Function at 0x67a0e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x67a715
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov byte [ebp - 0x15], 0
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
xor edx, edx
push ebp
push 0x67a6ca
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [esi + 0xd66], 1
je 0x67a175
cmp byte [esi + 0x378], 0
jne 0x67a175
cmp byte [esi + 0xec], 0
je 0x67a144
cmp byte [esi + 0xf4], 0
je 0x67a175
cmp byte [esi + 0xec], 0
je 0x67a153
cmp di, 0xb
jne 0x67a175
cmp byte [esi + 0x3854], 0
jne 0x67a175
mov eax, esi
call fcn.006a2f84
test al, al
jne 0x67a182
mov eax, dword [0x7070f8]
cmp byte [eax + 0x6686], 0
jne 0x67a182
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x67a6ff
mov dl, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [esi + 0x3b74]
sub eax, 4
jae 0x67a213
mov eax, dword [esi + 0x3b78]
movzx edx, di
cmp eax, edx
jne 0x67a213
mov eax, edi
sub ax, 0x11
je 0x67a1b8
sub ax, 2
je 0x67a1d7
dec ax
je 0x67a1f6
jmp 0x67a213
cmp byte [esi + 0x3b3c], 0
je 0x67a213
mov eax, dword [esi + 0x3b74]
cmp byte [esi + eax + 0x3b6d], 0x6e
jne 0x67a213
mov byte [ebp - 0x15], 1
jmp 0x67a213
cmp byte [esi + 0x3b44], 0
je 0x67a213
mov eax, dword [esi + 0x3b74]
cmp byte [esi + eax + 0x3b6d], 0x70
jne 0x67a213
mov byte [ebp - 0x15], 1
jmp 0x67a213
cmp byte [esi + 0x3b4c], 0
je 0x67a213
mov eax, dword [esi + 0x3b74]
cmp byte [esi + eax + 0x3b6d], 0x71
jne 0x67a213
mov byte [ebp - 0x15], 1
cmp byte [ebp - 0x15], 0
jne 0x67a223
mov dword [esi + 0x3b74], 0xffffffff
movzx eax, byte [ebp + 0xc]
xor al, 1
test al, al
je 0x67a2d5
cmp byte [ebp - 0x15], 0
jne 0x67a2d5
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
movsx edx, byte [esi + 0x2ee]
mov eax, dword [esi + 0x34]
call fcn.0048e014
mov edx, dword [0x7070f8]
mov edx, dword [edx + 0x65d8]
sub edx, eax
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
jge 0x67a26d
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0xe64]
cmp ebx, eax
jae 0x67a2a5
sub eax, ebx
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [0x7070f8]
mov eax, dword [eax + 0x65a4]
add dword [esi + 0xe84], eax
mov eax, dword [ebp - 0x14]
add dword [esi + 0xe64], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x67a6ff
cmp dword [esi + 0xe84], 0
jle 0x67a2b4
dec dword [esi + 0xe84]
mov edx, dword [0x7070f8]
mov edx, dword [edx + 0x65d0]
mov eax, esi
call fcn.00673f9c
call sub.kernel32.dll_GetTickCount_1
add eax, dword [ebp - 0x14]
mov dword [esi + 0xe64], eax
movzx eax, byte [ebp + 0xc]
xor al, 1
and al, byte [ebp - 0x15]
je 0x67a34b
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [esi + 0x3b7c]
cmp ebx, eax
jae 0x67a320
sub eax, ebx
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [0x7070f8]
mov eax, dword [eax + 0x65a4]
add dword [esi + 0xe84], eax
add dword [esi + 0x3b7c], 0x190
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x67a6ff
cmp dword [esi + 0xe84], 0
jle 0x67a32f
dec dword [esi + 0xe84]
mov edx, 0x190
mov eax, esi
call fcn.00673f9c
call sub.kernel32.dll_GetTickCount_1
add eax, 0x190
mov dword [esi + 0x3b7c], eax
mov byte [esi + 0xe7c], 0
mov eax, dword [esi + 0x24]
cmp eax, dword [ebp - 4]
jne 0x67a6c0
mov eax, dword [esi + 0x28]
cmp eax, dword [ebp + 0x14]
jne 0x67a6c0
mov byte [ebp - 5], 1
cmp di, 8
jne 0x67a436
cmp word [esi + 0x550], 0
jbe 0x67a436
mov dword [esi + 0x3b74], 0xffffffff
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.006b262c
test al, al
je 0x67a436
push 1
mov eax, dword [esi + 0x36c]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.006b5968
test al, al
jne 0x67a436
movzx edx, word [esi + 0x548]
mov eax, dword [0x707bc4]
mov eax, dword [eax]
call fcn.0062e410
test eax, eax
je 0x67a436
cmp byte [eax + 0x14], 0x13
jne 0x67a436
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00694354
test al, al
je 0x67a3fb
mov ecx, 0x67a734
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x98]
sub dword [esi + 0x408], 0x1e
sub dword [esi + 0x40c], 0x32
mov eax, dword [esi + 0x40c]
test eax, eax
jge 0x67a415
xor eax, eax
mov dword [esi + 0x40c], eax
sub dword [esi + 0x2d4], 2
sub dword [esi + 0x2dc], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x67a6ff
movzx eax, di
cmp eax, 0xf
jg 0x67a477
je 0x67a584
add eax, 0xfffffff9
cmp eax, 7
ja case.default.0x67a450
jmp dword [eax*4 + 0x67a457]
cmp eax, 0x15
jg 0x67a4a0
je 0x67a602
sub eax, 0x11
je 0x67a5cc
sub eax, 2
je 0x67a5de
dec eax
je 0x67a5f0
jmp case.default.0x67a450
sub eax, 0x16
je 0x67a5ba
sub eax, 0x36
je 0x67a596
sub eax, 0x3b
je 0x67a5a8
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
xor ecx, ecx
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
mov cx, 1
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
mov cx, 2
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
mov cx, 3
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
cmp byte [esi + 0xec], 0
je 0x67a530
mov eax, dword [ebp + 0x10]
push eax
mov cx, 0xb
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
mov cx, 4
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
mov cx, 5
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
mov cx, 7
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
mov cx, 8
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
mov cx, 9
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
mov cx, 0xa
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
mov cx, 0x2b
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
mov cx, 0x38
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
mov cx, 0x6e
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
mov cx, 0x70
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
mov cx, 0x71
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
jmp case.default.0x67a450
mov eax, dword [ebp + 0x10]
push eax
mov cx, 0x7a
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
cmp byte [ebp - 0x15], 0
je 0x67a621
xor edx, edx
mov eax, esi
call fcn.0067af20
cmp dword [esi + 0x387c], 0
je 0x67a692
cmp word [esi + 0x550], 0
jbe 0x67a692
cmp byte [esi + 0xce4], 0
jne 0x67a692
dec byte [esi + 0x398]
movzx eax, byte [esi + 0x399]
cmp al, byte [esi + 0x398]
jne 0x67a66a
mov byte [esi + 0xce4], 1
mov ecx, 0x67a744
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x98]
cmp byte [esi + 0x398], 0
ja 0x67a692
mov eax, dword [esi + 0x387c]
mov bl, 7
sub bl, byte [eax + 6]
mov byte [esi + 0x398], bl
movzx eax, bl
call fcn.004034e0
mov byte [esi + 0x399], al
sub dword [esi + 0x408], 0x1e
sub dword [esi + 0x40c], 0x64
mov eax, dword [esi + 0x40c]
test eax, eax
jge 0x67a6ac
xor eax, eax
mov dword [esi + 0x40c], eax
sub dword [esi + 0x2d4], 2
sub dword [esi + 0x2dc], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x67a6ff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67a71c
lea eax, [ebp - 0x1c]
call fcn.004054d0
ret