Function at 0x10004830
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001215e
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10024330]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.1000b280
cmp eax, 1
jne 0x10004877
mov ecx, dword [ebp + 8]
push 0x100156f0
call dword [sym.imp.mfc140.dll_Ordinal_310]
jmp 0x10004dc8
push 0x10016324
push 1
call fcn.1000c220
add esp, 8
lea ecx, [ebp - 0x10]
push 0x100156f0
call dword [sym.imp.mfc140.dll_Ordinal_310]
lea ecx, [ebx + 0xd0]
mov dword [ebp - 4], 0
call fcn.1000d890
mov esi, eax
test esi, esi
je 0x10004db2
push 0x100248c8
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
push esi
call fcn.10003830
push 0x100248c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x10016334
push 1
call fcn.1000c220
mov eax, dword [ebx + 0xbc]
add esp, 8
mov ecx, dword [ebx + 0xb8]
mov edx, eax
sub edx, ecx
sar edx, 2
test edx, edx
je 0x10004b63
push eax
push ecx
call fcn.10002db0
push str.random_shuffle
push 1
call fcn.1000c220
mov eax, dword [ebx + 0xbc]
add esp, 0x10
mov esi, dword [ebx + 0xb8]
sub eax, esi
sar eax, 2
test eax, eax
je 0x10004ddf
mov esi, dword [esi]
push str.IHTMLAnchorElement
push 1
call fcn.1000c220
mov eax, dword [esi]
lea ecx, [ebp - 0x1c]
add esp, 8
push ecx
push esi
call dword [eax + 0x20]
test eax, eax
js 0x10004adf
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140.dll_Ordinal_306]
push 0x10016380
push 1
mov byte [ebp - 4], 1
call fcn.1000c220
push dword [ebp - 0x14]
push 1
call fcn.1000c220
mov eax, dword [esi]
lea ecx, [ebp - 0x20]
add esp, 0x10
push ecx
push 0x1001ac54
push esi
call dword [eax]
test eax, eax
js 0x10004ad2
push str.QueryInterface_IID_IHTMLElement
push 1
call fcn.1000c220
add esp, 4
lea eax, [ebp - 0x14]
mov ecx, esp
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
push 0x100248e0
mov ecx, ebx
call fcn.100037b0
cmp eax, 1
jne 0x10004a9d
push 0x130
call sub.mfc140.dll_Ordinal_1507
add esp, 4
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x100049e9
push 0
mov ecx, eax
call fcn.100015e0
mov esi, eax
jmp 0x100049eb
xor esi, esi
mov eax, dword [esi]
mov ecx, esi
push 0
push 0x3ec
mov byte [ebp - 4], 1
call dword [eax + 0x16c]
push 0
mov ecx, esi
call sub.mfc140.dll_Ordinal_14149
push 1
push 0
push 0
push 0
push 0
mov ecx, esi
call sub.mfc140.dll_Ordinal_8776
push ecx
lea eax, [ebx + 0xac]
mov dword [ebp - 0x24], esp
mov ecx, esp
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x28], esp
mov ecx, esp
mov byte [ebp - 4], 3
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
push ecx
lea eax, [ebx + 0xa8]
mov dword [ebp - 0x2c], esp
mov ecx, esp
mov byte [ebp - 4], 4
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
push ecx
mov ecx, esp
mov byte [ebp - 4], 5
push 0x100156f0
call dword [sym.imp.mfc140.dll_Ordinal_310]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.10002090
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1526]
push 0x100163bc
push 1
call fcn.1000c220
push dword [ebp - 0x10]
push 1
call fcn.1000c220
add esp, 0x10
jmp 0x10004ad2
push 0x100163d4
push 1
call fcn.1000c220
mov eax, dword [ebp - 0x20]
add esp, 8
mov ecx, dword [eax]
push eax
call dword [ecx + 0x114]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1526]
push dword [ebp - 0x10]
push 1
call fcn.1000c220
add esp, 8
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push str.lpElement__Release___
push 1
call fcn.1000c220
push str.click
push 1
call fcn.1000c220
mov eax, dword [ebx + 0xbc]
add esp, 0x10
mov ecx, dword [ebx + 0xb8]
xor esi, esi
sub eax, ecx
sar eax, 2
test eax, eax
je 0x10004b43
mov edi, dword [ecx + esi*4]
test edi, edi
je 0x10004b2d
push str.pElem__Release___
push 1
call fcn.1000c220
mov eax, dword [edi]
add esp, 8
push edi
call dword [eax + 8]
mov eax, dword [ebx + 0xbc]
inc esi
mov ecx, dword [ebx + 0xb8]
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x10004b11
push str.m_Elevec.clear__
push 1
call fcn.1000c220
mov eax, dword [ebx + 0xb8]
add esp, 8
mov dword [ebx + 0xbc], eax
jmp 0x10004c8c
mov eax, dword [ebx + 0xc8]
sub eax, dword [ebx + 0xc4]
sar eax, 2
test eax, eax
je 0x10004c8c
push 0x10016448
push 1
call fcn.1000c220
push dword [ebx + 0xc8]
push dword [ebx + 0xc4]
call fcn.10002dd0
mov eax, dword [ebx + 0xc8]
add esp, 0x10
mov ecx, dword [ebx + 0xc4]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x10004de4
push ecx
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140.dll_Ordinal_300]
push 0x130
mov byte [ebp - 4], 6
call sub.mfc140.dll_Ordinal_1507
add esp, 4
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x10004be6
push 0
mov ecx, eax
call fcn.100015e0
mov esi, eax
jmp 0x10004be8
xor esi, esi
mov eax, dword [esi]
mov ecx, esi
push 0
push 0x3ec
mov byte [ebp - 4], 6
call dword [eax + 0x16c]
push 0
mov ecx, esi
call sub.mfc140.dll_Ordinal_14149
push 1
push 0
push 0
push 0
push 0
mov ecx, esi
call sub.mfc140.dll_Ordinal_8776
push ecx
lea eax, [ebx + 0xac]
mov dword [ebp - 0x30], esp
mov ecx, esp
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x2c], esp
mov ecx, esp
mov byte [ebp - 4], 8
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
push ecx
lea eax, [ebx + 0xa8]
mov dword [ebp - 0x28], esp
mov ecx, esp
mov byte [ebp - 4], 9
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xa
push 0x100156f0
call dword [sym.imp.mfc140.dll_Ordinal_310]
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.10002090
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1526]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push 0x100156f0
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x10004d64
mov eax, dword [ebx + 0xb0]
mov eax, dword [eax - 0xc]
sub eax, 2
cmp eax, 4
ja 0x10004d46
push 0x10016480
push 1
call fcn.1000c220
push dword [ebx + 0xb0]
push 1
call fcn.1000c220
push dword [ebp - 0x10]
push 1
call fcn.1000c220
push dword [ebx + 0xb4]
lea edi, [ebx + 0xb4]
push 1
call fcn.1000c220
add esp, 0x1c
mov dword [ebp - 0x30], esp
mov esi, esp
push ecx
mov ecx, esp
push edi
call dword [sym.imp.mfc140.dll_Ordinal_300]
push esi
call fcn.1000ccb0
add esp, 4
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x10]
mov esi, esp
push ecx
mov ecx, esp
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
push esi
call fcn.1000ccb0
add esp, 4
mov byte [ebp - 4], 0xc
lea eax, [ebx + 0xb0]
mov ecx, esp
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
mov byte [ebp - 4], 0
call fcn.1000c690
add esp, 0xc
mov ecx, ebx
call fcn.10003ba0
lea ecx, [ebp - 0x14]
mov esi, eax
call dword [sym.imp.mfc140.dll_Ordinal_316]
push esi
mov byte [ebp - 4], 0xd
push 0x1001649c
jmp 0x10004d80
mov ecx, ebx
call fcn.10003ba0
lea ecx, [ebp - 0x14]
mov esi, eax
call dword [sym.imp.mfc140.dll_Ordinal_316]
push esi
mov byte [ebp - 4], 0xe
push 0x100164c8
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
push dword [ebp - 0x14]
push 1
call fcn.1000c220
add esp, 0x14
push 0
push esi
push 2
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.100047d0
call fcn.100047e0
int3