Function at 0x402fc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
mov esi, dword [esp + 0x68]
xor ebp, ebp
push edi
cmp esi, ebp
je 0x4032ca
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x50]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
mov dword [esp + 0x4c], eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x44], ebp
call fcn.004081e7
cdq
mov ecx, 6
mov ebx, dword [esp + 0x74]
idiv ecx
lea eax, [ebx + ebx*4]
add esp, 4
mov dword [esp + 0x30], 0xa
add edx, 2
mov dword [esp + 0x3c], edx
imul edx, ebx
shl eax, 1
mov dword [esp + 0x34], eax
lea eax, [ebx + ebx*2]
mov dword [esp + 0x44], edx
lea edx, [eax + eax*4]
lea eax, [esi + edx*2 + 0x7a]
mov dword [esp + 0x2c], eax
mov esi, dword [esp + 0x2c]
mov edi, 0x32
mov dword [esp + 0x38], edi
mov dword [esp + 0x28], esi
jmp 0x403054
mov esi, dword [esp + 0x28]
xor ecx, ecx
xor edx, edx
mov ch, byte [esi - 2]
mov dl, byte [esi]
mov cl, byte [esi - 1]
push 0xa
shl ecx, 8
or ecx, edx
push 0xc4c8cd
mov esi, ecx
push esi
call fcn.00401200
add esp, 0xc
test eax, eax
jne 0x403093
push 0xa
push 0x1d5c11
push esi
call fcn.00401200
add esp, 0xc
test eax, eax
je 0x40318f
mov ecx, dword [esp + 0x30]
xor ebp, ebp
cmp edi, 0x204
mov dword [esp + 0x14], ebp
lea eax, [ecx + 0x28]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
jle 0x4030bc
mov dword [esp + 0x18], 0x1fe
cmp eax, 0x14e
jle 0x4030cf
mov dword [esp + 0x1c], 0x14a
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov dword [esp + 0x20], ecx
jge 0x40318f
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x18]
lea esi, [edi - 0x28]
cmp esi, ecx
jge 0x403174
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x6c]
lea eax, [edx + esi*4]
lea edi, [eax + ecx + 2]
xor ebx, ebx
xor edx, edx
mov bh, byte [edi - 2]
mov dl, byte [edi]
mov bl, byte [edi - 1]
push 0x19
shl ebx, 8
or ebx, edx
push 0xc4c8cd
push ebx
call fcn.00401200
add esp, 0xc
test eax, eax
jne 0x40313a
push 0x19
push 0x1d5c11
push ebx
call fcn.00401200
add esp, 0xc
test eax, eax
je 0x40315c
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
add ebx, esi
add edx, eax
inc ebp
cmp ebp, 0x1e
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
jg 0x4031e9
mov eax, dword [esp + 0x18]
inc esi
add edi, 4
cmp esi, eax
jl 0x403101
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x70]
mov edi, dword [esp + 0x38]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
inc ecx
add esi, ebx
cmp ecx, eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], esi
jl 0x4030e3
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x28]
add edi, ecx
lea eax, [ecx*4]
mov dword [esp + 0x38], edi
add esi, eax
cmp edi, 0x1ea
mov dword [esp + 0x28], esi
jl 0x403050
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x44]
mov edi, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
add eax, esi
add edi, ecx
add edx, ecx
cmp eax, 0x136
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
jl 0x40303d
jmp 0x4031ed
mov ebx, dword [esp + 0x70]
cmp ebp, 0x1e
jge 0x40327e
mov edx, dword [esp + 0x6c]
mov eax, ebx
shl eax, 4
add eax, ebx
mov dword [esp + 0x70], 0x14
lea ecx, [eax + eax*4]
lea eax, [edx + ecx*2 + 0x3d6]
mov dword [esp + 0x64], eax
mov esi, dword [esp + 0x64]
mov ebp, 0x28
xor ecx, ecx
xor edx, edx
mov ch, byte [esi - 2]
mov dl, byte [esi]
mov cl, byte [esi - 1]
push 0xa
shl ecx, 8
or ecx, edx
push 0xc4c8cd
mov edi, ecx
push edi
call fcn.00401200
add esp, 0xc
test eax, eax
jne 0x403257
push 0xa
push 0x1d5c11
push edi
call fcn.00401200
add esp, 0xc
add esi, 4
dec ebp
jne 0x403220
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x70]
add ecx, ebx
dec eax
mov dword [esp + 0x64], ecx
mov dword [esp + 0x70], eax
jne 0x403217
mov eax, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
mov eax, dword [esp + 0x10]
cdq
idiv ebp
mov edi, eax
mov eax, dword [esp + 0x14]
cdq
idiv ebp
mov esi, eax
cmp esi, 0x136
jle 0x4032a6
mov eax, dword [esp + 0x64]
push 0x64
push 0x275
push eax
jmp 0x4032b7
cmp edi, 0x50
jge 0x4032d4
mov ecx, dword [esp + 0x64]
push 0x56
push 0x258
push ecx
call fcn.00402090
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
lea eax, [esi + edx]
lea edx, [edi + ecx]
and eax, 0xffff
and edx, 0xffff
shl eax, 0x10
or eax, edx
push eax
mov eax, dword [esp + 0x68]
push 2
push 0x200
push eax
call ebx
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
lea edx, [esi + ecx]
lea ecx, [edi + eax]
and edx, 0xffff
and ecx, 0xffff
shl edx, 0x10
or edx, ecx
push edx
mov edx, dword [esp + 0x68]
push 2
push 0x204
push edx
call ebx
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
lea ecx, [esi + eax]
lea eax, [edi + edx]
and ecx, 0xffff
and eax, 0xffff
shl ecx, 0x10
or ecx, eax
push ecx
mov ecx, dword [esp + 0x68]
push 1
push 0x205
push ecx
call ebx
mov edx, dword [esp + 0x68]
push esi
push edi
push edx
call fcn.004022b0
add esp, 0xc
test eax, eax
jne 0x40339f
push 0x42b228
call fcn.00407a26
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x68]
push 1
push esi
push edi
push eax
push ecx
call fcn.00402330
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x4c]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x68]
push edx
push esi
push edi
push eax
push ecx
call fcn.00402a50
add esp, 0x14
mov dword [esp + 0x40], eax
test eax, eax
jne 0x4033f3
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
inc edx
mov ecx, dword [esp + 0x64]
and edx, 0xffff
shl edx, 0x10
inc eax
and eax, 0xffff
or edx, eax
push edx
push 1
push 0x200
push ecx
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [esp + 0x70]
push eax
push str.Pickup2__d_ms_n
call fcn.00407a26
add esp, 8
call ebx
sub eax, dword [esp + 0x48]
push eax
push ebp
push esi
push edi
push str.find_bones__d__d__n_d__use_time__d__n
call fcn.00407a26
mov eax, dword [esp + 0x54]
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret