Function at 0x10039750
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x1009ae40
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100b8070]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x597c4]
cmp ecx, 2
je 0x100397b1
mov eax, 1
mov dword [ebp + 0x74], eax
mov dword [ebp + 0x7c], eax
xor eax, eax
mov dword [ebp + 0x9c], eax
mov dword [ebp + 0xa0], eax
jmp 0x1003aea9
mov ebx, dword [eax + 0x5975c]
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.1001ad10
push ebp
call fcn.10003bc0
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 0x59798]
xor esi, esi
cmp eax, esi
ja 0x10039824
mov ecx, dword [0x100bb2cc]
mov edi, 1
mov dword [ebp + 0x74], edi
mov dword [ebp + 0x7c], edi
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebx + 0xec], esi
mov eax, dword [ebp + 0x14]
add eax, 0x597d0
lea ebx, [esp + 0x50]
mov dword [esp + 0x50], 2
call fcn.1001d970
mov dword [eax], esi
mov dword [ebp + 0xac], esi
mov eax, edi
jmp 0x1003aea9
cmp dword [ebp + 0x7c], esi
je 0x10039835
cmp dword [ebp + 0x78], esi
je 0x10039835
mov eax, 1
jmp 0x10039837
xor eax, eax
mov dword [ebp + 0x74], eax
mov eax, ebp
call fcn.100015c0
cmp dword [ebx + 0x94], esi
jne 0x1003aea4
cmp dword [ebx + 0x98], esi
jne 0x1003aea4
mov eax, dword [ebp + 0x14]
add eax, 0x59790
cmp dword [eax + 8], esi
mov dword [esp + 0x50], eax
jne 0x10039875
push ebx
call fcn.10021900
jmp 0x1003aea4
push ebp
call fcn.10072510
fld dword [ebx + 0x34]
fstp dword [esp + 0x60]
mov edi, eax
cmp edi, esi
fld dword [ebx + 0x30]
fstp dword [esp + 0x5c]
fld dword [ebx + 0x38]
fstp dword [esp + 0x64]
fld dword [ebx + 0x3c]
fstp dword [esp + 0x68]
je 0x10039b93
mov eax, dword [esp + 0x50]
call fcn.10004a40
mov esi, eax
mov dword [esp + 0x4c], eax
call fcn.1006f5f0
mov esi, edi
call fcn.1006f5f0
fld dword [edi + 0xc]
fstp dword [esp + 0x74]
lea eax, [esp + 0x5c]
fld dword [edi + 8]
lea ecx, [esp + 0x70]
fstp dword [esp + 0x70]
fld dword [edi + 0x10]
fstp dword [esp + 0x78]
fld dword [edi + 0x14]
fstp dword [esp + 0x7c]
call fcn.10003a50
fcomp qword [0x100a98b0]
fnstsw ax
test ah, 5
jp 0x10039b93
push str.target
call fcn.1007e0e0
add esp, 4
push edx
push eax
mov eax, edi
call fcn.10038030
test eax, eax
je 0x10039b93
mov ecx, dword [ebx + 0x170]
mov eax, dword [ebx + 0x16c]
push ecx
push eax
mov eax, edi
call fcn.10038030
test eax, eax
je 0x10039b93
mov eax, dword [esp + 0x4c]
call fcn.10003b20
cmp eax, 0xa
jbe 0x10039947
push edi
mov eax, ebp
call fcn.10004780
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0x3c]
cmp eax, 0x3e8
jbe 0x10039b93
lea ecx, [esp + 0x4c]
push ecx
mov ecx, str.Snake_Trap
call fcn.10003700
lea edx, [esp + 0x4c]
lea edi, [ebp + 0x68]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 0
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x100399e9
cmp dword [esi + 0x10], 0
jne 0x100399e9
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x100399e9
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x100399e9
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ecx
jmp 0x10039b81
lea eax, [esp + 0x4c]
push eax
mov ecx, str.Ice_Trap
call fcn.10003700
lea ecx, [esp + 0x4c]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 1
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x10039a7d
cmp dword [esi + 0x10], 0
jne 0x10039a7d
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x10039a7d
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x10039a7d
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx]
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
push edx
mov ecx, ebx
call eax
jmp 0x10039b8a
lea ecx, [esp + 0x4c]
push ecx
mov ecx, str.ExplosiveTrap
call fcn.10003700
lea edx, [esp + 0x4c]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 2
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x10039b05
cmp dword [esi + 0x10], 0
jne 0x10039b05
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x10039b05
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x10039b05
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ecx
jmp 0x10039b81
lea eax, [esp + 0x4c]
push eax
mov ecx, str.ImmolationTrap
call fcn.10003700
lea ecx, [esp + 0x4c]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 3
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov edi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test edi, edi
je 0x10039b93
cmp dword [edi + 0x10], 0
jne 0x10039b93
mov eax, edi
call fcn.10023fd0
test eax, eax
jne 0x10039b93
mov esi, dword [edi]
call fcn.1007e040
test eax, eax
je 0x10039b93
mov eax, dword [edi]
push eax
mov edx, dword [ebx]
mov edx, dword [edx + 0x14]
mov ecx, ebx
call edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x3c], eax
mov eax, dword [esp + 0x50]
call fcn.10004a40
mov esi, eax
mov dword [esp + 0x4c], esi
call fcn.1006f5f0
fld dword [esi + 0xc]
fstp dword [esp + 0x74]
lea eax, [esp + 0x5c]
fld dword [esi + 8]
lea ecx, [esp + 0x70]
fstp dword [esp + 0x70]
fld dword [esi + 0x10]
fstp dword [esp + 0x78]
fld dword [esi + 0x14]
fstp dword [esp + 0x7c]
call fcn.10003a50
fst qword [esp + 0x54]
fcomp qword [0x100a9868]
fnstsw ax
test ah, 5
jp 0x10039c66
fld dword [esp + 0x70]
sub esp, 0x10
fsub dword [esp + 0x6c]
fstp qword [esp + 8]
fld dword [esp + 0x84]
fsub dword [esp + 0x70]
fstp qword [esp]
call fcn.1006ddc0
fstp dword [esp + 0x58]
add esp, 4
fld dword [0x100a982c]
fstp dword [esp + 8]
fld dword [esp + 0x74]
fstp dword [esp + 4]
fld dword [esp + 0x54]
fstp dword [esp]
call fcn.100218b0
add esp, 0xc
test eax, eax
jne 0x10039c40
fld dword [esp + 0x48]
push ecx
fstp dword [esp]
call fcn.10021920
mov edi, dword [esp + 0x4c]
call fcn.10055280
test eax, eax
jne 0x10039c66
mov eax, dword [ebp + 0x14]
push eax
mov eax, edi
call fcn.1001b910
mov eax, dword [esp + 0x50]
call fcn.10004a60
jmp 0x1003aea4
push str.target
call fcn.1007e0e0
mov edi, dword [esp + 0x50]
add esp, 4
push edx
push eax
mov eax, edi
call fcn.1006f910
test eax, eax
je 0x10039cb6
mov ecx, dword [ebx + 0x170]
mov eax, dword [ebx + 0x16c]
push ecx
push eax
mov eax, edi
call fcn.10038030
test eax, eax
je 0x10039cb6
cmp dword [ebx + 0x134], 0
je 0x10039cb6
mov ecx, dword [0x100bb2cc]
mov edx, dword [ecx]
mov eax, dword [edx + 0x8c]
call eax
fld dword [ebx + 0x34]
lea esi, [ebp + 0x24]
fstp dword [esi + 4]
fld dword [ebx + 0x30]
fstp dword [esi]
fld dword [ebx + 0x38]
fstp dword [esi + 8]
mov dword [ebp + 0x34], 0x211
mov eax, dword [edi + 0x44]
mov edi, dword [edi + 0x48]
push edi
push eax
mov eax, ebx
call fcn.10003b80
fld qword [0x100a9870]
test eax, eax
je 0x10039dd2
cmp dword [ebp + 0x74], 0
je 0x10039dd2
fld qword [0x100a9938]
fld qword [esp + 0x54]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x10039d3d
fld dword [esp + 0x74]
mov dword [ebp + 0x34], 0x211
fld dword [esp + 0x60]
fsubr st(1)
fmul st(3)
fdiv st(2)
fsubp st(1)
fstp dword [ebp + 0x28]
fld dword [esp + 0x70]
fld dword [esp + 0x5c]
fsubr st(1)
fmulp st(3)
fxch st(2)
fdivrp st(1)
fsubp st(1)
fstp dword [esi]
jmp 0x10039d8a
fstp st(1)
fld qword [0x100a9930]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x10039d88
fld dword [esp + 0x74]
mov dword [ebp + 0x34], 0x112
fld dword [esp + 0x60]
fsubr st(1)
fld qword [0x100a9818]
fmul st(1), st(0)
fxch st(1)
fdiv st(3)
fsubp st(2)
fxch st(1)
fstp dword [ebp + 0x28]
fld dword [esp + 0x70]
fld dword [esp + 0x5c]
fsubr st(1)
fmulp st(2)
fxch st(1)
fdivrp st(2)
fsubrp st(1)
fstp dword [esi]
jmp 0x10039d8a
fstp st(0)
mov edx, dword [ebp + 0x34]
mov eax, esi
mov ecx, 1
mov esi, ebx
call fcn.10056b10
cmp eax, 2
jne 0x10039e46
mov ecx, dword [ebp + 0x34]
and cl, 0xf
cmp cl, al
jne 0x10039dba
mov dword [ebp + 0x7c], 0
jmp 0x10039e46
mov edx, dword [ebp + 0x14]
mov eax, dword [esp + 0x4c]
push edx
call fcn.1001b910
mov eax, dword [esp + 0x50]
call fcn.10004a60
jmp 0x10039e46
cmp dword [ebp + 0x74], 0
fstp st(0)
jne 0x10039e40
fld qword [0x100a98b0]
fld qword [esp + 0x54]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x10039e29
fld dword [esp + 0x74]
mov dword [ebp + 0x34], 0x211
fld dword [esp + 0x60]
fsubr st(1)
fld qword [0x100a9840]
fmul st(1), st(0)
fxch st(1)
fdiv st(3)
fsubp st(2)
fxch st(1)
fstp dword [ebp + 0x28]
fld dword [esp + 0x70]
fld dword [esp + 0x5c]
fsubr st(1)
fmulp st(2)
fxch st(1)
fdivrp st(2)
fsubrp st(1)
fstp dword [esi]
jmp 0x10039e2b
fstp st(0)
mov eax, esi
mov ecx, 1
mov edx, 0x211
mov esi, ebx
call fcn.10056b10
jmp 0x10039e46
push ebx
call fcn.10021900
fld dword [esp + 0x70]
sub esp, 0x10
fsub dword [esp + 0x6c]
fstp qword [esp + 8]
fld dword [esp + 0x84]
fsub dword [esp + 0x70]
fstp qword [esp]
call fcn.1006ddc0
fstp dword [esp + 0x60]
add esp, 4
fld dword [0x100a982c]
fstp dword [esp + 8]
fld dword [esp + 0x74]
fstp dword [esp + 4]
fld dword [esp + 0x5c]
fstp dword [esp]
call fcn.100218b0
add esp, 0xc
test eax, eax
jne 0x10039ea1
fld dword [esp + 0x50]
push ecx
fstp dword [esp]
call fcn.10021920
fld qword [0x100a9870]
fcomp qword [esp + 0x54]
fnstsw ax
test ah, 1
jne 0x1003adb2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0x3c]
cmp eax, 0x3e8
jbe 0x1003adb2
cmp dword [ebx + 0x18c], 0
je 0x10039f98
mov eax, dword [ebx + 0x134]
test eax, eax
je 0x10039f98
mov ecx, dword [ebx + 0x148]
test ecx, ecx
jne 0x10039ef4
lea eax, [ecx + 0x64]
jmp 0x10039efb
imul eax, eax, 0x64
xor edx, edx
div ecx
mov ecx, dword [ebp + 0x14]
cmp eax, dword [ecx + 0x23c]
jae 0x10039f98
lea edx, [esp + 0x50]
push edx
mov ecx, str.MendPet
call fcn.10003700
lea eax, [esp + 0x50]
push eax
lea ecx, [ebp + 0x68]
mov dword [esp + 0xc4], 4
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov edi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test edi, edi
je 0x10039f98
mov esi, dword [edi]
mov eax, ebx
call fcn.10037e70
test eax, eax
jne 0x10039f98
mov eax, edi
call fcn.10023fd0
test eax, eax
jne 0x10039f98
mov esi, dword [edi]
call fcn.1007e040
test eax, eax
je 0x10039f98
cmp dword [edi + 0x10], 0
jne 0x10039f98
mov eax, dword [edi]
jmp 0x1003ad9f
mov eax, ebx
call fcn.10003b60
cmp eax, 0x14
jae 0x1003a07a
mov esi, dword [esp + 0x4c]
mov eax, esi
call fcn.10003b20
cmp eax, 0x1e
jbe 0x1003a07a
mov eax, dword [esi + 0x48]
cmp eax, dword [ebx + 0x2c]
jne 0x1003a07a
mov eax, dword [esi + 0x44]
cmp eax, dword [ebx + 0x28]
jne 0x1003a07a
lea eax, [esp + 0x50]
push eax
mov ecx, str.FeignDeath
call fcn.10003700
lea ecx, [esp + 0x50]
push ecx
lea ecx, [ebp + 0x68]
mov dword [esp + 0xc4], 5
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov edi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test edi, edi
je 0x1003a07a
mov eax, edi
call fcn.10023fd0
test eax, eax
jne 0x1003a07a
mov esi, dword [edi]
call fcn.1007e040
test eax, eax
je 0x1003a07a
mov edx, dword [ebx]
mov eax, dword [edi]
mov edx, dword [edx + 0x14]
push eax
mov ecx, ebx
call edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1770
mov dword [ebp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x100bb2cc]
mov eax, dword [ecx]
mov edx, dword [eax + 0x2c]
call edx
jmp 0x1003adb2
fld qword [0x100a9928]
fcomp qword [esp + 0x54]
fnstsw ax
test ah, 1
jne 0x1003a1aa
lea eax, [esp + 0x50]
push eax
mov ecx, str.RaptorStrike
call fcn.10003700
lea ecx, [esp + 0x50]
lea edi, [ebp + 0x68]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 6
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003a11b
cmp dword [esi + 0x10], 0
jne 0x1003a11b
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x1003a11b
mov esi, dword [esi]
call fcn.1007e040
test eax, eax
je 0x1003a11b
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ecx
jmp 0x1003ada0
lea eax, [esp + 0x50]
push eax
mov ecx, str.Attack
call fcn.10003700
lea ecx, [esp + 0x50]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 7
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov edi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test edi, edi
je 0x1003a1aa
mov eax, edi
call fcn.10023fd0
test eax, eax
jne 0x1003a1aa
mov esi, dword [edi]
call fcn.1007e040
test eax, eax
je 0x1003a1aa
mov eax, edi
call fcn.1002ebf0
test eax, eax
jne 0x1003a1aa
mov dword [ebp + 0xa8], 1
mov eax, dword [edi]
jmp 0x1003ad9f
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0x240], 0
je 0x1003a248
lea ecx, [esp + 0x50]
push ecx
mov ecx, str.BestialWrath
call fcn.10003700
lea edx, [esp + 0x50]
push edx
lea ecx, [ebp + 0x68]
mov dword [esp + 0xc4], 8
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov edi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test edi, edi
je 0x1003a248
cmp dword [edi + 0x10], 0
jne 0x1003a248
mov esi, dword [edi]
call fcn.1007e040
test eax, eax
je 0x1003a248
cmp dword [ebx + 0x18c], 0
je 0x1003a248
cmp dword [ebx + 0x134], 0
je 0x1003a248
mov eax, dword [ebx]
mov ecx, dword [edi]
mov edx, dword [eax + 0x14]
push ecx
jmp 0x1003ada5
lea eax, [esp + 0x50]
push eax
mov ecx, str.HunterMark
call fcn.10003700
lea ecx, [esp + 0x50]
lea edi, [ebp + 0x68]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 9
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003a331
cmp dword [esi + 0x10], 0
jne 0x1003a331
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x1003a331
mov eax, dword [esp + 0x48]
call fcn.10023fd0
test eax, eax
jne 0x1003a331
mov eax, dword [esp + 0x48]
mov esi, dword [eax]
mov eax, dword [esp + 0x4c]
call fcn.1006f6d0
test eax, eax
jne 0x1003a331
mov ecx, dword [ebp + 0x94]
mov edx, dword [ebp + 0x90]
mov eax, dword [esp + 0x4c]
push ecx
push edx
call fcn.10038030
test eax, eax
je 0x1003a331
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx]
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
push edx
mov ecx, ebx
call eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x4c]
mov dword [ebp + 0x3c], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ecx]
mov dword [ebp + 0x90], ecx
mov dword [ebp + 0x94], eax
jmp 0x1003adb2
mov esi, dword [ebp + 0x14]
cmp dword [esi + 0x250], 0
je 0x1003a3a7
cmp dword [ebp + 0xac], 0
jne 0x1003a35e
mov dword [ebp + 0xac], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0xb0], eax
jmp 0x1003a3a7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x254]
sub eax, dword [ebp + 0xb0]
imul ecx, ecx, 0x3e8
cmp eax, ecx
jae 0x1003a39d
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x28]
push eax
push ecx
mov eax, ebp
call fcn.10004880
test eax, eax
jne 0x1003a39d
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003aea4
mov dword [ebp + 0xac], 2
lea edx, [esp + 0x50]
push edx
mov ecx, str.AspectHawk
call fcn.10003700
lea eax, [esp + 0x50]
push eax
mov ecx, edi
mov dword [esp + 0xc4], 0xa
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003a441
cmp dword [esi + 0x10], 0
jne 0x1003a441
mov ecx, esi
mov esi, dword [ecx]
mov eax, ebx
call fcn.10056f10
test eax, eax
jne 0x1003a441
mov edx, dword [esp + 0x48]
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x1003a441
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx]
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
push edx
mov ecx, ebx
call eax
jmp 0x1003ada9
lea ecx, [esp + 0x50]
push ecx
mov ecx, str.RapidFire
call fcn.10003700
lea edx, [esp + 0x50]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 0xb
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003a4da
cmp dword [esi + 0x10], 0
jne 0x1003a4da
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x1003a4da
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x1003a4da
mov eax, dword [esp + 0x4c]
call fcn.10003b20
cmp eax, 0xa
jbe 0x1003a4da
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ecx
jmp 0x1003ada0
lea eax, [esp + 0x50]
push eax
mov ecx, str.SilencingShot
call fcn.10003700
lea ecx, [esp + 0x50]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0xc
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003a554
cmp dword [esi + 0x10], 0
jne 0x1003a554
mov edx, dword [esp + 0x4c]
cmp dword [edx + 0x50], 0
je 0x1003a554
mov eax, dword [ebx]
mov ecx, dword [esi]
mov edx, dword [eax + 0x14]
push ecx
jmp 0x1003ada5
lea eax, [esp + 0x50]
push eax
mov ecx, str.Fervor
call fcn.10003700
lea ecx, [esp + 0x50]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0xd
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003a5e3
cmp dword [esi + 0x10], 0
jne 0x1003a5e3
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x1003a5e3
cmp dword [ebx + 0x4c], 0x32
jae 0x1003a5e3
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx]
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
push edx
mov ecx, ebx
call eax
jmp 0x1003ada9
lea ecx, [esp + 0x50]
push ecx
mov ecx, str.KillShot
call fcn.10003700
lea edx, [esp + 0x50]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 0xe
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003a67c
cmp dword [esi + 0x10], 0
jne 0x1003a67c
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x1003a67c
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x1003a67c
mov eax, dword [esp + 0x4c]
call fcn.10003b20
cmp eax, 0x14
jae 0x1003a67c
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ecx
jmp 0x1003ada0
push 0xa
mov eax, ebp
call fcn.10004680
cmp eax, 1
jg 0x1003a69a
mov eax, ebp
call fcn.10004640
cmp eax, 1
jbe 0x1003a738
cmp dword [ebx + 0x4c], 0x28
jb 0x1003a738
lea eax, [esp + 0x50]
push eax
mov ecx, str.MultiShot
call fcn.10003700
lea ecx, [esp + 0x50]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0xf
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003a738
cmp dword [esi + 0x10], 0
jne 0x1003a738
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x1003a738
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x1003a738
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx]
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
push edx
mov ecx, ebx
call eax
jmp 0x1003ada9
lea ecx, [esp + 0x50]
push ecx
mov ecx, str.ChimeraShot
call fcn.10003700
lea edx, [esp + 0x50]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 0x10
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003a7c9
cmp dword [esi + 0x10], 0
jne 0x1003a7c9
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x1003a7c9
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x1003a7c9
cmp dword [ebx + 0x4c], 0x32
jb 0x1003a7c9
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ecx
jmp 0x1003ada0
lea eax, [esp + 0x50]
push eax
mov ecx, str.SerpentSting
call fcn.10003700
lea ecx, [esp + 0x50]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0x11
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003a8c1
cmp dword [esi + 0x10], 0
jne 0x1003a8c1
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x1003a8c1
mov eax, dword [esp + 0x48]
call fcn.10023fd0
test eax, eax
jne 0x1003a8c1
mov eax, dword [esp + 0x48]
mov esi, dword [eax]
mov eax, dword [esp + 0x4c]
call fcn.1006f6d0
test eax, eax
jne 0x1003a8c1
mov ecx, dword [ebp + 0x84]
mov edx, dword [ebp + 0x80]
mov eax, dword [esp + 0x4c]
push ecx
push edx
call fcn.10038030
test eax, eax
je 0x1003a8c1
mov eax, dword [esp + 0x4c]
call fcn.10003b20
cmp eax, 0xa
jbe 0x1003a8c1
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx]
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
push edx
mov ecx, ebx
call eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x4c]
mov dword [ebp + 0x3c], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ecx]
mov dword [ebp + 0x80], ecx
mov dword [ebp + 0x84], eax
jmp 0x1003adb2
lea ecx, [esp + 0x50]
push ecx
mov ecx, str.ArcaneShot
call fcn.10003700
lea edx, [esp + 0x50]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 0x12
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003a952
cmp dword [esi + 0x10], 0
jne 0x1003a952
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x1003a952
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x1003a952
cmp dword [ebx + 0x4c], 0x19
jb 0x1003a952
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ecx
jmp 0x1003ada0
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0x238], 0
je 0x1003aa17
mov eax, dword [esp + 0x4c]
call fcn.10003b20
cmp eax, 0x14
jb 0x1003a979
cmp eax, 0x3c
jbe 0x1003aa17
lea ecx, [esp + 0x50]
push ecx
mov ecx, str.ConcussiveShot
call fcn.10003700
lea edx, [esp + 0x50]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 0x13
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003aa17
cmp dword [esi + 0x10], 0
jne 0x1003aa17
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x1003aa17
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x1003aa17
mov ecx, dword [esp + 0x48]
mov esi, dword [ecx]
mov eax, dword [esp + 0x4c]
call fcn.1006f6d0
test eax, eax
jne 0x1003aa17
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ecx
jmp 0x1003ada0
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0x244], 0
je 0x1003aab9
lea ecx, [esp + 0x50]
push ecx
mov ecx, str.Intimidation
call fcn.10003700
lea edx, [esp + 0x50]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 0x14
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003aab9
cmp dword [esi + 0x10], 0
jne 0x1003aab9
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x1003aab9
cmp dword [ebx + 0x134], 0
je 0x1003aab9
cmp dword [ebx + 0x18c], 0
je 0x1003aab9
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ecx
jmp 0x1003ada0
lea eax, [esp + 0x50]
push eax
mov ecx, str.KillCommand
call fcn.10003700
lea ecx, [esp + 0x50]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0x15
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003ab6a
cmp dword [esi + 0x10], 0
jne 0x1003ab6a
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x1003ab6a
cmp dword [ebx + 0x4c], 0x28
jb 0x1003ab6a
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x1003ab6a
mov eax, dword [esp + 0x4c]
call fcn.10003b20
cmp eax, 0xa
jbe 0x1003ab6a
cmp dword [ebx + 0x134], 0
je 0x1003ab6a
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx]
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
push edx
mov ecx, ebx
call eax
jmp 0x1003ada9
lea ecx, [esp + 0x50]
push ecx
mov ecx, str.Cobra_Shot
call fcn.10003700
lea edx, [esp + 0x50]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 0x16
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003abfb
cmp dword [esi + 0x10], 0
jne 0x1003abfb
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x1003abfb
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x1003abfb
cmp dword [ebx + 0x4c], 0x19
jae 0x1003abfb
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ecx
jmp 0x1003ada0
lea eax, [esp + 0x50]
push eax
mov ecx, str.SteadyShot
call fcn.10003700
lea ecx, [esp + 0x50]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0x17
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003ac95
cmp dword [esi + 0x10], 0
jne 0x1003ac95
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x1003ac95
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x1003ac95
cmp dword [ebx + 0x4c], 0x19
jae 0x1003ac95
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx]
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
push edx
mov ecx, ebx
call eax
jmp 0x1003ada9
lea ecx, [esp + 0x50]
push ecx
mov ecx, str.AimedShot
call fcn.10003700
lea edx, [esp + 0x50]
push edx
mov ecx, edi
mov dword [esp + 0xc4], 0x18
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003ad23
cmp dword [esi + 0x10], 0
jne 0x1003ad23
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x1003ad23
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x1003ad23
cmp dword [ebx + 0x4c], 0x37
jbe 0x1003ad23
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push ecx
jmp 0x1003ada0
lea eax, [esp + 0x48]
push eax
mov ecx, str.AutoShot
call fcn.10003700
lea ecx, [esp + 0x48]
push ecx
mov ecx, edi
mov dword [esp + 0xc4], 0x19
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x54], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebp
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x48]
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1003adb2
mov eax, esi
call fcn.1006e760
mov eax, esi
call fcn.10023fd0
test eax, eax
jne 0x1003adb2
mov eax, esi
call fcn.1002ebf0
test eax, eax
jne 0x1003adb2
mov eax, dword [esi]
push eax
mov edx, dword [ebx]
mov edx, dword [edx + 0x14]
mov ecx, ebx
call edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x3c], eax
push 0x11
call fcn.100579d0
test eax, eax
je 0x1003ade7
mov eax, dword [ebp + 0x14]
mov edx, dword [ebx]
add eax, 0xc
push eax
mov eax, dword [edx + 0x38]
mov ecx, ebx
call eax
test eax, eax
je 0x1003ade7
mov edx, dword [ebx]
mov eax, dword [edx + 0x4c]
mov ecx, ebx
call eax
test eax, eax
jle 0x1003ade7
mov edx, dword [ebx]
mov eax, dword [edx + 0x58]
mov ecx, ebx
call eax
push 0x12
call fcn.100579d0
test eax, eax
je 0x1003ae1c
mov ebp, dword [ebp + 0x14]
mov edx, dword [ebx]
mov eax, dword [edx + 0x3c]
add ebp, 0xc
push ebp
mov ecx, ebx
call eax
test eax, eax
je 0x1003ae1c
mov edx, dword [ebx]
mov eax, dword [edx + 0x50]
mov ecx, ebx
call eax
test eax, eax
jle 0x1003ae1c
mov edx, dword [ebx]
mov eax, dword [edx + 0x5c]
mov ecx, ebx
call eax
push 0x19
call fcn.100579d0
test eax, eax
je 0x1003ae41
mov edx, dword [ebx]
mov eax, dword [edx + 0x54]
push 0x19
mov ecx, ebx
call eax
test eax, eax
jle 0x1003ae41
mov edx, dword [ebx]
mov eax, dword [edx + 0x64]
push 0x19
mov ecx, ebx
call eax
push 0x1a
call fcn.100579d0
test eax, eax
je 0x1003ae66
mov edx, dword [ebx]
mov eax, dword [edx + 0x54]
push 0x1a
mov ecx, ebx
call eax
test eax, eax
jle 0x1003ae66
mov edx, dword [ebx]
mov eax, dword [edx + 0x64]
push 0x1a
mov ecx, ebx
call eax
call fcn.1007e120
test eax, eax
je 0x1003aea4
mov ecx, dword [esp + 0x4c]
mov eax, dword [ecx + 0x44]
mov ecx, dword [ecx + 0x48]
mov edx, dword [ebx]
push ecx
push eax
mov eax, dword [edx + 0x78]
mov ecx, ebx
call eax
test eax, eax
je 0x1003aea4
mov ecx, dword [0x100bb2cc]
mov edx, dword [ecx]
mov eax, dword [edx + 0x90]
push 0
call eax
mov al, 0
mov ecx, dword [0x100bb500]
mov byte [ecx], al
mov eax, 1
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 4