Function at 0x480790
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
mov eax, dword [esp + 0x6c]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x70]
mov esi, ecx
push eax
push edi
mov dword [esp + 0x18], esi
call dword [sym.imp.Staff2.dll_char___cdecl_STAFFGetDirection_struct_PIS___struct_PIS__]
add esp, 8
cmp al, 5
jne 0x4807b6
mov al, 2
mov ebp, dword [esp + 0x74]
mov ebx, dword [esp + 0x6c]
push ebp
push edi
push ebx
lea ecx, [esi + 0x40]
mov byte [ebx + 0x18], al
call fcn.0040a390
mov edi, dword [esp + 0x80]
mov edx, dword [ebp]
push edx
lea ecx, [edi + 0x37d8]
add edi, 0x42d0
mov dword [esp + 0x18], ecx
lea ecx, [esi + 0xbc]
mov dword [esp + 0x28], edi
call fcn.00476040
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x74], 0
mov ecx, dword [eax + 0x79c]
mov eax, dword [esp + 0x88]
test eax, eax
mov dword [esp + 0x18], ecx
je 0x481280
cmp word [eax + 0x28], 0
mov eax, dword [esp + 0x84]
jle 0x4809fb
cmp ax, 0x12
je 0x48085f
cmp ax, 0xcf
je 0x48085f
mov ecx, dword [edi + 0x94]
movsx edx, ax
mov eax, dword [esp + 0x78]
push edx
mov edx, dword [ebp + 0x2ac]
push eax
push ebx
push ecx
push edx
jmp 0x480877
mov ecx, dword [esp + 0x78]
mov edx, dword [edi + 0x98]
movsx eax, ax
push eax
mov eax, dword [ebp + 0x2b0]
push ecx
push ebx
push edx
push eax
mov ecx, dword [esi + 0x3c]
call fcn.0045fab0
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x1c], eax
mov dx, word [ecx + 0x1c]
and edx, 0x100
cmp edx, 0x100
jne 0x4809fb
test eax, eax
jne 0x480950
mov eax, 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x120]
mov dword [esp + 0x18], eax
mov esi, ebx
mov ecx, 0xb
lea edi, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x1c], 1
movsw word es:[edi], word [esi]
jne 0x481303
mov eax, dword [esp + 0x88]
mov al, byte [eax + 0x30]
movsx ecx, al
lea esi, [ecx - 2]
cmp esi, 0x42
ja case.0x4808f7.10
xor ecx, ecx
mov cl, byte [esi + 0x481374]
jmp dword [ecx*4 + 0x481350]
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x480a7e
mov edx, dword [esp + 0x10]
cmp dword [edx + 0xb8], 1
je 0x480a04
mov ecx, edx
call fcn.00476da0
cmp eax, 1
je 0x480a04
mov ecx, dword [esp + 0x10]
call fcn.00476de0
cmp eax, 1
je 0x480a04
mov eax, 0x88888889
mul dword [ebp + 0x2ac]
shr edx, 4
jmp 0x480a09
mov ecx, dword [edi + 0x94]
mov edx, dword [edi + 0x44]
add ecx, edx
cmp ecx, 0x1b58
mov eax, ecx
jb 0x48096a
mov eax, 0x1b58
lea edx, [eax + eax*2]
mov eax, 0x5d9f7391
mul edx
shr edx, 7
add edx, 0x14
cmp edx, 0x50
jbe 0x480986
mov esi, 0x50
jmp 0x4809d2
cmp ecx, 0x1b58
mov eax, ecx
jb 0x480995
mov eax, 0x1b58
lea edx, [eax + eax*2]
mov eax, 0x5d9f7391
mul edx
shr edx, 7
add edx, 0x14
cmp edx, 0x14
jae 0x4809b1
mov esi, 0x14
jmp 0x4809d2
cmp ecx, 0x1b58
mov eax, ecx
jb 0x4809c0
mov eax, 0x1b58
lea ecx, [eax + eax*2]
mov eax, 0x5d9f7391
mul ecx
mov esi, edx
shr esi, 7
add esi, 0x14
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x64
idiv ecx
cmp edx, esi
jae 0x4809fb
mov edx, dword [ebp + 0x120]
mov dword [esp + 0x74], 1
mov dword [esp + 0x18], edx
jmp 0x4808bc
mov esi, dword [esp + 0x78]
jmp 0x4808be
mov edx, 5
mov ecx, dword [esp + 0x80]
push 0
push 0
push 0
push edx
push 5
call fcn.0042b2d0
cmp eax, 1
jne 0x480d7c
mov eax, dword [esp + 0x78]
or byte [eax + 0x1a], 0x20
mov eax, dword [esp + 0x28]
test eax, eax
je 0x480d7c
cmp word [esp + 0x84], 0xcb
jne 0x480d7c
mov ecx, dword [ebp + 0x2d4]
test ecx, ecx
jne 0x480d7c
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x70]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push ebp
push edx
push ebx
mov dword [ebp + 0x2d4], 1
call fcn.0047a560
jmp 0x480d7c
mov eax, 0x88888889
mov ecx, dword [esp + 0x10]
mul dword [ebp + 0x2ac]
mov eax, dword [esp + 0x70]
push 0
shr edx, 4
push 0
push edx
push ebp
push eax
push ebx
push 5
call fcn.00479630
jmp 0x4811af
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x480b1e
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 0xb8], 1
je 0x480ae5
call fcn.00476da0
cmp eax, 1
je 0x480ae5
mov ecx, dword [esp + 0x10]
call fcn.00476de0
cmp eax, 1
je 0x480ae5
mov eax, 0x1b4e81b5
mul dword [ebp + 0x2ac]
shr edx, 4
jmp 0x480aea
mov edx, 5
mov ecx, dword [esp + 0x80]
push 0
push 0
push 0
push edx
push 0xd
call fcn.0042b2d0
mov esi, dword [esp + 0x78]
cmp eax, 1
jne 0x480b0c
or byte [esi + 0x1b], 0x20
mov ecx, 0xb
lea edi, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4811ca
mov eax, 0x1b4e81b5
mov ecx, dword [esp + 0x10]
mul dword [ebp + 0x2ac]
push 0
push 0
shr edx, 4
push edx
mov edx, dword [esp + 0x7c]
push ebp
push edx
push ebx
push 0xd
call fcn.00479630
jmp 0x4811af
xor ecx, ecx
cmp al, 0x12
jne 0x480b56
mov ecx, dword [ebp + 0x2c4]
jmp 0x480b94
cmp al, 0x13
jne 0x480b94
mov ecx, dword [ebp + 0x2ac]
mov eax, 0x88888889
mul ecx
shr edx, 3
imul edx, ecx
mov eax, 0xcccccccd
mul edx
mov esi, edx
mov eax, 0xcccccccd
shr esi, 3
add esi, 0x32
mul esi
mov eax, 0xcccccccd
mov ecx, edx
mul esi
shr ecx, 5
shr edx, 2
add ecx, edx
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x480d92
mov eax, dword [esp + 0x88]
mov esi, dword [esp + 0x80]
push 2
push ebx
mov edx, dword [eax + 0x34]
mov eax, 0x51eb851f
imul edx, ecx
mul edx
shr edx, 5
push edx
mov ecx, esi
call fcn.004101f0
mov edi, dword [esp + 0x14]
mov cl, byte [edi + 0x84c]
and cl, 0x40
cmp cl, 0x40
jne 0x480c04
mov edx, eax
mov ecx, esi
shr edx, 2
lea eax, [edx + eax*2]
push eax
call fcn.004396e0
mov eax, dword [edi + 0x7a0]
test eax, eax
jne 0x480c11
push 1
push 1
push 6
mov ecx, esi
call fcn.0042cb70
jmp 0x480c11
push 0
inc ebx
push ebp
push ebx
push eax
mov ecx, esi
call fcn.004393c0
mov ecx, dword [esp + 0x88]
cmp byte [ecx + 0x30], 0x43
jne 0x4811ca
mov esi, 3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
movsx ebx, al
and ebx, 0x80000007
jns 0x480c3d
dec ebx
or ebx, 0xfffffff8
inc ebx
mov ecx, dword [esp + 0x80]
mov byte [esp + 0x20], bl
mov edi, dword [esp + 0x20]
push edi
push esi
call fcn.00431880
test eax, eax
je 0x480d0f
cmp byte [eax], 0
je 0x480c6b
mov ecx, dword [eax + 4]
test ecx, ecx
ja 0x480d0f
xor eax, eax
mov dword [esp + 0x2c], edi
test bl, bl
mov byte [esp + 0x2c], bl
jl 0x480cc1
test eax, eax
jne 0x480cc1
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x80]
push edi
push esi
call fcn.00431880
test eax, eax
je 0x480cb1
mov cl, byte [eax]
test cl, cl
je 0x480caf
cmp cl, 6
je 0x480caf
mov ecx, dword [eax + 4]
test ecx, ecx
jbe 0x480caf
mov dword [esp + 0x20], edi
mov bl, byte [esp + 0x20]
jmp 0x480cb5
xor eax, eax
mov edi, dword [esp + 0x20]
mov cl, byte [esp + 0x2c]
dec cl
mov byte [esp + 0x2c], cl
jns 0x480c79
mov dword [esp + 0x2c], edi
cmp bl, 8
mov byte [esp + 0x2c], bl
jge 0x480d0f
test eax, eax
jne 0x480d0f
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x80]
push ebp
push esi
call fcn.00431880
test eax, eax
je 0x480d00
mov cl, byte [eax]
test cl, cl
je 0x480cfe
cmp cl, 6
je 0x480cfe
mov ecx, dword [eax + 4]
test ecx, ecx
jbe 0x480cfe
mov edi, ebp
jmp 0x480d00
xor eax, eax
mov cl, byte [esp + 0x2c]
inc cl
cmp cl, 8
mov byte [esp + 0x2c], cl
jl 0x480cce
mov ecx, dword [esp + 0x80]
push edi
push esi
call fcn.00431880
test eax, eax
je 0x4811ca
mov ebx, eax
mov edx, dword [ebx]
test dl, dl
mov ecx, dword [ebx + 4]
mov ebp, dword [ebx + 8]
mov dword [esp + 0x30], ebp
mov ebx, dword [ebx + 0xc]
mov dword [esp + 0x34], ebx
je 0x4811ca
test ecx, ecx
jbe 0x4811ca
cmp byte [eax], 6
je 0x4811ca
mov edx, ecx
and edx, 0xfffffffe
cmp edx, 2
jae 0x480d64
mov ecx, 1
jmp 0x480d66
shr ecx, 1
mov eax, dword [esp + 0x70]
push 1
push eax
push ecx
mov ecx, dword [esp + 0x8c]
push edi
push esi
call fcn.00433760
mov esi, dword [esp + 0x78]
mov ecx, 0xb
lea edi, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4811ca
mov edx, dword [esp + 0x88]
mov eax, dword [esp + 0x70]
push edx
mov edx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x88]
push ebp
push eax
mov eax, dword [esp + 0x24]
push ebx
push ecx
mov ecx, dword [esp + 0x28]
push edx
push eax
mov ecx, dword [ecx + 0x3c]
call fcn.0045f890
jmp case.0x4808f7.10
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x480e3d
mov edx, dword [esp + 0x10]
cmp dword [edx + 0xb8], 1
je 0x480e04
mov ecx, edx
call fcn.00476da0
cmp eax, 1
je 0x480e04
mov ecx, dword [esp + 0x10]
call fcn.00476de0
cmp eax, 1
je 0x480e04
mov eax, 0x88888889
mul dword [ebp + 0x2ac]
shr edx, 4
jmp 0x480e09
mov edx, 5
mov ecx, dword [esp + 0x80]
push 0
push 0
push 0
push edx
push 0xe
call fcn.0042b2d0
mov esi, dword [esp + 0x78]
cmp eax, 1
jne 0x480e2b
or byte [esi + 0x1b], 0x40
mov ecx, 0xb
lea edi, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4811ca
mov eax, 0x88888889
mov ecx, dword [esp + 0x10]
mul dword [ebp + 0x2ac]
mov eax, dword [esp + 0x70]
push 0
shr edx, 4
push 0
push edx
push ebp
push eax
push ebx
push 0xe
call fcn.00479630
or byte [ebx + 0x1b], 0x40
jmp 0x4811af
mov esi, 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
movsx eax, al
cdq
mov ecx, 0xe
idiv ecx
mov ecx, dword [esp + 0x80]
mov bl, dl
mov byte [esp + 0x20], bl
mov edi, dword [esp + 0x20]
push edi
push esi
call fcn.00431880
test eax, eax
je 0x480f49
cmp byte [eax], 0
je 0x480eb1
mov ecx, dword [eax + 4]
test ecx, ecx
ja 0x480f49
xor eax, eax
mov dword [esp + 0x2c], edi
test bl, bl
mov byte [esp + 0x2c], bl
jl 0x480f01
test eax, eax
jne 0x480f01
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x80]
push edx
push esi
call fcn.00431880
test eax, eax
je 0x480ef5
cmp byte [eax], 0
je 0x480ef3
mov ecx, dword [eax + 4]
test ecx, ecx
jbe 0x480ef3
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x20], edi
mov bl, byte [esp + 0x20]
jmp 0x480ef5
xor eax, eax
mov cl, byte [esp + 0x2c]
dec cl
mov byte [esp + 0x2c], cl
jns 0x480ebf
mov dword [esp + 0x2c], edi
cmp bl, 0xe
mov byte [esp + 0x2c], bl
jge 0x480f49
test eax, eax
jne 0x480f49
mov ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x80]
push ebx
push esi
call fcn.00431880
test eax, eax
je 0x480f3a
cmp byte [eax], 0
je 0x480f38
mov ecx, dword [eax + 4]
test ecx, ecx
jbe 0x480f38
mov edi, ebx
jmp 0x480f3a
xor eax, eax
mov cl, byte [esp + 0x2c]
inc cl
cmp cl, 0xe
mov byte [esp + 0x2c], cl
jl 0x480f0e
mov ebx, dword [esp + 0x80]
push edi
push esi
mov ecx, ebx
call fcn.00431880
test eax, eax
je 0x4811ca
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov ebp, dword [eax + 8]
mov eax, dword [eax + 0xc]
test dl, dl
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], eax
je 0x4811ca
xor ebp, ebp
cmp ecx, ebp
jbe 0x4811ca
mov edx, dword [esp + 0x70]
push 1
push edx
push ecx
push edi
push esi
mov ecx, ebx
call fcn.00433760
mov eax, dword [esp + 0x14]
mov cl, byte [eax + 0x6e0]
test cl, cl
je 0x480fb7
movzx cx, byte [eax + 0x6e2]
mov esi, dword [esp + 0x78]
mov word [esi + 0x14], cx
jmp 0x480fbf
mov esi, dword [esp + 0x78]
mov word [esi + 0x14], bp
mov cl, byte [eax + 0x6c0]
test cl, cl
je 0x480fe7
movzx dx, byte [eax + 0x6c2]
mov ecx, 0xb
lea edi, [esp + 0x38]
mov word [esi + 0x16], dx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4811ca
mov ecx, 0xb
lea edi, [esp + 0x38]
mov word [esi + 0x16], bp
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4811ca
cmp word [ebx + 0x12], 0x4a
jne 0x481020
mov ax, word [ebx + 0x1c]
and eax, 0x400
test ax, ax
jne 0x481045
mov ecx, dword [esp + 0x70]
push 0
push 0
push 0xa
push ebp
push ecx
jmp 0x481039
mov eax, 0x88888889
push 0
mul dword [ebp + 0x2ac]
shr edx, 4
push 0
push edx
mov edx, dword [esp + 0x7c]
push ebp
push edx
mov ecx, dword [esp + 0x24]
push ebx
push 0x1a
call fcn.00479630
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, 5
call edi
and eax, 0xff
and eax, 0x80000007
jns 0x481063
dec eax
or eax, 0xfffffff8
inc eax
test al, al
mov byte [esp + 0x80], al
jne 0x481078
mov byte [esp + 0x80], 8
jmp 0x481084
cmp al, 5
jne 0x481084
mov byte [esp + 0x80], 9
mov eax, dword [ebp + 0x108]
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x70]
push eax
push ebp
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push ebx
call fcn.0047d880
dec esi
jne 0x481050
jmp 0x4811ca
mov eax, dword [esp + 0x10]
cmp dword [eax + 0xb8], 1
je 0x4810e2
mov ecx, eax
call fcn.00476da0
cmp eax, 1
je 0x4810e2
mov ecx, dword [esp + 0x10]
call fcn.00476de0
cmp eax, 1
je 0x4810e2
mov eax, 0x88888889
mul dword [ebp + 0x2ac]
shr edx, 4
jmp 0x4810e7
mov edx, 5
mov ecx, dword [esp + 0x80]
push 0
push 0
push 0
push edx
push 0x1b
call fcn.0042b2d0
mov esi, dword [esp + 0x78]
cmp eax, 1
jne 0x481109
or byte [esi + 0x1d], 8
mov ecx, 0xb
lea edi, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4811ca
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x48118a
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 0xb8], 1
je 0x481154
call fcn.00476da0
cmp eax, 1
je 0x481154
mov ecx, dword [esp + 0x10]
call fcn.00476de0
cmp eax, 1
je 0x481154
mov edx, dword [esp + 0x88]
mov eax, dword [edx + 0x38]
jmp 0x481159
mov eax, 5
mov ecx, dword [esp + 0x80]
push 0
push 0
push 0
push eax
push 0x3a
call fcn.0042b2d0
mov esi, dword [esp + 0x78]
cmp eax, 1
jne 0x48117b
or byte [esi + 0x21], 4
mov ecx, 0xb
lea edi, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4811ca
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x70]
push 0
push 0
mov ecx, dword [eax + 0x38]
push ecx
mov ecx, dword [esp + 0x1c]
push ebp
push edx
push ebx
push 0x3a
call fcn.00479630
or byte [ebx + 0x21], 4
mov ecx, 0xb
mov esi, ebx
lea edi, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x48128a
mov ebx, dword [esp + 0x14]
mov ecx, dword [ebx + 0x79c]
test ecx, ecx
jne 0x4811fb
mov esi, dword [esp + 0x78]
xor eax, eax
lea edi, [esp + 0x38]
mov byte [esp + 0x66], 0xff
lea ecx, [esi + 0x1a]
mov dword [esi + 0x1a], eax
mov dword [ecx + 4], eax
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x481246
mov edx, dword [esp + 0x24]
mov esi, dword [edx + 8]
cmp ecx, esi
jae 0x481241
cmp ecx, 0x1312d00
jbe 0x48122a
mov eax, 0x51eb851f
mul esi
mov esi, edx
mov eax, ecx
shr esi, 5
xor edx, edx
div esi
cmp al, 0x64
jae 0x481241
mov byte [esp + 0x66], al
jmp 0x481246
lea ecx, [ecx + ecx*4]
xor edx, edx
lea eax, [ecx + ecx*4]
shl eax, 2
div esi
cmp al, 0x64
jae 0x481241
mov byte [esp + 0x66], al
jmp 0x481246
mov byte [esp + 0x66], 0x64
mov eax, dword [esp + 0x18]
test eax, eax
je 0x48125b
cmp eax, dword [ebx + 0x79c]
jne 0x48125b
mov byte [esp + 0x66], 0xfe
mov ebx, dword [esp + 0x6c]
mov edx, dword [esp + 0x84]
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0x38]
push 0x2f
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
mov ecx, dword [ecx + 0x3c]
push ebx
call fcn.0045f9b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0x20
mov ecx, dword [ebp + 0x120]
test ecx, ecx
jne 0x48129b
mov byte [esp + 0x66], 0xff
jmp 0x4812e5
mov ebp, dword [ebp + 0x2bc]
cmp ecx, ebp
jae 0x4812e0
cmp ecx, 0x1312d00
jbe 0x4812c9
mov eax, 0x51eb851f
mul ebp
mov esi, edx
mov eax, ecx
shr esi, 5
xor edx, edx
div esi
cmp al, 0x64
jae 0x4812e0
mov byte [esp + 0x66], al
jmp 0x4812e5
lea eax, [ecx + ecx*4]
xor edx, edx
lea eax, [eax + eax*4]
shl eax, 2
div ebp
cmp al, 0x64
jae 0x4812e0
mov byte [esp + 0x66], al
jmp 0x4812e5
mov byte [esp + 0x66], 0x64
mov eax, dword [esp + 0x18]
test eax, eax
je 0x48125f
cmp eax, ecx
jne 0x48125f
mov byte [esp + 0x66], 0xfe
jmp 0x48125f
mov eax, dword [esp + 0x14]
mov byte [esp + 0x66], 0xfe
mov cx, word [eax + 0x850]
and ecx, 0x2000
test cx, cx
je 0x48125f
mov edx, dword [esp + 0x14]
mov eax, 0xcccccccd
mov ecx, dword [esp + 0x10]
push 0
mul dword [edx + 0x788]
mov eax, dword [esp + 0x74]
push 0
shr edx, 4
push edx
push ebp
push eax
push ebx
push 0x37
call fcn.00479630
jmp 0x48125f