Function at 0x47eea0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa8
mov eax, dword [esp + 0xb4]
push ebx
push ebp
mov ebp, dword [esp + 0xc8]
push esi
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 0x11c]
push edi
lea edi, [ebp + 0x37d8]
mov dword [esp + 0x24], ecx
xor ebx, ebx
mov dword [esp + 0x10], edi
mov cx, word [edi + 0x84e]
mov edx, dword [edi + 0x79c]
mov eax, ecx
mov dword [esp + 0x2c], edx
and eax, 0x8000
cmp ax, 0x8000
jne 0x47ef03
mov eax, dword [edi + 0xa60]
mov dword [esp + 0x30], 1
cmp eax, 3
jb 0x47ef07
mov dword [esp + 0x30], ebx
mov dl, cl
mov dword [esp + 0x28], ebx
and dl, 2
cmp dl, 2
je 0x47ef28
mov ax, word [edi + 0x850]
and eax, 0x400
cmp eax, 0x400
jne 0x47ef3c
mov eax, dword [edi + 0xa58]
mov edx, dword [ebp + 0x4368]
cmp eax, edx
mov ebx, eax
jb 0x47ef3c
mov ebx, edx
mov dl, cl
and dl, 0x40
cmp dl, 0x40
je 0x47ef5d
mov ax, word [edi + 0x850]
and eax, 0x400
cmp eax, 0x400
jne 0x47efe9
mov dl, byte [edi + 0x6e0]
cmp dl, 1
jne 0x47ef9f
mov ax, word [edi + 0x6e2]
cmp ax, 0x34
jl 0x47ef7b
cmp ax, 0x3f
jle 0x47efcf
cmp ax, 0x89
je 0x47efcf
cmp ax, 0x8a
je 0x47efcf
cmp ax, 0xf0
je 0x47efcf
cmp ax, 0xf1
je 0x47efcf
cmp ax, 0xbe
jl 0x47ef9f
cmp ax, 0xc2
jle 0x47efcf
cmp dl, 6
jne 0x47efe9
mov ax, word [edi + 0x6e2]
cmp ax, 0x54
je 0x47efcf
cmp ax, 0x72
je 0x47efcf
cmp ax, 0x86
je 0x47efcf
cmp ax, 0x9a
je 0x47efcf
cmp ax, 0xae
je 0x47efcf
cmp ax, 0xc2
jne 0x47efe9
mov eax, dword [ebp + 0x4368]
lea eax, [eax + eax*2]
lea edx, [eax + eax*4]
mov eax, 0x51eb851f
mul edx
mov esi, edx
shr esi, 5
jmp 0x47efeb
xor esi, esi
and ecx, 0x4000
cmp ecx, 0x4000
jne 0x47f009
mov eax, 0xcccccccd
mul dword [ebp + 0x4368]
shr edx, 2
jmp 0x47f00b
xor edx, edx
mov ecx, dword [ebp + 0x4318]
mov eax, dword [ebp + 0x4368]
add ecx, eax
mov eax, dword [esp + 0xc4]
add ecx, edx
mov edx, dword [eax + 0x2b0]
add ecx, esi
add ecx, ebx
lea eax, [edx + edx*4]
cmp edx, ecx
lea eax, [eax + eax*4]
jbe 0x47f05a
lea esi, [ecx + ecx*4]
add ecx, edx
shl eax, 1
lea esi, [esi + esi*4]
xor edx, edx
shl esi, 1
sub eax, esi
div ecx
mov edx, eax
mov eax, 0xaaaaaaab
mul edx
mov esi, edx
shr esi, 1
add esi, 0xa
jmp 0x47f080
shl eax, 1
mov esi, eax
lea eax, [ecx + ecx*4]
add ecx, edx
xor edx, edx
lea eax, [eax + eax*4]
shl eax, 1
sub eax, esi
mov esi, 0xa
div ecx
mov edx, eax
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
sub esi, edx
mov eax, dword [esp + 0x24]
mov al, byte [eax]
cmp al, 0x35
je 0x47f092
cmp al, 0x3b
je 0x47f092
cmp al, 0x3c
jne 0x47f095
add esi, 0xf
test esi, esi
jge 0x47f09d
xor esi, esi
jmp 0x47f0a7
cmp esi, 0x64
jle 0x47f0a7
mov esi, 0x64
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x64
idiv ecx
cmp edx, esi
jge 0x47f0c1
mov dword [esp + 0x28], 1
mov dx, word [edi + 0x850]
mov eax, edx
mov dword [esp + 0x14], edx
and eax, 0x1000
test ax, ax
jne 0x47f1f4
mov bx, word [edi + 0x84e]
mov cl, bl
and cl, 2
cmp cl, 2
je 0x47f0ff
mov eax, edx
and eax, 0x400
cmp eax, 0x400
je 0x47f0ff
xor esi, esi
jmp 0x47f113
mov eax, dword [edi + 0xa58]
mov ecx, dword [ebp + 0x4368]
cmp eax, ecx
mov esi, eax
jb 0x47f113
mov esi, ecx
mov cl, bl
and cl, 0x40
cmp cl, 0x40
je 0x47f12f
and edx, 0x400
cmp edx, 0x400
jne 0x47f1bb
mov cl, byte [edi + 0x6e0]
cmp cl, 1
jne 0x47f171
mov ax, word [edi + 0x6e2]
cmp ax, 0x34
jl 0x47f14d
cmp ax, 0x3f
jle 0x47f1a1
cmp ax, 0x89
je 0x47f1a1
cmp ax, 0x8a
je 0x47f1a1
cmp ax, 0xf0
je 0x47f1a1
cmp ax, 0xf1
je 0x47f1a1
cmp ax, 0xbe
jl 0x47f171
cmp ax, 0xc2
jle 0x47f1a1
cmp cl, 6
jne 0x47f1bb
mov ax, word [edi + 0x6e2]
cmp ax, 0x54
je 0x47f1a1
cmp ax, 0x72
je 0x47f1a1
cmp ax, 0x86
je 0x47f1a1
cmp ax, 0x9a
je 0x47f1a1
cmp ax, 0xae
je 0x47f1a1
cmp ax, 0xc2
jne 0x47f1bb
mov eax, dword [ebp + 0x4368]
lea eax, [eax + eax*2]
lea edx, [eax + eax*4]
mov eax, 0x51eb851f
mul edx
mov ecx, edx
shr ecx, 5
jmp 0x47f1bd
xor ecx, ecx
and ebx, 0x4000
cmp ebx, 0x4000
jne 0x47f1db
mov eax, 0xcccccccd
mul dword [ebp + 0x4368]
shr edx, 2
jmp 0x47f1dd
xor edx, edx
mov eax, dword [ebp + 0x4318]
add eax, edx
add eax, ecx
mov ecx, dword [ebp + 0x4368]
add eax, esi
jmp 0x47f466
mov si, word [edi + 0x84e]
mov ebp, esi
and ebp, 2
cmp bp, 2
je 0x47f220
mov eax, dword [esp + 0x14]
and eax, 0x400
cmp eax, 0x400
je 0x47f220
mov dword [esp + 0x18], 0
jmp 0x47f23f
mov ecx, dword [esp + 0xd0]
mov eax, dword [edi + 0xa58]
mov dword [esp + 0x18], eax
mov ecx, dword [ecx + 0x4368]
cmp eax, ecx
jb 0x47f23f
mov dword [esp + 0x18], ecx
mov eax, esi
and eax, 0x40
cmp ax, 0x40
mov dword [esp + 0x34], eax
je 0x47f264
mov edx, dword [esp + 0x14]
and edx, 0x400
cmp edx, 0x400
jne 0x47f2f7
mov cl, byte [edi + 0x6e0]
cmp cl, 1
jne 0x47f2a6
mov ax, word [edi + 0x6e2]
cmp ax, 0x34
jl 0x47f282
cmp ax, 0x3f
jle 0x47f2d6
cmp ax, 0x89
je 0x47f2d6
cmp ax, 0x8a
je 0x47f2d6
cmp ax, 0xf0
je 0x47f2d6
cmp ax, 0xf1
je 0x47f2d6
cmp ax, 0xbe
jl 0x47f2a6
cmp ax, 0xc2
jle 0x47f2d6
cmp cl, 6
jne 0x47f2f7
mov ax, word [edi + 0x6e2]
cmp ax, 0x54
je 0x47f2d6
cmp ax, 0x72
je 0x47f2d6
cmp ax, 0x86
je 0x47f2d6
cmp ax, 0x9a
je 0x47f2d6
cmp ax, 0xae
je 0x47f2d6
cmp ax, 0xc2
jne 0x47f2f7
mov eax, dword [esp + 0xd0]
mov eax, dword [eax + 0x4368]
lea eax, [eax + eax*2]
lea ecx, [eax + eax*4]
mov eax, 0x51eb851f
mul ecx
mov ebx, edx
shr ebx, 5
jmp 0x47f2f9
xor ebx, ebx
and esi, 0x4000
cmp si, 0x4000
jne 0x47f321
mov edx, dword [esp + 0xd0]
mov eax, 0xcccccccd
mul dword [edx + 0x4368]
shr edx, 2
mov dword [esp + 0x1c], edx
jmp 0x47f329
mov dword [esp + 0x1c], 0
cmp bp, 2
je 0x47f343
mov eax, dword [esp + 0x14]
and eax, 0x400
cmp eax, 0x400
je 0x47f343
xor ebp, ebp
jmp 0x47f35e
mov ecx, dword [esp + 0xd0]
mov eax, dword [edi + 0xa58]
mov ebp, eax
mov ecx, dword [ecx + 0x4368]
cmp eax, ecx
jb 0x47f35e
mov ebp, ecx
cmp word [esp + 0x34], 0x40
je 0x47f37a
mov eax, dword [esp + 0x14]
and eax, 0x400
cmp eax, 0x400
jne 0x47f40d
mov cl, byte [edi + 0x6e0]
cmp cl, 1
jne 0x47f3bc
mov ax, word [edi + 0x6e2]
cmp ax, 0x34
jl 0x47f398
cmp ax, 0x3f
jle 0x47f3ec
cmp ax, 0x89
je 0x47f3ec
cmp ax, 0x8a
je 0x47f3ec
cmp ax, 0xf0
je 0x47f3ec
cmp ax, 0xf1
je 0x47f3ec
cmp ax, 0xbe
jl 0x47f3bc
cmp ax, 0xc2
jle 0x47f3ec
cmp cl, 6
jne 0x47f40d
mov ax, word [edi + 0x6e2]
cmp ax, 0x54
je 0x47f3ec
cmp ax, 0x72
je 0x47f3ec
cmp ax, 0x86
je 0x47f3ec
cmp ax, 0x9a
je 0x47f3ec
cmp ax, 0xae
je 0x47f3ec
cmp ax, 0xc2
jne 0x47f40d
mov edx, dword [esp + 0xd0]
mov eax, dword [edx + 0x4368]
lea eax, [eax + eax*2]
lea ecx, [eax + eax*4]
mov eax, 0x51eb851f
mul ecx
mov edi, edx
shr edi, 5
jmp 0x47f40f
xor edi, edi
cmp si, 0x4000
jne 0x47f42d
mov edx, dword [esp + 0xd0]
mov eax, 0xcccccccd
mul dword [edx + 0x4368]
shr edx, 2
jmp 0x47f42f
xor edx, edx
mov eax, dword [esp + 0xd0]
add edx, edi
add edx, ebp
mov esi, dword [eax + 0x4318]
mov ecx, dword [eax + 0x4368]
add edx, esi
mov eax, 0xcccccccd
add edx, ecx
mul edx
mov eax, edx
mov edx, dword [esp + 0x1c]
shr eax, 2
add eax, edx
add eax, ebx
mov ebx, dword [esp + 0x18]
add eax, ebx
add eax, esi
mov ebp, dword [esp + 0xbc]
mov edi, dword [esp + 0xc4]
add eax, ecx
mov ecx, dword [esp + 0xc8]
mov edx, dword [edi + 0x2b0]
push 0
push ecx
push ebp
push eax
mov eax, dword [esp + 0x30]
push edx
mov ecx, dword [eax + 0x3c]
call fcn.0045fab0
cmp eax, 1
mov dword [esp + 0x18], eax
je 0x47f4a9
cmp dword [esp + 0x28], 1
jne 0x47f6ee
mov ecx, dword [edi + 0x2bc]
mov edx, dword [edi + 0x120]
mov al, byte [edi + 0xec]
sub ecx, edx
cmp al, 5
jne 0x47f4cf
mov eax, 0xcccccccd
mul ecx
mov esi, edx
shr esi, 4
jmp 0x47f4da
mov eax, 0xaaaaaaab
mul ecx
mov esi, edx
shr esi, 1
mov ecx, dword [edi + 0x11c]
cmp byte [ecx], 0x49
jne 0x47f4ed
cmp esi, dword [edi + 0x2c4]
ja 0x47f4f3
mov esi, dword [edi + 0x2c4]
mov ebx, dword [esp + 0xc4]
mov edi, dword [ebx + 0x2c8]
cmp edi, 0x64
jbe 0x47f50a
mov edi, 0x64
call dword [sym.imp.MSVCRT.dll_rand]
mov ecx, 0x65
xor edx, edx
sub ecx, edi
mov edi, dword [ebx + 0x2c8]
div ecx
mov eax, 0x51eb851f
add edx, edi
imul edx, esi
mul edx
mov esi, dword [esp + 0x28]
shr edx, 5
cmp esi, 1
jne 0x47f53b
add edx, edx
mov ecx, dword [esp + 0xd0]
xor eax, eax
test esi, esi
setne al
push eax
push ebp
push edx
call fcn.004101f0
mov ecx, dword [esp + 0x10]
mov dx, word [ecx + 0x850]
and edx, 0x2000
test dx, dx
je 0x47f577
mov ecx, dword [esp + 0x24]
cmp byte [ecx], 0x62
je 0x47f577
mov edi, 1
jmp 0x47f579
xor edi, edi
mov edx, dword [esp + 0x10]
mov esi, eax
shr esi, 1
mov cl, byte [edx + 0x84c]
and cl, 0x40
cmp cl, 0x40
jne 0x47f5c6
mov ecx, dword [esp + 0xd0]
mov edx, eax
shr edx, 2
lea eax, [edx + eax*2]
push eax
call fcn.004396e0
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 0x7a0]
test eax, eax
jne 0x47f5da
mov ecx, dword [esp + 0xd0]
push 1
push 1
push 6
call fcn.0042cb70
jmp 0x47f5da
mov ecx, dword [esp + 0xd0]
push 0
lea edx, [ebp + 1]
push ebx
push edx
push eax
call fcn.004393c0
test edi, edi
je 0x47f6ee
test esi, esi
jbe 0x47f6ee
mov eax, dword [esp + 0xc0]
mov edx, dword [esp + 0x20]
push 1
lea ecx, [esp + 0x4c]
push eax
push ecx
mov ecx, dword [edx + 0x3c]
call fcn.00468220
mov ecx, 0xb
xor eax, eax
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 0x120]
cmp ecx, esi
stosw word es:[edi], ax
jbe 0x47f696
sub ecx, esi
cmp ecx, 0x1312d00
mov dword [ebx + 0x120], ecx
jbe 0x47f64e
mov eax, 0x51eb851f
mul dword [ebx + 0x2bc]
mov esi, edx
mov eax, ecx
shr esi, 5
xor edx, edx
div esi
cmp al, 0x64
jae 0x47f669
mov byte [esp + 0x14], al
jmp 0x47f66e
lea eax, [ecx + ecx*4]
xor edx, edx
lea eax, [eax + eax*4]
shl eax, 2
div dword [ebx + 0x2bc]
cmp al, 0x64
jae 0x47f669
mov byte [esp + 0x14], al
jmp 0x47f66e
mov byte [esp + 0x14], 0x64
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov eax, dword [esp + 0x2c]
push 4
push 0
mov ecx, dword [eax + 0x3c]
push 0
push 0
lea edx, [esp + 0x74]
push ebp
push edx
jmp 0x47f6e9
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0xc4]
push edx
push eax
push ebx
lea edx, [ebp + 1]
push ecx
push edx
mov ecx, esi
mov dword [ebx + 0x120], 0
call fcn.00478670
lea eax, [esp + 0x48]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 4
push 0
push 0
push 0
lea ecx, [esp + 0x74]
push ebp
push ecx
mov ecx, dword [esi + 0x3c]
call fcn.004703d0
mov esi, dword [esp + 0xc8]
mov ecx, 0xb
lea edi, [esp + 0x88]
mov eax, dword [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
test eax, eax
movsw word es:[edi], word [esi]
je 0x47f71d
mov edx, dword [esp + 0x10]
cmp eax, dword [edx + 0x79c]
jne 0x47f71d
xor edi, edi
jmp 0x47f73c
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x47f729
xor edi, edi
jmp 0x47f73c
mov edx, dword [esp + 0xd4]
xor eax, eax
test edx, edx
setne al
add eax, 4
mov edi, eax
mov ecx, dword [esp + 0xcc]
mov esi, dword [esp + 0xc0]
push ecx
push esi
call dword [sym.imp.Staff2.dll_char___cdecl_STAFFGetDirection_struct_PIS___struct_PIS__]
mov bl, al
add esp, 8
cmp bl, 5
mov byte [esp + 0x1c], bl
jne 0x47f766
mov bl, 2
mov byte [esp + 0x1c], bl
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.Staff2.dll_char___cdecl_STAFFOppositeDir_char_]
mov byte [ebp + 0x18], al
mov eax, dword [esp + 0xcc]
add esp, 4
mov byte [eax + 0x18], bl
mov ebx, dword [esp + 0xd0]
mov ecx, dword [ebx + 0x3f74]
test ecx, ecx
je 0x47f7e5
cmp dword [ebx + 0x43a4], 2
je 0x47f7e5
cmp ecx, 0x1312d00
jbe 0x47f7ca
mov eax, 0x51eb851f
mul dword [ebx + 0x42d8]
shr edx, 5
mov eax, ecx
mov ecx, edx
xor edx, edx
div ecx
cmp al, 0x64
jae 0x47f7c3
mov byte [esp + 0x10], al
jmp 0x47f7f4
mov byte [esp + 0x10], 0x64
jmp 0x47f7f4
lea eax, [ecx + ecx*4]
xor edx, edx
lea eax, [eax + eax*4]
shl eax, 2
div dword [ebx + 0x42d8]
cmp al, 0x64
jae 0x47f7c3
mov byte [esp + 0x10], al
jmp 0x47f7f4
xor edx, edx
add eax, 0x1a
mov byte [esp + 0x10], 0xff
mov dword [eax], edx
mov dword [eax + 4], edx
push 1
push esi
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x40]
push eax
mov ecx, dword [esi + 0x3c]
call fcn.00468220
mov eax, dword [esp + 0xd4]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x38]
push ecx
test eax, eax
push edx
jne 0x47f832
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov eax, dword [esp + 0x30]
push edi
push 2
movsx cx, byte [eax + 0x10]
jmp 0x47f845
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov eax, dword [esp + 0x30]
push edi
push 3
movsx cx, byte [eax + 0x11]
mov dl, byte [ebp + 0x18]
push ecx
mov ecx, dword [esi + 0x3c]
lea eax, [esp + 0xa0]
push edx
push eax
push ebp
call fcn.004703d0
mov eax, dword [esp + 0x18]
mov edi, 1
cmp eax, edi
jne 0x47f906
mov ecx, dword [esp + 0xc4]
mov edx, dword [ecx + 0x11c]
mov al, byte [edx]
cmp al, 0x60
jne 0x47f89a
mov eax, dword [ebx + 0x3f7c]
mov ecx, ebx
push eax
call fcn.00439790
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa8
ret 0x1c
cmp al, 0x3c
jne 0x47f906
cmp dword [esp + 0x28], edi
jne 0x47f906
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x47f906
mov ecx, dword [esp + 0xc8]
mov dl, byte [ecx + 0x20]
and dl, 0x10
cmp dl, 0x10
jne 0x47f8d1
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x64
idiv ecx
cmp edx, 0x1e
jge 0x47f906
cmp dword [esi + 0xb8], edi
je 0x47f8f6
mov ecx, esi
call fcn.00476da0
test eax, eax
jne 0x47f8f6
mov ecx, esi
call fcn.00476de0
test eax, eax
jne 0x47f8f6
push edi
push eax
push eax
push 0x14
jmp 0x47f8fd
push edi
push 0
push 0
push 5
push 0xe
mov ecx, ebx
call fcn.0042b2d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa8
ret 0x1c