Function at 0x1006eaa0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc0
push ebx
push ebp
push esi
push edi
mov ebp, ecx
movzx eax, byte [0x101cc030]
add eax, dword [ebp + 0x3b4]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
mov dword [esp + 0x4c], eax
mov al, byte [esp + 0x68]
or al, 1
and al, 0xf1
or al, 0x10
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
mov byte [esp + 0x68], al
mov byte [esp + 0x69], 0
mov dword [esp + 0x6a], esi
mov word [esp + 0x6e], si
mov dword [esp + 0x70], esi
mov word [esp + 0x74], si
mov dword [esp + 0x76], esi
mov word [esp + 0x7a], si
mov dword [esp + 0x7c], esi
mov word [esp + 0x80], si
mov byte [esp + 0x82], 0
mov word [esp + 0x83], si
mov dword [esp + 0x85], esi
mov byte [esp + 0x15], 0
mov dword [esp + 0x30], esi
mov dword [esp + 0x1c], 5
mov dword [esp + 0x40], esi
mov byte [esp + 0x17], 0
mov edi, 0x4e20
call ebx
sub eax, dword [ebp + 0x1fc]
cmp eax, 0xea60
jge 0x1006eb59
mov edi, 0xbb8
jmp 0x1006eb65
cmp eax, 0x2bf20
jge 0x1006eb65
mov edi, 0x2710
call ebx
movzx ecx, byte [0x101cc031]
sub eax, dword [ebp + 0x1144]
imul ecx, edi
cmp eax, ecx
jbe 0x1006eb80
mov byte [esp + 0x17], 1
cmp dword [ebp + 0x1138], 0x32
ja 0x1006f204
mov dword [esp + 0x3c], esi
mov eax, dword [ebp + 0x44]
test eax, eax
mov byte [esp + 0x16], 0
jbe 0x1006ec9b
mov ecx, dword [esp + 0x3c]
cmp ecx, 3
jae 0x1006ec9b
cmp eax, ecx
jbe 0x1006ec9b
cmp dword [ebp + 0x48], 0
lea ebx, [ebp + 0x48]
jne 0x1006ebd5
mov edx, dword [ebp + 0x40]
mov esi, dword [edx]
cmp esi, edx
jne 0x1006ebcd
call fcn.1015988d
add esi, 0xc
jmp 0x1006ec71
push ebx
lea eax, [esp + 0x54]
lea esi, [ebp + 0x3c]
push eax
mov ecx, esi
call fcn.10062320
mov eax, dword [esp + 0x50]
test eax, eax
mov edi, dword [esi + 4]
je 0x1006ebf4
cmp eax, esi
je 0x1006ebf9
call fcn.1015988d
cmp dword [esp + 0x54], edi
jne 0x1006ec1b
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
mov dword [esp + 0x98], edx
mov dword [esp + 0x94], esi
lea ecx, [esp + 0x94]
jmp 0x1006ec6a
lea ecx, [esp + 0x50]
call fcn.100610c0
mov eax, dword [esi + 4]
lea ecx, [esp + 0x8c]
push ecx
lea ecx, [esp + 0x54]
mov dword [esp + 0x94], eax
mov dword [esp + 0x90], esi
call fcn.100018e0
test al, al
je 0x1006ec66
mov edx, dword [esi + 4]
mov eax, dword [edx]
mov dword [esp + 0xa0], eax
mov dword [esp + 0x9c], esi
lea ecx, [esp + 0x9c]
jmp 0x1006ec6a
lea ecx, [esp + 0x50]
call fcn.10061ca0
mov esi, eax
mov ecx, 9
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
add dword [esp + 0x3c], 1
movsb byte es:[edi], byte [esi]
mov ecx, 9
mov esi, ebx
lea edi, [esp + 0xa4]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov byte [esp + 0x16], 1
jmp 0x1006ed63
mov eax, dword [ebp + 0x30]
test eax, eax
je 0x1006f1c8
mov ecx, dword [ebp + 0x34]
sub ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
je 0x1006f1c8
mov eax, dword [ebp + 0x30]
test eax, eax
je 0x1006ece1
mov ecx, dword [ebp + 0x34]
sub ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x1006ece6
call fcn.1015988d
mov eax, dword [ebp + 0x30]
test eax, eax
mov esi, dword [ebp + 0x30]
mov ecx, 0xb
lea edi, [esp + 0x60]
rep movsd dword es:[edi], dword [esi]
je 0x1006ed13
mov ecx, dword [ebp + 0x34]
sub ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x1006ed18
call fcn.1015988d
mov esi, dword [ebp + 0x30]
add esi, 4
mov ecx, 9
lea edi, [esp + 0xa4]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x30]
cmp esi, dword [ebp + 0x34]
jbe 0x1006ed3a
call fcn.1015988d
mov byte [esp + 0x18], 0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [ebp + 0x34]
push eax
push ecx
push esi
push edx
add esi, 0x2c
push esi
call fcn.100449a0
add esp, 0x18
add dword [ebp + 0x34], 0xffffffd4
xor eax, eax
cmp dword [ebp + 0x10], eax
jbe 0x1006ed6f
mov byte [esp + 0x15], 1
lea ebx, [ebp + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 4]
mov esi, dword [eax]
mov edi, ebx
mov ecx, eax
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x48], ecx
nop
test edi, edi
je 0x1006ed98
cmp edi, ebx
je 0x1006ed9d
call fcn.1015988d
cmp esi, dword [esp + 0x48]
je 0x1006ee18
test edi, edi
jne 0x1006edac
call fcn.1015988d
cmp esi, dword [edi + 4]
jne 0x1006edb6
call fcn.1015988d
mov edx, dword [esp + 0xa4]
cmp edx, dword [esi + 0x34]
je 0x1006eb91
cmp esi, dword [edi + 4]
jne 0x1006edd0
call fcn.1015988d
mov ecx, dword [esi + 0x74]
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
call edx
test eax, eax
jne 0x1006ee02
add dword [esp + 0x20], 1
cmp esi, dword [edi + 4]
jne 0x1006eded
call fcn.1015988d
mov esi, dword [esi + 0x74]
mov eax, dword [esi]
mov edx, dword [eax + 0x70]
mov ecx, esi
call edx
test al, al
je 0x1006ee02
add dword [esp + 0x24], 1
lea ecx, [esp + 0x58]
call fcn.10060ae0
mov esi, dword [esp + 0x5c]
mov edi, dword [esp + 0x58]
jmp 0x1006ed90
cmp byte [esp + 0x16], 0
jne 0x1006ef4d
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x24]
lea edx, [eax + 2]
cmp ecx, edx
jae 0x1006ef9b
cmp ecx, eax
jb 0x1006ef25
mov ecx, ebp
call fcn.10061ba0
movzx eax, byte [0x101cc030]
cmp dword [esp + 0x40], eax
jae 0x1006f187
cmp byte [esp + 0x17], 0
je 0x1006f187
mov ecx, ebp
call fcn.10061ba0
test al, al
jne 0x1006f187
mov ecx, ebp
call fcn.10061960
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
push edx
mov ecx, ebx
mov dword [esp + 0x2c], eax
call fcn.100622b0
mov eax, dword [ebx + 4]
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], ebx
call fcn.1002e660
test al, al
je 0x1006f187
lea ecx, [esp + 0x28]
call fcn.10061ca0
add eax, 0x60
mov eax, dword [eax + 8]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x18]
call eax
test eax, eax
jne 0x1006f187
lea ecx, [esp + 0x28]
call fcn.10061ca0
add eax, 0x60
mov eax, dword [eax + 8]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x98]
call eax
movzx ecx, byte [0x101cc032]
shl ecx, 0xa
cmp eax, ecx
jae 0x1006f187
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add dword [esp + 0x40], 1
lea ecx, [esp + 0x28]
mov dword [ebp + 0x1144], eax
call fcn.10061ca0
add eax, 0x60
mov eax, dword [eax + 8]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x38]
call eax
jmp 0x1006ef31
sub eax, ecx
cmp dword [esp + 0x1c], eax
ja 0x1006ef31
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [ebp + 0x11b4]
add eax, eax
cmp eax, ecx
jb 0x1006ef43
mov eax, ecx
cmp dword [esp + 0x20], eax
jae 0x1006f1a5
push 0
sub esp, 0x28
mov edi, esp
mov ecx, 9
lea esi, [esp + 0xd0]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
movsb byte es:[edi], byte [esi]
call fcn.1006c210
test al, al
je 0x1006ef7f
cmp byte [esp + 0x16], 0
jne 0x1006ef7a
add dword [esp + 0x30], 1
mov byte [esp + 0x15], 1
mov ecx, dword [esp + 0x30]
cmp ecx, dword [esp + 0x1c]
jae 0x1006f1c8
cmp ecx, 0xa
jb 0x1006eb91
jmp 0x1006f1c8
mov ecx, ebp
call fcn.10061af0
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
push edx
lea eax, [esp + 0x38]
lea esi, [ebp + 8]
push eax
mov ecx, esi
call fcn.100622b0
mov ebx, dword [esp + 0x34]
test ebx, ebx
mov ecx, dword [esi + 4]
mov dword [esp + 0x48], ecx
je 0x1006efcd
cmp ebx, esi
je 0x1006efd2
call fcn.1015988d
mov edi, dword [esp + 0x38]
cmp edi, dword [esp + 0x48]
je 0x1006f0b7
test ebx, ebx
jne 0x1006efe9
call fcn.1015988d
cmp edi, dword [ebx + 4]
jne 0x1006eff3
call fcn.1015988d
mov ecx, dword [edi + 0x74]
mov edx, dword [ecx]
mov eax, dword [edx + 0x38]
call eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [ebp + 0x101c]
call fcn.100655a0
cmp edi, dword [ebx + 4]
jne 0x1006f017
call fcn.1015988d
cmp dword [edi + 0x55], 0
je 0x1006f03d
cmp edi, dword [ebx + 4]
jne 0x1006f027
call fcn.1015988d
cmp dword [edi + 0x55], 1
je 0x1006f03d
cmp edi, dword [ebx + 4]
jne 0x1006f037
call fcn.1015988d
cmp dword [edi + 0x55], 4
jne 0x1006f04d
lea edx, [esp + 0x1c]
push edx
lea ecx, [ebp + 0xf60]
call fcn.100655a0
cmp edi, dword [ebx + 4]
jne 0x1006f057
call fcn.1015988d
cmp dword [edi + 0x55], 1
je 0x1006f169
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp edi, dword [ebx + 4]
mov esi, eax
jne 0x1006f073
call fcn.1015988d
mov dword [esp + 0xa4], esi
lea esi, [edi + 0x34]
mov ecx, 9
lea edi, [esp + 0xa8]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x30]
cmp edi, dword [ebp + 0x34]
lea esi, [ebp + 0x2c]
jbe 0x1006f09c
call fcn.1015988d
lea eax, [esp + 0xa4]
push eax
push edi
push esi
lea ecx, [esp + 0x50]
push ecx
mov ecx, esi
call fcn.10065610
jmp 0x1006f169
mov ecx, ebp
call fcn.10061a40
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
push edx
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call fcn.100622b0
mov edi, dword [esp + 0x28]
test edi, edi
mov ebx, dword [esi + 4]
je 0x1006f0e2
cmp edi, esi
je 0x1006f0e7
call fcn.1015988d
cmp dword [esp + 0x2c], ebx
je 0x1006f114
test edi, edi
jne 0x1006f0f6
call fcn.1015988d
mov ecx, dword [esp + 0x2c]
cmp ecx, dword [edi + 4]
jne 0x1006f104
call fcn.1015988d
mov edx, dword [esp + 0x2c]
mov ecx, dword [edx + 0x74]
mov eax, dword [ecx]
mov edx, dword [eax + 0x38]
call edx
jmp 0x1006f169
mov ecx, ebp
call fcn.10061960
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
push ecx
mov ecx, esi
call fcn.100622b0
mov edi, dword [esp + 0x34]
test edi, edi
mov ebx, dword [esi + 4]
je 0x1006f13f
cmp edi, esi
je 0x1006f144
call fcn.1015988d
mov esi, dword [esp + 0x38]
cmp esi, ebx
je 0x1006f169
test edi, edi
jne 0x1006f155
call fcn.1015988d
cmp esi, dword [edi + 4]
jne 0x1006f15f
call fcn.1015988d
mov ecx, dword [esi + 0x74]
mov edx, dword [ecx]
mov eax, dword [edx + 0x38]
call eax
mov edi, dword [ebp + 0x30]
cmp edi, dword [ebp + 0x34]
lea esi, [ebp + 0x2c]
jbe 0x1006f179
call fcn.1015988d
lea ecx, [esp + 0x60]
push ecx
push edi
push esi
lea edx, [esp + 0x50]
push edx
jmp 0x1006f1c1
mov edi, dword [ebp + 0x30]
cmp edi, dword [ebp + 0x34]
lea esi, [ebp + 0x2c]
jbe 0x1006f197
call fcn.1015988d
lea eax, [esp + 0x60]
push eax
push edi
push esi
lea ecx, [esp + 0x50]
push ecx
jmp 0x1006f1c1
mov edi, dword [ebp + 0x30]
cmp edi, dword [ebp + 0x34]
lea esi, [ebp + 0x2c]
jbe 0x1006f1b5
call fcn.1015988d
lea edx, [esp + 0x60]
push edx
push edi
push esi
lea eax, [esp + 0x50]
push eax
mov ecx, esi
call fcn.10065610
cmp byte [esp + 0x15], 0
jne 0x1006f1eb
mov ecx, dword [ebp + 0x1f4]
push 1
push ecx
push 2
push 0
mov ecx, ebp
call fcn.100606e0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x3e8
push 0
push 0
mov ecx, ebp
mov byte [ebp + 0x1148], 0
call fcn.100606e0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret