov edx, dword [ebx]
mov edx, dword [edx + 0x1908]
mov eax, dword [edx + eax + 0xc]
imul edx, esi, 0x4d
mov ecx, dword [0x4d116c]
cmp eax, dword [ecx + edx + 0x34]
ja 0x4b9718
mov byte [ebp - 9], 0
mov eax, dword [ebx]
mov eax, dword [eax + 0x1908]
call fcn.0040580c
test eax, eax
jl 0x4b96bb
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
imul eax, dword [ebp - 4], 0x4d
mov edx, dword [ebx]
mov edx, dword [edx + 0x1908]
mov eax, dword [edx + eax]
imul edx, esi, 0x4d
mov ecx, dword [0x4d116c]
cmp eax, dword [ecx + edx]
jne 0x4b96a9
imul eax, dword [ebp - 4], 0x4d
mov edx, dword [ebx]
mov edx, dword [edx + 0x1908]
mov eax, dword [edx + eax + 0xc]
imul edx, esi, 0x4d
mov ecx, dword [0x4d116c]
cmp eax, dword [ecx + edx + 0x34]
jbe 0x4b96a9
mov eax, dword [0x4d116c]
call fcn.0040580c
test eax, eax
jl 0x4b9694
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], 0
imul eax, dword [ebp - 8], 0x4d
mov edx, dword [0x4d116c]
mov eax, dword [edx + eax + 0x14]
imul edx, dword [ebp - 4], 0x4d
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x1908]
cmp eax, dword [ecx + edx + 0x14]
jne 0x4b968c
mov byte [ebp - 9], 0
jmp 0x4b9694
inc dword [ebp - 8]
dec dword [ebp - 0x24]
jne 0x4b9666
mov eax, dword [0x4d116c]
call fcn.0040580c
cmp eax, dword [ebp - 8]
jge 0x4b96a9
mov byte [ebp - 9], 1
jmp 0x4b96bb
cmp byte [ebp - 9], 0
jne 0x4b96bb
inc dword [ebp - 4]
dec dword [ebp - 0x20]
jne 0x4b9611
cmp byte [ebp - 9], 0
je 0x4b9718
imul eax, esi, 0x4d
mov edx, dword [0x4d116c]
mov edx, dword [edx + eax + 4]
lea eax, [ebp - 0x238]
mov ecx, 0x4b98fc
call fcn.00404918
mov edx, dword [ebp - 0x238]
mov eax, dword [0x4d1aa8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d1168
push 0x4d1170
mov ecx, 0x4d116c
mov edx, 0x4d1164
mov eax, edi
call fcn.004b8104
mov eax, 0x1f4
call fcn.00499780
jmp 0x4b97ee
inc esi
dec dword [ebp - 0x1c]
jne 0x4b9493
jmp 0x4b97ee
mov edx, 0x4b9920
mov eax, dword [0x4d1aa8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4b97ee
push edi
mov eax, dword [ebx]
push eax
call fcn.0049983c
test al, al
je 0x4b9796
mov ecx, 0xd18
mov edx, edi
mov eax, dword [ebx]
call fcn.00499d20
test al, al
je 0x4b9796
mov eax, dword [ebx]
cmp byte [eax + 0x178c], 0
je 0x4b9770
mov eax, dword [ebx]
cmp dword [eax + 0x178d], 0
jne 0x4b97a5
mov edx, 0x4b993c
mov eax, dword [0x4d1aa8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4d0134]
mov eax, dword [eax + 0x57c]
mov edx, 0xff
call fcn.0045963c
jmp 0x4b97a5
mov edx, 0x4b995c
mov eax, dword [0x4d1aa8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4d0134]
mov eax, dword [eax + 0x568]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4b97ee
mov eax, dword [ebx]
cmp byte [eax + 0x178c], 0
je 0x4b97d2
mov eax, dword [ebx]
cmp dword [eax + 0x178d], 0
jne 0x4b97ee
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x497ddc
push 0
push 0
call sub.kernel32.dll_CreateThread_1
push eax
call sub.kernel32.dll_CloseHandle
mov eax, 0x3e8
call fcn.00499780
cmp byte [0x4d1174], 0
jne 0x4b9279
mov edx, 0x4b9978
mov eax, dword [0x4d1aa8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4b9824
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9856
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.00404614
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00404614
ret