Function at 0x1009bf30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e9940
mov eax, dword fs:[0]
push eax
sub esp, 0x388
mov eax, dword [0x10122094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x2d0], ebx
mov eax, dword [0x1012f414]
mov esi, dword [eax]
mov dword [ebp - 0x2d4], esi
call fcn.10036850
mov dword [ebp - 0x2ac], eax
test esi, esi
je 0x1009d74e
test eax, eax
je 0x1009d74e
cmp dword [ebx + 0x1d4], 0
jne 0x1009bfba
push 0
push 0
push str.buffs
push str.buffs.mpq
push 0x10107ba4
push 0x1388
call fcn.10055800
mov dword [ebx + 0x1d4], eax
cmp dword [ebx + 0x1e4], 0
jne 0x1009bfdf
xor edx, edx
mov ecx, str.dataglobalui_spells_buffs24
call fcn.1003c2e0
mov dword [ebx + 0x1d0], eax
mov dword [ebx + 0x1e4], 1
cmp byte [0x10122ea8], 0
je 0x1009c00d
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.GetTickCount64
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1013b548], eax
mov byte [0x10122ea8], 0
jmp 0x1009c012
mov eax, dword [0x1013b548]
test eax, eax
je 0x1009c022
call eax
mov edi, edx
mov dword [ebp - 0x2b8], edx
jmp 0x1009c030
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
mov dword [ebp - 0x2b8], edi
mov esi, eax
mov eax, edi
mov ecx, esi
mov dword [ebp - 0x2c8], esi
sub ecx, dword [ebx + 0x78]
sbb eax, dword [ebx + 0x7c]
cmp byte [ebx + 0x83], 0
jne 0x1009c07d
cmp dword [ebx + 0x68], 6
jge 0x1009c07d
test eax, eax
jne 0x1009c05d
cmp ecx, 0x1388
jbe 0x1009c07d
lea eax, [ebp - 0x2a5]
mov byte [ebp - 0x2a5], 0x40
push eax
push 0
push 1
call fcn.1003b7d0
inc dword [ebx + 0x68]
mov dword [ebx + 0x78], esi
mov dword [ebx + 0x7c], edi
cmp dword [ebx + 0x50], 0
je 0x1009c133
mov edi, dword [ebx + 0x4c]
mov eax, edi
mov edx, dword [ebx + 0x48]
mov ecx, edi
shr eax, 2
dec edx
and edx, eax
and ecx, 3
mov eax, dword [ebx + 0x44]
mov eax, dword [eax + edx*4]
mov esi, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x2b8]
sub ecx, dword [esi + 0x18]
sbb eax, dword [esi + 0x1c]
mov dword [ebp - 0x1d4], eax
jne 0x1009c0c5
cmp ecx, 0x1388
jbe 0x1009c133
add dword [ebx + 0x50], 0xffffffff
jne 0x1009c0d4
mov dword [ebx + 0x4c], 0
jmp 0x1009c0da
lea eax, [edi + 1]
mov dword [ebx + 0x4c], eax
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x1009c10d
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x1009c103
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d76a
mov eax, edx
push ecx
push eax
call fcn.100b4eda
add esp, 8
push 0x20
push esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.100b4eda
add esp, 8
cmp dword [ebx + 0x50], 0
jne 0x1009c087
mov edx, dword [ebx + 0x40]
mov ecx, 0x22
mov edi, dword [ebx + 0x4c]
mov dword [ebp - 0x2c4], edx
mov eax, dword [ebx + 0x50]
add eax, dword [ebx + 0x4c]
cmp edi, eax
je 0x1009c1f9
mov eax, dword [0x1012f418]
mov eax, dword [eax]
shr eax, 1
mov dword [ebp - 0x2b4], eax
mov eax, dword [0x1012f404]
mov esi, dword [eax]
shr esi, 1
add esi, ecx
add ecx, 0x22
mov dword [ebp - 0x2c0], ecx
test edx, edx
je 0x1009c17d
mov eax, dword [edx]
jmp 0x1009c17f
xor eax, eax
mov edx, dword [eax + 8]
mov ecx, edi
mov dword [ebp - 0x2bc], eax
dec edx
mov eax, edi
and ecx, 3
shr eax, 2
and edx, eax
mov eax, dword [ebp - 0x2bc]
mov eax, dword [eax + 4]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + ecx*4]
cmp dword [eax + 0x14], 0x10
jb 0x1009c1ac
mov eax, dword [eax]
push eax
sub esp, 0x18
mov ecx, esp
push 0xf
push str._s_has_expired_
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1003f030
push 1
push 3
push 1
push esi
push dword [ebp - 0x2b4]
call fcn.10058b30
mov ecx, dword [ebp - 0x2c0]
add esp, 0x30
mov edx, dword [ebp - 0x2c4]
inc edi
jmp 0x1009c144
push 0x12
mov dword [ebp - 0x1f4], 0
lea ecx, [ebp - 0x1f4]
push str.Quest_Drop_Warning
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
call fcn.1003f030
lea eax, [ebp - 0x1f4]
mov dword [ebp - 4], 0
mov ecx, dword [0x1012f0d8]
push eax
call fcn.1005ae70
mov al, byte [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1e0]
mov byte [ebp - 0x2a5], al
cmp edx, 0x10
jb 0x1009c299
mov ecx, dword [ebp - 0x1f4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009c289
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d76a
push edx
push ecx
call fcn.100b4eda
mov al, byte [ebp - 0x2a5]
add esp, 8
test al, al
je 0x1009c4cd
mov eax, dword [ebp - 0x2d4]
mov esi, dword [ebp - 0x2ac]
push 0
push 0xe
movzx eax, byte [eax + 0x1eb]
and eax, 0x20
mov dword [ebp - 0x1dc], str.Mephisto
push esi
mov dword [ebp - 0x1d8], str.Diablo
mov dword [ebp - 0x1d4], str.Baal
mov dword [ebp - 0x2c4], eax
call fcn.1003b320
push 0
push 0x16
push esi
mov ebx, eax
call fcn.1003b320
push 0
push 0x1a
push esi
mov dword [ebp - 0x2bc], eax
call fcn.1003b320
push 0
push 0x28
push esi
mov dword [ebp - 0x2b0], eax
call fcn.1003b320
push 9
push 0x16
push esi
mov dword [ebp - 0x2cc], eax
call fcn.1003b320
push 7
push 0x16
push esi
mov edi, eax
call fcn.1003b320
push 6
push 0x16
push esi
or edi, eax
call fcn.1003b320
push 4
push 0x16
push dword [ebp - 0x2ac]
mov esi, eax
or esi, edi
call fcn.1003b320
push 3
push 0x16
push dword [ebp - 0x2ac]
mov edi, eax
or edi, esi
call fcn.1003b320
push 2
mov esi, eax
push 0x16
or esi, edi
mov edi, dword [ebp - 0x2ac]
push edi
call fcn.1003b320
push 3
push 0x1a
or eax, esi
push edi
mov dword [ebp - 0x2c0], eax
call fcn.1003b320
push 2
push 0x1a
push edi
mov esi, eax
call fcn.1003b320
push 3
push 0x28
push edi
or esi, eax
call fcn.1003b320
push 2
push 0x28
mov dword [ebp - 0x2b4], eax
push edi
call fcn.1003b320
mov ecx, dword [ebp - 0x2b4]
or ecx, eax
test ebx, ebx
je 0x1009c3e2
cmp dword [ebp - 0x2c0], 0
je 0x1009c3e2
cmp dword [ebp - 0x2bc], 0
jne 0x1009c3eb
mov ebx, dword [ebp - 0x2d0]
cmp byte [ebx + 0x80], 0
jne 0x1009c415
lea edi, [ebp - 0x1dc]
jmp 0x1009c458
cmp dword [ebp - 0x2bc], 0
je 0x1009c40f
mov eax, dword [ebp - 0x2b0]
mov ebx, dword [ebp - 0x2d0]
test esi, esi
je 0x1009c41b
test eax, eax
jne 0x1009c41b
cmp byte [ebx + 0x81], al
jne 0x1009c41b
lea edi, [ebp - 0x1d8]
jmp 0x1009c458
mov ebx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x2c4], 0
je 0x1009c4cd
test eax, eax
je 0x1009c4cd
test ecx, ecx
je 0x1009c4cd
cmp dword [ebp - 0x2cc], 0
jne 0x1009c4cd
cmp byte [ebx + 0x82], 0
jne 0x1009c4cd
lea edi, [ebp - 0x1d4]
mov eax, dword [ebp - 0x2c8]
mov edx, eax
sub edx, dword [ebx + 0x70]
mov ecx, dword [ebp - 0x2b8]
mov esi, ecx
sbb esi, dword [ebx + 0x74]
jne 0x1009c4c7
cmp edx, 0x7d0
ja 0x1009c4c7
test esi, esi
jne 0x1009c484
cmp edx, 0x1f4
jbe 0x1009c4cd
push dword [edi]
mov eax, dword [0x1012f418]
sub esp, 0x18
mov ecx, esp
mov esi, dword [eax]
push 0xf
push str._s_Quest_Active
shr esi, 1
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1003f030
push 1
push 3
push 1
push 0x1e
push esi
call fcn.10058b30
add esp, 0x30
jmp 0x1009c4cd
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x74], ecx
call fcn.10036be0
push 0
mov esi, eax
push 0xd
push esi
mov dword [ebp - 0x2c8], esi
call fcn.1003b0e0
push 0
push 0xc
push esi
mov dword [ebx + 0xa4], eax
call fcn.1003b0e0
mov dword [ebx + 0xa8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [ebx + 0x88]
mov ecx, eax
sub ecx, dword [ebx + 0x60]
mov eax, 0x10624dd3
mul ecx
mov eax, dword [ebx + 0xa8]
shr edx, 6
mov dword [ebp - 0x2b4], edx
mov dword [ebx + 0x64], edx
mov dword [ebp - 0x2b8], edi
mov dword [ebp - 0x2b0], eax
test edi, edi
jne 0x1009c548
mov edi, eax
mov dword [ebp - 0x2b8], eax
mov dword [ebx + 0x88], eax
mov dword [ebp - 0x2b0], edi
push 0xff
lea eax, [ebp - 0x1d0]
push 0
push eax
call fcn.100b7cc0
mov eax, dword [ebx + 0x84]
add esp, 0xc
mov esi, dword [edi*8 + 0x10104278]
mov ecx, esi
mov edi, dword [edi*8 + 0x1010427c]
mov edx, edi
mov dword [ebp - 0x2c0], eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1010ddc0]
movsd qword [ebp - 0x1fc], xmm0
call fcn.100df650
mov edx, dword [ebp - 0x2b8]
movsd xmm2, qword [ebp - 0x1fc]
subsd xmm2, xmm0
mov ecx, dword [edx*8 + 0x10104280]
mov edx, dword [edx*8 + 0x10104284]
sub ecx, esi
sbb edx, edi
movsd qword [ebp - 0x1fc], xmm2
call fcn.100df650
movsd xmm1, qword [ebp - 0x1fc]
divsd xmm1, xmm0
mov ecx, dword [ebx + 0xa4]
mov eax, dword [ebp - 0x2b0]
mov esi, dword [eax*8 + 0x10104278]
mov edi, dword [eax*8 + 0x1010427c]
mov eax, ecx
mov edx, edi
shr eax, 0x1f
movd xmm0, ecx
mov ecx, esi
mulsd xmm1, qword [0x1010dd60]
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x1fc], xmm1
addsd xmm0, qword [eax*8 + 0x1010ddc0]
movsd qword [ebp - 0x1d8], xmm0
call fcn.100df650
mov ecx, dword [ebp - 0x2b0]
movsd xmm1, qword [ebp - 0x1d8]
subsd xmm1, xmm0
mov ecx, dword [ecx*8 + 0x10104280]
sub ecx, esi
mov esi, dword [ebp - 0x2b0]
movsd qword [ebp - 0x1d8], xmm1
mov edx, dword [esi*8 + 0x10104284]
sbb edx, edi
call fcn.100df650
movsd xmm3, qword [ebp - 0x1d8]
divsd xmm3, xmm0
mov eax, dword [ebp - 0x2b8]
movsd xmm4, qword [0x1010dd60]
movsd xmm2, qword [ebp - 0x1fc]
mulsd xmm3, xmm4
movsd qword [ebp - 0x1d8], xmm3
movaps xmm0, xmm3
subsd xmm0, xmm2
movsd qword [ebx + 0xb0], xmm0
cmp esi, eax
jle 0x1009c6c8
sub esi, eax
movaps xmm0, xmm4
dec esi
subsd xmm0, xmm2
imul eax, esi, 0x64
addsd xmm0, xmm3
movd xmm1, eax
cvtdq2pd xmm1, xmm1
addsd xmm1, xmm0
movsd qword [ebx + 0xb0], xmm1
mov eax, dword [ebp - 0x2b4]
xorps xmm2, xmm2
test eax, eax
je 0x1009c70f
mov ecx, dword [ebx + 0xa4]
sub ecx, dword [ebp - 0x2c0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
shr ecx, 0x1f
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1010ddc0]
addsd xmm1, qword [ecx*8 + 0x1010ddc0]
divsd xmm1, xmm0
jmp 0x1009c712
xorps xmm1, xmm1
movsd xmm0, qword [0x1010dd78]
mov eax, 0x101038b3
comisd xmm1, xmm0
movsd qword [ebx + 0xb8], xmm1
jbe 0x1009c734
mov eax, 0x10103bbc
jmp 0x1009c75c
movsd xmm0, qword [0x1010dd70]
comisd xmm1, xmm0
jbe 0x1009c749
mov eax, 0x10103c3c
jmp 0x1009c75c
movsd xmm0, qword [0x1010dd68]
comisd xmm1, xmm0
jbe 0x1009c760
mov eax, 0x10103c24
divsd xmm1, xmm0
push eax
sub esp, 8
mov esi, 0x10103ffc
comisd xmm1, xmm2
mov eax, esi
mov edi, 0x101038b3
movsd qword [esp], xmm1
cmovb eax, edi
push eax
lea eax, [ebp - 0x50]
push str._s_.2f_s_s
push eax
call fcn.10055870
add esp, 0x18
mov dword [ebp - 0x1f4], 0
lea ecx, [ebp - 0x1f4]
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
push 0x10
push str.Experience_Meter
call fcn.1003f030
lea eax, [ebp - 0x1f4]
mov dword [ebp - 4], 1
push eax
mov ecx, 0x1012f3f8
call fcn.1005ae70
mov al, byte [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1e0]
mov byte [ebp - 0x2a5], al
cmp edx, 0x10
jb 0x1009c82d
mov ecx, dword [ebp - 0x1f4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009c81d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d76f
push edx
push ecx
call fcn.100b4eda
mov al, byte [ebp - 0x2a5]
add esp, 8
test al, al
je 0x1009c8ca
movsd xmm0, qword [ebx + 0xb0]
lea eax, [ebp - 0x50]
push eax
sub esp, 8
lea eax, [ebp - 0x1d0]
xorps xmm1, xmm1
comisd xmm0, xmm1
movsd qword [esp], xmm0
movsd xmm0, qword [ebp - 0x1d8]
cmovb esi, edi
push esi
sub esp, 8
movsd qword [esp], xmm0
push str._00.2f_____s_00.2f______s_
push eax
call fcn.100a0790
mov eax, dword [0x1012f404]
add esp, 0x20
mov edi, dword [eax]
mov eax, dword [0x1012f418]
sub edi, 0x3c
mov esi, dword [eax]
lea eax, [ebp - 0x1d0]
push eax
sub esp, 0x18
shr esi, 1
mov ecx, esp
sub esi, 0x64
push 2
push 0x10106154
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1003f030
push 0
push 6
push 1
push edi
push esi
call fcn.10058b30
add esp, 0x30
mov eax, dword [ebx + 0x64]
xor edx, edx
mov esi, 0x3c
div esi
push edx
xor edx, edx
div esi
mov eax, 0x91a2b3c5
push edx
mul dword [ebx + 0x64]
lea eax, [ebp - 0x30]
shr edx, 0xb
push edx
push str._.2d:_.2d:_.2d
push 0x14
push eax
call fcn.10048de0
lea eax, [ebp - 0x2e4]
push eax
call fcn.100c7bab
push 0x80
lea eax, [ebp - 0xd0]
push 0
push eax
call fcn.100b7cc0
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.100c77dc
lea eax, [ebp - 0x26c]
push eax
push str._I:_M:_S__p
lea eax, [ebp - 0xd0]
push 0x80
push eax
call fcn.100c7b8c
mov esi, dword [ebx + 0x1d0]
add esp, 0x40
mov dword [ebp - 0x2b8], esi
test esi, esi
je 0x1009cdd9
cmp dword [ebx + 0x1d8], 0
je 0x1009cb55
mov eax, dword [ebx + 0x1f8]
xor ecx, ecx
mov edx, dword [ebx + 0x1f4]
mov dword [ebp - 0x2ac], ecx
mov dword [ebp - 0x2b8], esi
sub eax, edx
je 0x1009cb4b
lea edi, [ebx + 0x1e8]
movzx eax, byte [edx + ecx]
push eax
push dword [ebp - 0x2c8]
call fcn.1003b110
mov edi, dword [edi + 4]
xor esi, esi
mov ecx, dword [ebx + 0x1e8]
mov edx, edi
mov dword [ebp - 0x2cc], eax
sub edx, ecx
mov eax, 0x2aaaaaab
mov dword [ebp - 0x2c0], 0
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0x2ac]
mov dword [ebp - 0x2b4], eax
je 0x1009ca3a
mov eax, dword [ebx + 0x1f4]
mov al, byte [edx + eax]
mov edx, dword [ebx + 0x1ec]
mov byte [ebp - 0x2a5], al
xor eax, eax
mov dword [ebp - 0x2bc], edx
nop dword [eax]
mov dl, byte [ebp - 0x2a5]
cmp byte [eax + ecx], dl
mov edx, dword [ebp - 0x2ac]
je 0x1009ca2d
inc esi
mov dword [ebp - 0x2bc], edi
add eax, 0xc
cmp esi, dword [ebp - 0x2b4]
jb 0x1009ca00
mov eax, dword [ebp - 0x2c0]
mov esi, eax
jmp 0x1009ca3e
mov edi, dword [ebp - 0x2bc]
mov eax, 1
jmp 0x1009ca3e
xor eax, eax
xor esi, esi
cmp dword [ebp - 0x2cc], 0
je 0x1009caf0
test eax, eax
jne 0x1009cb16
cmp dword [ebx + 0x1dc], 0
xorps xmm0, xmm0
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebx + 0x1f4]
movq qword [ebp - 0x200], xmm0
mov dword [ebp - 0x1fc], edx
mov al, byte [edx + eax]
mov byte [ebp - 0x200], al
je 0x1009caac
cmp al, 0x1c
jne 0x1009caac
push 0
push 0x27
push dword [ebp - 0x2c8]
call fcn.1003b0e0
xor ecx, ecx
mov dword [ebx + 0x1dc], 0
cmp eax, dword [ebx + 0x1e0]
setge cl
jmp 0x1009cab3
cmp edx, 0x27
sbb ecx, ecx
neg ecx
mov eax, dword [ebx + 0x1ec]
lea edi, [ebx + 0x1e8]
mov dword [ebp - 0x1f8], ecx
cmp eax, dword [edi + 8]
je 0x1009cadf
movq xmm0, qword [ebp - 0x200]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
add dword [edi + 4], 0xc
jmp 0x1009cb1c
lea ecx, [ebp - 0x200]
push ecx
push eax
mov ecx, edi
call fcn.100a0a40
jmp 0x1009cb1c
test eax, eax
je 0x1009cb16
lea eax, [esi + esi*2]
lea ecx, [ecx + eax*4]
lea eax, [ecx + 0xc]
sub edi, eax
push edi
push eax
push ecx
call fcn.100b7730
lea edi, [ebx + 0x1e8]
add esp, 0xc
add dword [edi + 4], 0xfffffff4
jmp 0x1009cb1c
lea edi, [ebx + 0x1e8]
mov ecx, dword [ebp - 0x2ac]
mov eax, dword [ebx + 0x1f8]
inc ecx
mov edx, dword [ebx + 0x1f4]
sub eax, edx
mov dword [ebp - 0x2ac], ecx
cmp ecx, eax
jb 0x1009c993
mov esi, dword [ebx + 0x1d0]
mov dword [ebp - 0x2b8], esi
mov dword [ebx + 0x1d8], 0
mov eax, dword [0x1012f400]
mov edi, dword [ebx + 0x1e8]
mov dword [ebp - 0x2b0], 0x75
mov eax, dword [eax]
mov dword [ebp - 0x2c0], eax
mov eax, dword [0x1012f408]
mov eax, dword [eax]
mov dword [ebp - 0x1f8], eax
mov eax, dword [0x1012f418]
mov edx, dword [eax]
mov eax, dword [0x1012f404]
mov ecx, dword [eax]
lea eax, [esi + 0x18]
mov dword [ebp - 0x2b4], eax
xor esi, esi
mov eax, dword [eax]
mov dword [ebp - 0x2c4], esi
sub edx, dword [eax + 4]
lea eax, [ecx - 0x31]
xor ecx, ecx
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x2dc], eax
sub edx, 0x75
mov dword [ebp - 0x2bc], ecx
mov eax, 0x2aaaaaab
mov ecx, dword [ebx + 0x1ec]
sub ecx, edi
mov dword [ebp - 0x2cc], edx
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1009cdc4
xor ecx, ecx
mov dword [ebp - 0x2ac], ecx
nop dword [eax]
mov eax, 0x38e38e39
mov ecx, esi
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*8]
sub ecx, eax
jne 0x1009cc2b
test esi, esi
je 0x1009cc2b
mov eax, dword [ebp - 0x2b4]
or ecx, 0xffffffff
mov dword [ebp - 0x2b0], 0x75
mov eax, dword [eax]
sub ecx, dword [eax + 8]
add dword [ebp - 0x2d8], ecx
mov ecx, dword [ebp - 0x2ac]
xorps xmm0, xmm0
mov esi, dword [ebp - 0x2cc]
movlpd qword [ebp - 0x2a0], xmm0
movlpd qword [ebp - 0x298], xmm0
movlpd qword [ebp - 0x290], xmm0
movlpd qword [ebp - 0x288], xmm0
movlpd qword [ebp - 0x280], xmm0
movlpd qword [ebp - 0x278], xmm0
mov eax, dword [edi + ecx + 4]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x270], eax
mov eax, dword [edi + ecx + 8]
test eax, eax
mov edi, dword [ebp - 0x2dc]
cmovne edi, dword [ebp - 0x2d8]
setne al
cmovne esi, dword [ebp - 0x2b0]
mov dword [ebp - 0x2b4], esi
lea eax, [eax*2 + 1]
push eax
push 5
push 0xffffffffffffffff
push edi
push esi
lea eax, [ebp - 0x2a4]
push eax
call fcn.1003b950
cmp dword [ebp - 0x2c0], esi
jbe 0x1009cd35
mov eax, dword [ebx + 0x1d0]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 4]
lea eax, [ecx + esi]
cmp dword [ebp - 0x2c0], eax
jae 0x1009cd35
mov eax, dword [ebp - 0x1f8]
mov esi, edi
sub esi, dword [edx + 8]
cmp eax, esi
jbe 0x1009cd35
cmp eax, edi
jae 0x1009cd35
mov eax, dword [ebx + 0x1e8]
shr ecx, 1
add dword [ebp - 0x2b4], ecx
mov ecx, dword [ebp - 0x2ac]
mov ecx, dword [eax + ecx + 4]
mov eax, dword [ebx + 0x200]
mov edi, dword [eax + ecx*4]
mov ecx, edi
call fcn.1003c3d0
push 0
cdq
add esi, 0xfffffffe
sub eax, edx
mov ecx, edi
mov edx, dword [ebp - 0x2b4]
push 1
push 0
sar eax, 1
push esi
sub edx, eax
call fcn.1003c370
mov eax, dword [ebx + 0x1d0]
mov edi, dword [ebx + 0x1e8]
add eax, 0x18
mov ecx, dword [ebp - 0x2ac]
mov esi, dword [ebp - 0x2c4]
mov dword [ebp - 0x2b4], eax
mov eax, dword [eax]
cmp dword [edi + ecx + 8], 0
mov edx, dword [eax + 4]
je 0x1009cd7a
mov eax, dword [ebp - 0x2b0]
inc eax
add eax, edx
inc esi
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2c4], esi
jmp 0x1009cd85
or eax, 0xffffffff
sub eax, edx
add dword [ebp - 0x2cc], eax
inc dword [ebp - 0x2bc]
add ecx, 0xc
mov dword [ebp - 0x2ac], ecx
mov eax, 0x2aaaaaab
mov ecx, dword [ebx + 0x1ec]
sub ecx, edi
imul ecx
mov ecx, dword [ebx + 0x1d0]
sar edx, 1
mov eax, edx
mov dword [ebp - 0x2b8], ecx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x2bc], eax
jb 0x1009cbf0
push 0
push 0x27
push dword [ebp - 0x2c8]
call fcn.1003b0e0
mov dword [ebx + 0x1e0], eax
mov eax, dword [ebp - 0x2c8]
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x58]
mov ecx, dword [ecx + 0x1d0]
call fcn.100557c0
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
push 0
push str.___t1y
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0x4e4
call edi
mov esi, eax
push esi
call fcn.100b554a
add esp, 4
mov dword [ebp - 0x1f8], eax
push 0
push str.___t1y
push esi
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0x4e4
call edi
call fcn.10036be0
mov esi, eax
test esi, esi
je 0x1009d74e
mov ecx, dword [0x1012f40c]
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
mov word [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
push dword [ecx]
push 0x1010523c
push 0xa
push eax
call fcn.10048de0
mov eax, dword [esi + 0x2c]
add esp, 0x10
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x58]
mov ecx, dword [eax + 0x1d0]
mov eax, dword [0x1012f3f4]
imul esi, ecx, 0x220
mov eax, dword [eax]
add esi, dword [eax + 0xc58]
mov eax, dword [ebp - 0x2d4]
test byte [eax + 0x1eb], 0x20
je 0x1009ceb6
call fcn.10036b50
movzx eax, al
movzx eax, word [esi + eax*2 + 0x16]
jmp 0x1009cec3
call fcn.10036b50
movzx eax, al
movzx eax, word [esi + eax*2 + 0x10]
mov edi, dword [ebp - 0x2d0]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x2d4], eax
mov edx, dword [edi + 0xa8]
call fcn.10071070
mov esi, eax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x1f4]
push 0x10
mov dword [ebp - 0x1f4], 0
lea ebx, [edi + 0x1ac]
push str.CURRENTCHARLEVEL
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
call fcn.1003f030
push esi
lea eax, [ebp - 0x1f4]
mov byte [ebp - 4], 3
push eax
mov ecx, ebx
call fcn.100a0120
mov ecx, eax
call fcn.1004eec0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1e0]
cmp edx, 0x10
jb 0x1009cf7e
mov ecx, dword [ebp - 0x1f4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009cf74
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d774
push edx
push ecx
call fcn.100b4eda
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x204]
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
cmp edx, 0x10
jb 0x1009cfda
mov ecx, dword [ebp - 0x218]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009cfd0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d774
push edx
push ecx
call fcn.100b4eda
add esp, 8
movsd xmm1, qword [ebp - 0x1d8]
lea ecx, [ebp - 0x218]
divsd xmm1, qword [0x1010dd60]
movd xmm0, dword [edi + 0xa8]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
call fcn.10098010
mov esi, eax
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x1f4]
push 0x17
mov dword [ebp - 0x1f4], 0
push str.CURRENTCHARLEVELPERCENT
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
call fcn.1003f030
push esi
lea eax, [ebp - 0x1f4]
mov byte [ebp - 4], 5
push eax
mov ecx, ebx
call fcn.100a0120
mov ecx, eax
call fcn.1004eec0
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x1e0]
cmp edx, 0x10
jb 0x1009d09d
mov ecx, dword [ebp - 0x1f4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009d093
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d779
push edx
push ecx
call fcn.100b4eda
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x204]
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
cmp edx, 0x10
jb 0x1009d0f9
mov ecx, dword [ebp - 0x218]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009d0ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d779
push edx
push ecx
call fcn.100b4eda
add esp, 8
movsd xmm1, qword [ebp - 0x1d8]
lea ecx, [ebp - 0x218]
call fcn.10098010
mov esi, eax
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x1f4]
push 0x14
mov dword [ebp - 0x1f4], 0
push str.CURRENTCHARXPPERCENT
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
call fcn.1003f030
push esi
lea eax, [ebp - 0x1f4]
mov byte [ebp - 4], 7
push eax
mov ecx, ebx
call fcn.100a0120
mov ecx, eax
call fcn.1004eec0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x1e0]
cmp edx, 0x10
jb 0x1009d1a4
mov ecx, dword [ebp - 0x1f4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009d19a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d77e
push edx
push ecx
call fcn.100b4eda
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x204]
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
cmp edx, 0x10
jb 0x1009d200
mov ecx, dword [ebp - 0x218]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009d1f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d77e
push edx
push ecx
call fcn.100b4eda
add esp, 8
mov edx, dword [edi + 0xa4]
lea ecx, [ebp - 0x218]
call fcn.10071120
mov esi, eax
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x1f4]
push 0xd
mov dword [ebp - 0x1f4], 0
push str.CURRENTCHARXP
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
call fcn.1003f030
push esi
lea eax, [ebp - 0x1f4]
mov byte [ebp - 4], 9
push eax
mov ecx, ebx
call fcn.100a0120
mov ecx, eax
call fcn.1004eec0
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x1e0]
cmp edx, 0x10
jb 0x1009d2a9
mov ecx, dword [ebp - 0x1f4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009d29f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d783
push edx
push ecx
call fcn.100b4eda
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x204]
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
cmp edx, 0x10
jb 0x1009d305
mov ecx, dword [ebp - 0x218]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009d2fb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d783
push edx
push ecx
call fcn.100b4eda
add esp, 8
push 5
mov dword [ebp - 0x1f4], 0
lea ecx, [ebp - 0x1f4]
push str.LEVEL
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
call fcn.1003f030
lea eax, [ebp - 0x1f4]
mov dword [ebp - 4], 0xa
push eax
mov ecx, ebx
call fcn.100a0120
mov esi, dword [ebp - 0x1f8]
mov edx, esi
lea ecx, [edx + 1]
mov dword [ebp - 0x1f8], ecx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x1009d362
sub edx, dword [ebp - 0x1f8]
mov ecx, eax
push edx
push esi
call fcn.1003f030
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1e0]
cmp edx, 0x10
jb 0x1009d3b9
mov ecx, dword [ebp - 0x1f4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009d3af
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d788
push edx
push ecx
call fcn.100b4eda
add esp, 8
push 4
mov dword [ebp - 0x1f4], 0
lea ecx, [ebp - 0x1f4]
push str.PING
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
call fcn.1003f030
lea eax, [ebp - 0x1f4]
mov dword [ebp - 4], 0xb
push eax
mov ecx, ebx
call fcn.100a0120
lea ecx, [ebp - 0x1c]
mov edx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x1f8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1009d413
sub ecx, dword [ebp - 0x1f8]
lea eax, [ebp - 0x1c]
push ecx
push eax
mov ecx, edx
call fcn.1003f030
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1e0]
cmp edx, 0x10
jb 0x1009d46d
mov ecx, dword [ebp - 0x1f4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009d463
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d78d
push edx
push ecx
call fcn.100b4eda
add esp, 8
push 8
mov dword [ebp - 0x1f4], 0
lea ecx, [ebp - 0x1f4]
push str.GAMETIME
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
call fcn.1003f030
lea eax, [ebp - 0x1f4]
mov dword [ebp - 4], 0xc
push eax
mov ecx, ebx
call fcn.100a0120
lea ecx, [ebp - 0x30]
mov edx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x1f8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1009d4c7
sub ecx, dword [ebp - 0x1f8]
lea eax, [ebp - 0x30]
push ecx
push eax
mov ecx, edx
call fcn.1003f030
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1e0]
cmp edx, 0x10
jb 0x1009d521
mov ecx, dword [ebp - 0x1f4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009d517
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d792
push edx
push ecx
call fcn.100b4eda
add esp, 8
push 8
mov dword [ebp - 0x1f4], 0
lea ecx, [ebp - 0x1f4]
push str.REALTIME
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0xf
mov byte [ebp - 0x1f4], 0
call fcn.1003f030
lea eax, [ebp - 0x1f4]
mov dword [ebp - 4], 0xd
push eax
mov ecx, ebx
call fcn.100a0120
lea ecx, [ebp - 0xd0]
mov edx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x1f8], eax
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1009d580
sub ecx, dword [ebp - 0x1f8]
lea eax, [ebp - 0xd0]
push ecx
push eax
mov ecx, edx
call fcn.1003f030
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1e0]
cmp edx, 0x10
jb 0x1009d5dd
mov ecx, dword [ebp - 0x1f4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009d5d3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d797
push edx
push ecx
call fcn.100b4eda
add esp, 8
push ecx
lea ecx, [ebp - 0x394]
call fcn.1004da50
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x384]
mov dword [ebp - 4], 0xe
call fcn.100a11b0
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x37c]
call fcn.1004fb90
lea ecx, [ebp - 0x394]
call fcn.1004a9c0
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0x230]
push 9
mov dword [ebp - 0x230], 0
push str.AREALEVEL
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
call fcn.1003f030
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.100a0120
mov ecx, eax
call fcn.1004eec0
mov edx, dword [ebp - 0x21c]
cmp edx, 0x10
jb 0x1009d6b6
mov ecx, dword [ebp - 0x230]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009d6ac
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d79c
push edx
push ecx
call fcn.100b4eda
add esp, 8
mov edx, dword [ebp - 0x234]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
cmp edx, 0x10
jb 0x1009d70b
mov ecx, dword [ebp - 0x248]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009d701
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d79c
push edx
push ecx
call fcn.100b4eda
add esp, 8
mov eax, dword [0x1012f410]
xor ecx, ecx
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
mov eax, dword [eax]
test eax, eax
je 0x1009d73e
mov eax, dword [eax + 0x80]
inc ecx
test eax, eax
jne 0x1009d733
inc dword [edi + ecx*4 + 0x140]
push esi
call fcn.100b4f0b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b4e9c
mov esp, ebp
pop ebp
ret
call fcn.100ba49f
call fcn.100ba49f
call fcn.100ba49f
call fcn.100ba49f
call fcn.100ba49f
call fcn.100ba49f
call fcn.100ba49f
call fcn.100ba49f
call fcn.100ba49f
call fcn.100ba49f
call fcn.100ba49f
int3