Function at 0x40dac0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0xfc]
add eax, 0x800
mov ecx, 0x8000
mov dword [ebp + 0x100], eax
mov edi, dword [ebp + 0x65c]
or eax, 0xffffffff
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xfc]
mov edi, dword [ebp + 0x65c]
mov esi, dword [ebp + 0x664]
mov edx, ecx
add edi, 0x800
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xfc]
xor ecx, ecx
test eax, eax
jle 0x40db47
mov edx, dword [ebp + 0x664]
cmp byte [edx + ecx], 0xff
jne 0x40db37
inc ecx
cmp ecx, eax
jl 0x40db2c
cmp ecx, 0x10000
mov dword [esp + 0x14], 0x10000
jg 0x40db4b
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 0x65c]
mov edi, eax
mov eax, 0x1b4e81b5
mov dword [esp + 0x18], edi
mov word [ebx], 0xa55a
mov ecx, dword [ebp + 0xe4]
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov byte [ebx + 0xa], dl
mov cl, byte [ebp + 0xec]
mov byte [ebx + 0xb], cl
mov edx, dword [ebp + 0x11c]
shl edx, 5
mov ax, word [edx + 0x41b450]
push eax
call fcn.00419da0
mov word [ebx + 0xc], ax
mov ecx, dword [ebp + 0x11c]
shl ecx, 5
mov dx, word [ecx + 0x41b452]
push edx
call fcn.00419da0
mov word [ebx + 0xe], ax
mov byte [ebx + 0x10], 0
mov byte [ebx + 0x11], 0
mov byte [ebx + 0x12], 0
mov byte [ebx + 0x13], 0
mov eax, dword [ebp + 0xf8]
push eax
call fcn.00419d80
mov dword [ebx + 0x14], eax
mov ecx, dword [ebp + 0x114]
push ecx
call fcn.00419d80
mov dword [ebx + 0x18], eax
fild dword [ebp + 0xf8]
fmul dword [ebp + 0x1e0]
call sub.MSVCRT.dll__ftol
push eax
call fcn.00419d80
mov dword [ebx + 0x1a3], eax
mov edx, dword [ebp + 0x698]
push edx
call fcn.00419d80
mov dword [ebx + 0x1a9], eax
mov al, byte [ebp + 0x69c]
mov byte [ebx + 0x1ad], al
mov cl, byte [ebp + 0x69d]
mov byte [ebx + 0x1ae], cl
mov dl, byte [ebp + 0x69e]
mov byte [ebx + 0x1af], dl
mov al, byte [ebp + 0x69f]
mov byte [ebx + 0x1b0], al
mov cl, byte [ebp + 0x6a0]
mov byte [ebx + 0x1b1], cl
mov dl, byte [ebp + 0x6a1]
mov byte [ebx + 0x1b2], dl
mov al, byte [ebp + 0x6a2]
mov byte [ebx + 0x1b3], al
mov cl, byte [ebp + 0x6a3]
mov byte [ebx + 0x1b4], cl
mov al, byte [ebx + 0x10]
or al, 0x20
mov byte [ebx + 0x10], al
mov edx, dword [ebp + 0x168]
push edx
call fcn.00419d80
mov dword [ebx + 0x1c], eax
mov ecx, dword [ebp + 0x670]
lea eax, [ebx + 0x20]
add esp, 0x1c
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp + 0x11c]
shl edx, 5
mov eax, dword [edx + 0x41b448]
mov ecx, eax
and ecx, 0x7f8000
cmp ecx, 0x168000
jb 0x40dcd0
test al, 8
jne 0x40dcd0
mov byte [ebx + 0x23], 0xff
mov al, byte [ebp + 0x2f]
test al, al
je 0x40dcf6
mov al, byte [ebx + 0x10]
lea edi, [ebx + 0x300]
or al, 1
mov ecx, 0x40
mov byte [ebx + 0x10], al
mov esi, dword [ebp + 0x66c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x18]
mov al, byte [ebp + 0x27]
test al, al
je 0x40dd01
or byte [ebx + 0x10], 2
mov edx, dword [ebp + 0x670]
test byte [edx + 0x10], 1
jne 0x40dd6b
mov al, byte [ebx + 0x10]
or al, 4
mov byte [ebx + 0x10], al
mov ecx, dword [ebp + 0x670]
test byte [ecx + 0x10], 2
jne 0x40dd2a
and eax, 0xff
or al, 8
jmp 0x40dd31
and eax, 0xff
and al, 0xf7
mov byte [ebx + 0x10], al
mov edx, dword [ebp + 0x670]
test byte [edx + 0x10], 4
jne 0x40dd49
and eax, 0xff
or al, 0x10
jmp 0x40dd50
and eax, 0xff
and al, 0xef
mov byte [ebx + 0x10], al
mov eax, dword [ebp + 0x670]
mov cl, byte [eax + 0x11]
mov byte [ebx + 0x30], cl
mov edx, dword [ebp + 0x670]
mov al, byte [edx + 0x12]
mov byte [ebx + 0x31], al
mov eax, dword [ebp + 0xf0]
test eax, eax
je 0x40dd79
or byte [ebx + 0x10], 0x40
mov ecx, dword [ebp + 0x11c]
shl ecx, 5
test byte [ecx + 0x41b448], 0x20
je 0x40dd8f
or byte [ebx + 0x10], 0x80
mov dl, byte [ebp + 0x10c]
mov byte [ebx + 0x32], dl
mov eax, dword [ebp + 0x11c]
shl eax, 5
mov ecx, dword [eax + 0x41b448]
shr ecx, 0xf
mov byte [ebx + 0x33], cl
mov al, byte [ebp + 0x31]
test al, al
je 0x40de27
mov eax, dword [ebp + 0x88]
mov esi, dword [esp + 0x14]
cmp esi, eax
jl 0x40ddc8
mov esi, eax
mov dword [esp + 0x14], esi
mov edx, dword [ebp + 0x90]
add eax, edx
cmp edi, eax
jg 0x40ddda
mov edi, eax
mov dword [esp + 0x18], edi
mov dl, byte [ebx + 0x11]
or dl, 1
mov byte [ebx + 0x11], dl
mov eax, dword [ebp + 0x88]
push eax
call fcn.00419d80
mov dword [ebx + 0x34], eax
mov cl, byte [ebp + 0x90]
lea edx, [ebp + 0x48]
push 0x10
lea eax, [ebx + 0x40]
push edx
push eax
mov byte [ebx + 0x3c], cl
call fcn.00419d50
lea ecx, [ebp + 0x68]
push 0x10
lea edx, [ebx + 0x60]
push ecx
push edx
call fcn.00419d50
mov al, byte [ebp + 0x98]
add esp, 0x1c
mov byte [ebx + 0x3e], al
jmp 0x40de2b
mov esi, dword [esp + 0x14]
mov al, byte [ebp + 0x32]
test al, al
je 0x40de9f
mov eax, dword [ebp + 0x8c]
cmp esi, eax
jl 0x40de42
mov esi, eax
mov dword [esp + 0x14], esi
mov ecx, dword [ebp + 0x94]
add eax, ecx
cmp edi, eax
jg 0x40de54
mov edi, eax
mov dword [esp + 0x18], edi
mov cl, byte [ebx + 0x11]
or cl, 2
mov byte [ebx + 0x11], cl
mov edx, dword [ebp + 0x8c]
push edx
call fcn.00419d80
lea ecx, [ebp + 0x58]
mov dword [ebx + 0x38], eax
mov al, byte [ebp + 0x94]
push 0x10
lea edx, [ebx + 0x50]
push ecx
push edx
mov byte [ebx + 0x3d], al
call fcn.00419d50
lea eax, [ebp + 0x78]
push 0x10
lea ecx, [ebx + 0x70]
push eax
push ecx
call fcn.00419d50
mov dl, byte [ebp + 0x9c]
add esp, 0x1c
mov byte [ebx + 0x3f], dl
mov al, byte [ebp + 0x29]
test al, al
je 0x40deaa
or byte [ebx + 0x11], 4
mov al, byte [ebp + 0x2a]
test al, al
jne 0x40deb5
or byte [ebx + 0x12], 4
mov al, byte [ebp + 0x2b]
test al, al
je 0x40dec0
or byte [ebx + 0x12], 8
mov al, byte [ebp + 0x2c]
test al, al
jne 0x40decb
or byte [ebx + 0x12], 0x10
mov eax, dword [ebp + 0x11c]
shl eax, 5
test byte [eax + 0x41b448], 4
je 0x40dee1
or byte [ebx + 0x12], 0x20
mov cl, byte [ebp + 0xd8]
mov dl, byte [ebx + 0x12]
shl cl, 6
or dl, cl
mov byte [ebx + 0x12], dl
mov dl, byte [ebp + 0xf4]
mov byte [ebx + 0x80], dl
mov al, byte [ebp + 0x38]
test al, al
je 0x40dffb
mov eax, dword [ebp + 0xd0]
cmp esi, eax
jl 0x40df17
mov dword [esp + 0x14], eax
mov ecx, dword [ebp + 0xcc]
add eax, ecx
cmp edi, eax
jg 0x40df27
mov dword [esp + 0x18], eax
mov al, byte [ebx + 0x11]
or al, 0x40
mov byte [ebx + 0x11], al
mov ecx, dword [ebp + 0xb8]
mov eax, 0x1b4e81b5
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov byte [ebx + 0xa3], dl
mov ecx, dword [ebp + 0xc4]
cmp ecx, 0x20
jle 0x40df5c
mov ecx, 0x20
mov byte [ebx + 0xa4], cl
mov esi, dword [ebp + 0x674]
and ecx, 0xff
lea edi, [ebx + 0xa5]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xcc]
cmp eax, 0x800
jle 0x40df94
mov eax, 0x800
push eax
mov word [ebx + 0xe5], ax
call fcn.00419da0
mov word [ebx + 0xe5], ax
mov eax, dword [ebp + 0xd0]
push eax
call fcn.00419d80
mov dword [ebx + 0xe7], eax
mov ecx, dword [ebp + 0xc8]
add esp, 8
cmp ecx, 0x1f
jle 0x40dfcd
mov ecx, 0x1f
mov byte [ebx + 0xc5], cl
mov esi, dword [ebp + 0x678]
and ecx, 0xff
lea edi, [ebx + 0xc6]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov al, byte [ebp + 0x15d4]
test al, al
jne 0x40e027
mov al, byte [ebp + 0x15d5]
test al, al
jne 0x40e027
mov al, byte [ebp + 0x15d6]
test al, al
jne 0x40e027
mov al, byte [ebp + 0x15d7]
test al, al
je 0x40e165
mov cl, byte [ebx + 0x11]
or cl, 8
mov byte [ebx + 0x11], cl
mov al, byte [ebp + 0x15d8]
mov byte [ebx + 0xeb], al
mov cl, byte [ebp + 0x15d9]
mov byte [ebx + 0xec], cl
mov dl, byte [ebp + 0x15da]
mov byte [ebx + 0xed], dl
mov al, byte [ebp + 0x15db]
lea ecx, [ebp + 0x15dc]
mov byte [ebx + 0xee], al
lea edx, [ebx + 0xef]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp + 0x15ec]
push edx
call fcn.00419d80
mov dword [ebx + 0xff], eax
mov eax, dword [ebp + 0x15f0]
push eax
call fcn.00419d80
mov dword [ebx + 0x103], eax
mov ecx, dword [ebp + 0x15f4]
push ecx
call fcn.00419d80
mov dword [ebx + 0x107], eax
mov edx, dword [ebp + 0x15f8]
push edx
call fcn.00419d80
mov dword [ebx + 0x10b], eax
mov al, byte [ebp + 0x15d4]
add esp, 0x10
test al, al
je 0x40e0f4
mov eax, dword [ebp + 0x15ec]
cmp esi, eax
jl 0x40e0e7
mov esi, eax
mov dword [esp + 0x14], esi
add eax, 7
cmp edi, eax
jg 0x40e0f4
mov edi, eax
mov dword [esp + 0x18], edi
mov al, byte [ebp + 0x15d5]
test al, al
je 0x40e11b
mov eax, dword [ebp + 0x15f0]
cmp esi, eax
jl 0x40e10e
mov esi, eax
mov dword [esp + 0x14], esi
add eax, 7
cmp edi, eax
jg 0x40e11b
mov edi, eax
mov dword [esp + 0x18], edi
mov al, byte [ebp + 0x15d6]
test al, al
je 0x40e142
mov eax, dword [ebp + 0x15f4]
cmp esi, eax
jl 0x40e135
mov esi, eax
mov dword [esp + 0x14], esi
add eax, 7
cmp edi, eax
jg 0x40e142
mov edi, eax
mov dword [esp + 0x18], edi
mov al, byte [ebp + 0x15d7]
test al, al
je 0x40e165
mov eax, dword [ebp + 0x15f8]
cmp esi, eax
jl 0x40e15a
mov dword [esp + 0x14], eax
add eax, 7
cmp edi, eax
jg 0x40e165
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x11c]
shl eax, 5
mov ecx, dword [eax + 0x41b454]
push ecx
call fcn.00419d80
mov dword [ebx + 0x10f], eax
mov eax, dword [ebp + 0x11c]
shl eax, 5
mov edx, dword [eax + 0x41b458]
mov edi, dword [eax + 0x41b454]
add edx, edi
push edx
call fcn.00419d80
mov dword [ebx + 0x113], eax
mov eax, dword [ebp + 0x16c]
add esp, 8
cmp eax, 0x10
jle 0x40e1b6
mov eax, 0x10
mov cl, 0xa
imul cl
test al, al
mov byte [ebx + 0x117], al
jne 0x40e1cb
mov byte [ebx + 0x117], 0x32
mov al, byte [ebp + 0x15fc]
test al, al
je 0x40e22f
mov dl, byte [ebp + 0x1600]
lea esi, [ebp + 0x1608]
mov byte [ebx + 0x118], dl
mov al, byte [ebp + 0x1604]
mov byte [ebx + 0x119], al
mov ecx, dword [ebp + 0x1600]
mov edx, ecx
lea edi, [ebx + 0x11a]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x1604]
lea esi, [ebp + 0x1708]
mov eax, ecx
lea edi, [ebx + 0x15a]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x40e23d
mov byte [ebx + 0x118], 0
mov byte [ebx + 0x119], 0
mov ecx, dword [ebp + 0x670]
test byte [ecx + 0xf], 2
je 0x40e28a
mov eax, dword [ebp + 0x11c]
shl eax, 5
mov ecx, dword [eax + 0x41b448]
and ecx, 0x7f8000
cmp ecx, 0x168000
jae 0x40e278
mov eax, dword [eax + 0x41b454]
mov edx, dword [esp + 0x18]
cmp edx, eax
jg 0x40e278
mov dword [esp + 0x18], eax
cmp ecx, 0xc8000
jb 0x40e286
or byte [ebx + 0x11], 0x80
jmp 0x40e28a
or byte [ebx + 0x12], 1
mov al, byte [ebp + 0x39]
test al, al
je 0x40e2b9
mov eax, dword [ebp + 0x11c]
shl eax, 5
test byte [eax + 0x41b448], 8
je 0x40e2b5
mov edx, dword [eax + 0x41b460]
sub edx, 0x800
mov dword [ebx + 0x113], edx
or byte [ebx + 0x12], 2
mov al, byte [ebp + 0x188]
mov esi, dword [esp + 0x18]
mov byte [ebx + 0x19a], al
mov cl, byte [ebp + 0x18c]
mov byte [ebx + 0x19b], cl
mov dl, byte [ebp + 0x190]
mov byte [ebx + 0x19c], dl
mov eax, dword [ebp + 0x664]
push 0
push esi
push eax
mov ecx, ebp
call fcn.004018f0
push eax
call fcn.00419da0
mov word [ebx + 4], ax
mov ecx, dword [ebp + 0x11c]
lea eax, [esi + 0x7f]
mov edi, dword [esp + 0x18]
cdq
and edx, 0x7f
push 3
add eax, edx
push 0x42d7d8
mov esi, eax
and edi, 0xfffffe00
shl ecx, 5
sar esi, 7
mov edx, dword [ecx + 0x41b44c]
shl esi, 7
push edx
mov dword [esp + 0x28], esi
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0x10
test eax, eax
je 0x40e353
mov eax, dword [ebp + 0x11c]
shl eax, 5
cmp word [eax + 0x41b450], 0xf55f
jne 0x40e376
mov eax, dword [ebp + 0x11c]
xor ecx, ecx
shl eax, 5
mov cl, byte [eax + 0x41b464]
mov eax, dword [eax + 0x41b454]
sub eax, ecx
cmp esi, eax
jl 0x40e376
mov esi, eax
mov dword [esp + 0x18], esi
push esi
call fcn.00419d80
push edi
mov dword [ebx + 6], eax
call fcn.00419d80
mov dword [ebx + 0x19d], eax
mov al, byte [ebp + 0x25]
add esp, 8
test al, al
je 0x40e511
mov edx, dword [ebp + 0xf0]
mov al, byte [ebp + 0x10c]
neg edx
sbb dl, dl
lea ecx, [esp + 0x15]
and dl, 2
push ecx
push 2
add dl, 3
push 0
push 0x40
mov ecx, ebp
mov byte [esp + 0x24], 0xff
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], al
call fcn.00410390
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x13]
mov ecx, ebp
push edx
push 1
push 0
push 1
mov byte [esp + 0x23], 4
call fcn.00410390
mov eax, dword [ebp + 0x16c]
mov ecx, ebp
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
push eax
call fcn.004021c0
push 1
push 0
mov ecx, ebp
call fcn.00401f50
mov al, byte [ebp + 0x23]
test al, al
je 0x40e726
mov ecx, ebp
call fcn.004021e0
test al, al
jne 0x40e733
lea ecx, [ebp + 0x6aa]
push 1
push ecx
mov ecx, ebp
call fcn.00401f50
test al, al
je 0x40e412
mov al, byte [ebp + 0x25]
test al, al
je 0x40e45e
mov eax, dword [ebp + 0x1c4]
test eax, eax
je 0x40e45e
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
lea edi, [ebp + 0x6aa]
xor eax, eax
lea esi, [ebx + 0x1a1]
mov ah, byte [edi]
mov al, byte [ebp + 0x6ab]
push eax
call fcn.00419da0
add esp, 4
mov word [esi], ax
mov dl, byte [ebp + 0x170]
mov ecx, ebp
push esi
mov byte [ebx + 0x1a7], dl
mov al, byte [ebp + 0x174]
push 2
push 0
push 2
mov byte [ebx + 0x1a8], al
call fcn.00410390
mov eax, dword [ebp + 0x16c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
shl ecx, 3
push ecx
mov ecx, ebp
call fcn.004021c0
push 1
push 0
mov ecx, ebp
call fcn.00401f50
mov al, byte [ebp + 0x23]
test al, al
je 0x40e726
mov ecx, ebp
call fcn.004021e0
test al, al
jne 0x40e733
push 1
push edi
mov ecx, ebp
call fcn.00401f50
test al, al
je 0x40e4cb
mov al, byte [ebp + 0x25]
test al, al
je 0x40e511
mov eax, dword [ebp + 0x1c4]
test eax, eax
je 0x40e511
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
mov edx, dword [ebp + 0x65c]
push 4
push 0x3fc
push edx
mov ecx, ebp
call fcn.004018f0
push eax
call fcn.00419da0
mov word [ebx + 2], ax
mov eax, dword [esp + 0x1c]
add esp, 4
add eax, 0x800
mov ecx, ebp
mov dword [ebp + 0x100], eax
push 0x32e2
call fcn.00401720
push eax
push ebp
call fcn.00401760
add esp, 8
mov ecx, ebp
push 0
push 0
call fcn.00401890
mov eax, dword [ebp + 0x100]
xor ebx, ebx
test eax, eax
mov dword [esp + 0x14], eax
mov byte [ebp + 0xaaa], 0xf4
jle 0x40e6d3
jmp 0x40e584
mov eax, dword [esp + 0x14]
mov cl, byte [ebp + 0x25]
test cl, cl
je 0x40e59d
cmp eax, 0x38
jge 0x40e596
mov byte [esp + 0x18], al
jmp 0x40e5ad
mov byte [esp + 0x18], 0x38
jmp 0x40e5ad
cmp eax, 0x80
mov byte [esp + 0x18], al
jl 0x40e5ad
mov byte [esp + 0x18], 0x80
test cl, cl
je 0x40e5cb
mov ecx, dword [ebp + 0x65c]
mov esi, dword [esp + 0x18]
add ecx, ebx
push ecx
push esi
push ebx
push 0x49
mov ecx, ebp
call fcn.00410390
jmp 0x40e619
mov esi, dword [ebp + 0x65c]
mov edx, ebx
xor eax, eax
add esi, ebx
shr edx, 0x10
mov al, bh
lea edi, [ebp + 0xaae]
mov ecx, 0x20
mov byte [ebp + 0xaab], dl
mov byte [ebp + 0xaac], al
mov byte [ebp + 0xaad], bl
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x18]
lea eax, [ebp + 0xaaa]
mov ecx, esi
and ecx, 0xff
add ecx, 4
push ecx
push eax
mov ecx, ebp
call fcn.00401db0
push 0x7d0
mov ecx, ebp
call fcn.004021c0
push 1
push 0
mov ecx, ebp
call fcn.00401f50
mov al, byte [ebp + 0x23]
test al, al
je 0x40e726
mov ecx, ebp
call fcn.004021e0
test al, al
jne 0x40e733
lea edx, [ebp + 0x6aa]
push 1
push edx
mov ecx, ebp
call fcn.00401f50
test al, al
je 0x40e630
mov al, byte [ebp + 0x25]
test al, al
je 0x40e688
mov ecx, dword [ebp + 0x1c4]
test ecx, ecx
jne 0x40e504
test al, al
je 0x40e688
cmp byte [ebp + 0x6aa], 0x54
je 0x40e6a9
test al, al
jne 0x40e504
mov al, byte [ebp + 0x6aa]
mov cl, byte [ebp + 0xaaa]
cmp al, cl
jne 0x40e504
cmp byte [ebp + 0x6ab], 0x54
jne 0x40e504
mov ecx, dword [ebp + 0x100]
push ecx
push ebx
mov ecx, ebp
call fcn.00401890
mov ecx, dword [esp + 0x14]
mov eax, esi
and eax, 0xff
sub ecx, eax
add ebx, eax
test ecx, ecx
mov dword [esp + 0x14], ecx
jg 0x40e580
push 0
push 0
mov ecx, ebp
call fcn.00401890
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
sub eax, ebx
sub esp, 8
mov dword [esp + 0x24], eax
mov ecx, ebp
fild qword [esp + 0x24]
fmul dword [0x4244e0]
fstp qword [esp]
push 0x32df
call fcn.00401720
push eax
push ebp
call fcn.00401760
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x14
ret