Function at 0x4f7644
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push esi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x16], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b4], 9
jne 0x4f766d
mov byte [ebp - 0x15], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b4], 6
je 0x4f7685
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b4], 7
jne 0x4f7689
mov byte [ebp - 0x16], 1
mov eax, dword [0x529bec]
mov eax, dword [eax]
cmp eax, dword [ebp - 4]
jne 0x4f7805
cmp byte [ebp - 0x15], 0
jne 0x4f7805
cmp byte [ebp - 0x16], 0
jne 0x4f7805
mov eax, dword [0x52a184]
mov byte [eax], 0
mov eax, dword [0x529be8]
mov byte [eax], 0
mov eax, dword [0x529c04]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x76]
mov edx, dword [ebp - 4]
cmp ax, word [edx + 0x78]
jbe 0x4f76fb
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x76]
mov edx, dword [ebp - 4]
movzx edx, word [edx + 0x78]
inc edx
mov ecx, edx
xor edx, edx
div ecx
mov edx, dword [0x529c04]
mov dword [edx], eax
mov eax, dword [0x52a184]
mov byte [eax], 1
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x7a]
mov edx, dword [ebp - 4]
cmp ax, word [edx + 0x7c]
jbe 0x4f7730
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x7a]
mov edx, dword [ebp - 4]
movzx edx, word [edx + 0x7c]
inc edx
mov ecx, edx
xor edx, edx
div ecx
mov edx, dword [0x529c04]
add dword [edx], eax
mov eax, dword [0x52a184]
mov byte [eax], 1
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x7e]
mov edx, dword [ebp - 4]
cmp ax, word [edx + 0x80]
jbe 0x4f774b
mov eax, dword [0x529be8]
mov byte [eax], 1
mov eax, dword [0x52a184]
cmp byte [eax], 0
je 0x4f7783
mov eax, dword [0x529c04]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x26c]
jle 0x4f7783
mov eax, dword [0x529bd4]
cmp byte [eax + 0xbc], 0
jne 0x4f7783
mov eax, dword [ebp - 4]
inc dword [eax + 0x26c]
jmp 0x4f7c14
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x26c], edx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b4], 0xb
je 0x4f77ca
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b4], 9
je 0x4f77ca
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b4], 0xd
je 0x4f77ca
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b4], 6
je 0x4f77ca
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b4], 7
jne 0x4f7805
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x218]
dec eax
je 0x4f77e6
sub eax, 3
je 0x4f77f6
jmp 0x4f7805
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e4]
call fcn.004fab1c
jmp 0x4f7805
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e4]
inc eax
call fcn.004fab1c
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x258], 0
mov eax, dword [0x529bec]
mov eax, dword [eax]
cmp eax, dword [ebp - 4]
je 0x4f7838
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x294]
cmp dword [eax + 8], 2
jl 0x4f7838
mov eax, dword [ebp - 4]
mov byte [eax + 0x258], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b4], 0xb
je 0x4f7878
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b4], 0xd
je 0x4f7878
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b4], 6
je 0x4f7878
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b4], 7
jne 0x4f7a7a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x218]
jl 0x4f78a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x21c]
jle 0x4f78b3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
dec eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x220], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x21c]
jge 0x4f7950
mov eax, dword [ebp - 4]
inc dword [eax + 0x220]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x258], 0
je 0x4f7903
cmp byte [ebp - 0x16], 0
jne 0x4f7903
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x21c]
jge 0x4f7903
mov eax, dword [ebp - 4]
inc dword [eax + 0x220]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x218]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x21c]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x218]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dl, byte [eax + 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x254]
mov eax, dword [ebp - 4]
call fcn.004f4ef8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x21c]
jl 0x4f79cc
mov eax, dword [0x529bec]
mov eax, dword [eax]
cmp eax, dword [ebp - 4]
jne 0x4f79a5
mov eax, dword [0x52a078]
mov eax, dword [eax]
call fcn.005099e8
test al, al
je 0x4f79c8
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1b4], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x1cc], 1
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x270], eax
jmp 0x4f79c8
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1b4], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x1cc], 1
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x270], eax
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b4], 6
jne 0x4f79fc
mov eax, dword [0x529bec]
mov eax, dword [eax]
cmp eax, dword [ebp - 4]
jne 0x4f79fc
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x529d54]
mov dword [edx], eax
mov eax, dword [0x52a080]
mov dword [eax], 0x12c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b4], 7
jne 0x4f7a76
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x21c]
sub eax, 3
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x220]
jg 0x4f7a76
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x288]
mov edx, dword [ebp - 4]
mov word [edx + 8], ax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x28c]
mov edx, dword [ebp - 4]
mov word [edx + 0xa], ax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x120], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xa]
mov edx, dword [ebp - 4]
mov dword [edx + 0x124], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1b4], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x1cc], 1
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1b4], 9
jne 0x4f7bec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x21c]
jg 0x4f7ab2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x218]
jge 0x4f7ac5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x21c]
inc eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x220], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x218]
jle 0x4f7b64
mov eax, dword [ebp - 4]
dec dword [eax + 0x220]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x258]
or al, byte [ebp - 0x15]
je 0x4f7b11
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x218]
jle 0x4f7b11
mov eax, dword [ebp - 4]
dec dword [eax + 0x220]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x21c]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x220]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x21c]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x218]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x10]
call fcn.004f2324
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x254]
mov eax, dword [ebp - 4]
call fcn.004f4ef8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x218]
jg 0x4f7be8
mov eax, dword [0x529bec]
mov eax, dword [eax]
cmp eax, dword [ebp - 4]
jne 0x4f7bc1
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1b4], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x1cc], 1
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x270], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x529d54]
mov dword [edx], eax
mov eax, dword [0x52a080]
mov dword [eax], 0x3e8
jmp 0x4f7be4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1b4], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x1cc], 1
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x270], eax
mov byte [ebp - 5], 1
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x220]
je 0x4f7c14
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x278], eax
mov eax, dword [ebp - 4]
mov si, 0xfff3
call fcn.00404400
mov al, byte [ebp - 5]
pop esi
mov esp, ebp
pop ebp
ret