Function at 0x40f3e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0xfc]
add eax, 0x800
mov ecx, 0xc000
mov dword [ebp + 0x100], eax
mov edi, dword [ebp + 0x660]
or eax, 0xffffffff
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xfc]
mov edi, dword [ebp + 0x660]
mov esi, dword [ebp + 0x668]
mov edx, ecx
add edi, 0x800
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xfc]
xor ecx, ecx
test eax, eax
jle 0x40f467
mov edx, dword [ebp + 0x668]
cmp byte [edx + ecx], 0xff
jne 0x40f457
inc ecx
cmp ecx, eax
jl 0x40f44c
cmp ecx, 0x10000
mov dword [esp + 0x18], 0x10000
jg 0x40f46b
mov dword [esp + 0x18], ecx
mov ebx, dword [ebp + 0x660]
mov edi, eax
mov eax, 0x1b4e81b5
mov dword [esp + 0x14], edi
mov word [ebx], 0xa55a
mov ecx, dword [ebp + 0xe4]
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov byte [ebx + 0xa], dl
mov cl, byte [ebp + 0xec]
mov byte [ebx + 0xb], cl
mov edx, dword [ebp + 0x11c]
shl edx, 5
mov ax, word [edx + 0x4216f0]
push eax
call fcn.0041e520
mov word [ebx + 0xc], ax
mov ecx, dword [ebp + 0x11c]
shl ecx, 5
mov dx, word [ecx + 0x4216f2]
push edx
call fcn.0041e520
mov word [ebx + 0xe], ax
mov byte [ebx + 0x10], 0
mov byte [ebx + 0x11], 0
mov byte [ebx + 0x12], 0
mov byte [ebx + 0x13], 0
mov eax, dword [ebp + 0xf8]
push eax
call fcn.0041e500
mov dword [ebx + 0x14], eax
mov ecx, dword [ebp + 0x114]
push ecx
call fcn.0041e500
mov dword [ebx + 0x18], eax
fild dword [ebp + 0xf8]
fmul dword [ebp + 0x1e4]
call sub.MSVCRT.dll__ftol
push eax
call fcn.0041e500
mov dword [ebx + 0x1a3], eax
mov edx, dword [ebp + 0x69c]
push edx
call fcn.0041e500
mov dword [ebx + 0x1a9], eax
mov al, byte [ebp + 0x6a0]
mov byte [ebx + 0x1ad], al
mov cl, byte [ebp + 0x6a1]
mov byte [ebx + 0x1ae], cl
mov dl, byte [ebp + 0x6a2]
mov byte [ebx + 0x1af], dl
mov al, byte [ebp + 0x6a3]
mov byte [ebx + 0x1b0], al
mov cl, byte [ebp + 0x6a4]
mov byte [ebx + 0x1b1], cl
mov dl, byte [ebp + 0x6a5]
mov byte [ebx + 0x1b2], dl
mov al, byte [ebp + 0x6a6]
mov byte [ebx + 0x1b3], al
mov cl, byte [ebp + 0x6a7]
mov byte [ebx + 0x1b4], cl
mov al, byte [ebx + 0x10]
or al, 0x20
mov byte [ebx + 0x10], al
mov edx, dword [ebp + 0x168]
push edx
call fcn.0041e500
mov dword [ebx + 0x1c], eax
mov ecx, dword [ebp + 0x674]
lea eax, [ebx + 0x20]
add esp, 0x1c
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp + 0x11c]
shl edx, 5
mov eax, dword [edx + 0x4216e8]
mov ecx, eax
and ecx, 0x7f8000
cmp ecx, 0x168000
jb 0x40f5f0
test al, 8
jne 0x40f5f0
mov byte [ebx + 0x23], 0xff
mov al, byte [ebp + 0x2f]
test al, al
je 0x40f616
mov al, byte [ebx + 0x10]
lea edi, [ebx + 0x300]
or al, 1
mov ecx, 0x40
mov byte [ebx + 0x10], al
mov esi, dword [ebp + 0x670]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
mov al, byte [ebp + 0x27]
test al, al
je 0x40f621
or byte [ebx + 0x10], 2
mov edx, dword [ebp + 0x674]
test byte [edx + 0x10], 1
jne 0x40f68b
mov al, byte [ebx + 0x10]
or al, 4
mov byte [ebx + 0x10], al
mov ecx, dword [ebp + 0x674]
test byte [ecx + 0x10], 2
jne 0x40f64a
and eax, 0xff
or al, 8
jmp 0x40f651
and eax, 0xff
and al, 0xf7
mov byte [ebx + 0x10], al
mov edx, dword [ebp + 0x674]
test byte [edx + 0x10], 4
jne 0x40f669
and eax, 0xff
or al, 0x10
jmp 0x40f670
and eax, 0xff
and al, 0xef
mov byte [ebx + 0x10], al
mov eax, dword [ebp + 0x674]
mov cl, byte [eax + 0x11]
mov byte [ebx + 0x30], cl
mov edx, dword [ebp + 0x674]
mov al, byte [edx + 0x12]
mov byte [ebx + 0x31], al
mov eax, dword [ebp + 0xf0]
test eax, eax
je 0x40f699
or byte [ebx + 0x10], 0x40
mov ecx, dword [ebp + 0x11c]
shl ecx, 5
test byte [ecx + 0x4216e8], 0x20
je 0x40f6af
or byte [ebx + 0x10], 0x80
mov dl, byte [ebp + 0x10c]
mov byte [ebx + 0x32], dl
mov eax, dword [ebp + 0x11c]
shl eax, 5
mov ecx, dword [eax + 0x4216e8]
shr ecx, 0xf
mov byte [ebx + 0x33], cl
mov al, byte [ebp + 0x31]
test al, al
je 0x40f747
mov eax, dword [ebp + 0x88]
mov esi, dword [esp + 0x18]
cmp esi, eax
jl 0x40f6e8
mov esi, eax
mov dword [esp + 0x18], esi
mov edx, dword [ebp + 0x90]
add eax, edx
cmp edi, eax
jg 0x40f6fa
mov edi, eax
mov dword [esp + 0x14], edi
mov dl, byte [ebx + 0x11]
or dl, 1
mov byte [ebx + 0x11], dl
mov eax, dword [ebp + 0x88]
push eax
call fcn.0041e500
mov dword [ebx + 0x34], eax
mov cl, byte [ebp + 0x90]
lea edx, [ebp + 0x48]
push 0x10
lea eax, [ebx + 0x40]
push edx
push eax
mov byte [ebx + 0x3c], cl
call fcn.0041e4d0
lea ecx, [ebp + 0x68]
push 0x10
lea edx, [ebx + 0x60]
push ecx
push edx
call fcn.0041e4d0
mov al, byte [ebp + 0x98]
add esp, 0x1c
mov byte [ebx + 0x3e], al
jmp 0x40f74b
mov esi, dword [esp + 0x18]
mov al, byte [ebp + 0x32]
test al, al
je 0x40f7bf
mov eax, dword [ebp + 0x8c]
cmp esi, eax
jl 0x40f762
mov esi, eax
mov dword [esp + 0x18], esi
mov ecx, dword [ebp + 0x94]
add eax, ecx
cmp edi, eax
jg 0x40f774
mov edi, eax
mov dword [esp + 0x14], edi
mov cl, byte [ebx + 0x11]
or cl, 2
mov byte [ebx + 0x11], cl
mov edx, dword [ebp + 0x8c]
push edx
call fcn.0041e500
lea ecx, [ebp + 0x58]
mov dword [ebx + 0x38], eax
mov al, byte [ebp + 0x94]
push 0x10
lea edx, [ebx + 0x50]
push ecx
push edx
mov byte [ebx + 0x3d], al
call fcn.0041e4d0
lea eax, [ebp + 0x78]
push 0x10
lea ecx, [ebx + 0x70]
push eax
push ecx
call fcn.0041e4d0
mov dl, byte [ebp + 0x9c]
add esp, 0x1c
mov byte [ebx + 0x3f], dl
mov al, byte [ebp + 0x29]
test al, al
je 0x40f7ca
or byte [ebx + 0x11], 4
mov al, byte [ebp + 0x2a]
test al, al
jne 0x40f7d5
or byte [ebx + 0x12], 4
mov al, byte [ebp + 0x2b]
test al, al
je 0x40f7e0
or byte [ebx + 0x12], 8
mov al, byte [ebp + 0x2c]
test al, al
jne 0x40f7eb
or byte [ebx + 0x12], 0x10
mov eax, dword [ebp + 0x11c]
shl eax, 5
test byte [eax + 0x4216e8], 4
je 0x40f801
or byte [ebx + 0x12], 0x20
mov cl, byte [ebp + 0xd8]
mov dl, byte [ebx + 0x12]
shl cl, 6
or dl, cl
mov byte [ebx + 0x12], dl
mov dl, byte [ebp + 0xf4]
mov byte [ebx + 0x80], dl
mov al, byte [ebp + 0x38]
test al, al
je 0x40f91b
mov eax, dword [ebp + 0xd0]
cmp esi, eax
jl 0x40f837
mov dword [esp + 0x18], eax
mov ecx, dword [ebp + 0xcc]
add eax, ecx
cmp edi, eax
jg 0x40f847
mov dword [esp + 0x14], eax
mov al, byte [ebx + 0x11]
or al, 0x40
mov byte [ebx + 0x11], al
mov ecx, dword [ebp + 0xb8]
mov eax, 0x1b4e81b5
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov byte [ebx + 0xa3], dl
mov ecx, dword [ebp + 0xc4]
cmp ecx, 0x20
jle 0x40f87c
mov ecx, 0x20
mov byte [ebx + 0xa4], cl
mov esi, dword [ebp + 0x678]
and ecx, 0xff
lea edi, [ebx + 0xa5]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xcc]
cmp eax, 0x800
jle 0x40f8b4
mov eax, 0x800
push eax
mov word [ebx + 0xe5], ax
call fcn.0041e520
mov word [ebx + 0xe5], ax
mov eax, dword [ebp + 0xd0]
push eax
call fcn.0041e500
mov dword [ebx + 0xe7], eax
mov ecx, dword [ebp + 0xc8]
add esp, 8
cmp ecx, 0x1f
jle 0x40f8ed
mov ecx, 0x1f
mov byte [ebx + 0xc5], cl
mov esi, dword [ebp + 0x67c]
and ecx, 0xff
lea edi, [ebx + 0xc6]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov al, byte [ebp + 0xedc]
test al, al
jne 0x40f947
mov al, byte [ebp + 0xedd]
test al, al
jne 0x40f947
mov al, byte [ebp + 0xede]
test al, al
jne 0x40f947
mov al, byte [ebp + 0xedf]
test al, al
je 0x40fa87
mov cl, byte [ebx + 0x11]
or cl, 8
mov byte [ebx + 0x11], cl
mov al, byte [ebp + 0xee0]
mov byte [ebx + 0xeb], al
mov cl, byte [ebp + 0xee1]
mov byte [ebx + 0xec], cl
mov dl, byte [ebp + 0xee2]
mov byte [ebx + 0xed], dl
mov al, byte [ebp + 0xee3]
lea ecx, [ebp + 0xee4]
mov byte [ebx + 0xee], al
lea edx, [ebx + 0xef]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp + 0xef4]
push edx
call fcn.0041e500
mov dword [ebx + 0xff], eax
mov eax, dword [ebp + 0xef8]
push eax
call fcn.0041e500
mov dword [ebx + 0x103], eax
mov ecx, dword [ebp + 0xefc]
push ecx
call fcn.0041e500
mov dword [ebx + 0x107], eax
mov edx, dword [ebp + 0xf00]
push edx
call fcn.0041e500
mov dword [ebx + 0x10b], eax
mov al, byte [ebp + 0xedc]
add esp, 0x10
test al, al
je 0x40fa14
mov eax, dword [ebp + 0xef4]
cmp esi, eax
jl 0x40fa07
mov esi, eax
mov dword [esp + 0x18], esi
add eax, 7
cmp edi, eax
jg 0x40fa14
mov edi, eax
mov dword [esp + 0x14], edi
mov al, byte [ebp + 0xedd]
test al, al
je 0x40fa3b
mov eax, dword [ebp + 0xef8]
cmp esi, eax
jl 0x40fa2e
mov esi, eax
mov dword [esp + 0x18], esi
add eax, 7
cmp edi, eax
jg 0x40fa3b
mov edi, eax
mov dword [esp + 0x14], edi
mov al, byte [ebp + 0xede]
test al, al
je 0x40fa62
mov eax, dword [ebp + 0xefc]
cmp esi, eax
jl 0x40fa55
mov esi, eax
mov dword [esp + 0x18], esi
add eax, 7
cmp edi, eax
jg 0x40fa62
mov edi, eax
mov dword [esp + 0x14], edi
mov al, byte [ebp + 0xedf]
test al, al
je 0x40fa87
mov eax, dword [ebp + 0xf00]
cmp esi, eax
jl 0x40fa7a
mov dword [esp + 0x18], eax
add eax, 7
cmp edi, eax
jg 0x40fa87
mov edi, eax
mov dword [esp + 0x14], edi
mov eax, dword [ebp + 0x674]
test byte [eax + 0xf], 2
je 0x40fab4
mov eax, dword [ebp + 0x11c]
xor ecx, ecx
shl eax, 5
mov cl, byte [eax + 0x421704]
mov eax, dword [eax + 0x4216f4]
sub eax, ecx
cmp edi, eax
jg 0x40fab4
mov dword [esp + 0x14], eax
mov edx, dword [ebp + 0x11c]
shl edx, 5
mov eax, dword [edx + 0x4216f4]
push eax
call fcn.0041e500
mov dword [ebx + 0x10f], eax
mov eax, dword [ebp + 0x11c]
shl eax, 5
mov ecx, dword [eax + 0x4216f8]
mov edi, dword [eax + 0x4216f4]
add ecx, edi
push ecx
call fcn.0041e500
mov dword [ebx + 0x113], eax
mov eax, dword [ebp + 0x16c]
add esp, 8
cmp eax, 0x10
jle 0x40fb05
mov eax, 0x10
mov dl, 0xa
imul dl
test al, al
mov byte [ebx + 0x117], al
jne 0x40fb1a
mov byte [ebx + 0x117], 0x32
mov al, byte [ebp + 0xf04]
test al, al
je 0x40fb7e
mov al, byte [ebp + 0xf08]
lea esi, [ebp + 0xf10]
mov byte [ebx + 0x118], al
mov cl, byte [ebp + 0xf0c]
mov byte [ebx + 0x119], cl
mov ecx, dword [ebp + 0xf08]
mov edx, ecx
lea edi, [ebx + 0x11a]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xf0c]
lea esi, [ebp + 0x1010]
mov eax, ecx
lea edi, [ebx + 0x15a]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x40fb8c
mov byte [ebx + 0x118], 0
mov byte [ebx + 0x119], 0
mov ecx, dword [ebp + 0x674]
test byte [ecx + 0xf], 2
je 0x40fbd9
mov eax, dword [ebp + 0x11c]
shl eax, 5
mov ecx, dword [eax + 0x4216e8]
and ecx, 0x7f8000
cmp ecx, 0x168000
jae 0x40fbc7
mov eax, dword [eax + 0x4216f4]
mov edx, dword [esp + 0x14]
cmp edx, eax
jg 0x40fbc7
mov dword [esp + 0x14], eax
cmp ecx, 0xc8000
jb 0x40fbd5
or byte [ebx + 0x11], 0x80
jmp 0x40fbd9
or byte [ebx + 0x12], 1
mov al, byte [ebp + 0x39]
test al, al
je 0x40fc08
mov eax, dword [ebp + 0x11c]
shl eax, 5
test byte [eax + 0x4216e8], 8
je 0x40fc04
mov edx, dword [eax + 0x421700]
sub edx, 0x800
mov dword [ebx + 0x113], edx
or byte [ebx + 0x12], 2
mov al, byte [ebp + 0x188]
mov esi, dword [esp + 0x14]
mov byte [ebx + 0x19a], al
mov cl, byte [ebp + 0x18c]
mov byte [ebx + 0x19b], cl
mov dl, byte [ebp + 0x190]
mov byte [ebx + 0x19c], dl
mov eax, dword [ebp + 0x668]
push 0
push esi
push eax
mov ecx, ebp
call fcn.00403060
push eax
call fcn.0041e520
mov word [ebx + 4], ax
lea eax, [esi + 0x7f]
cdq
and edx, 0x7f
mov esi, dword [esp + 0x1c]
add eax, edx
add esp, 4
mov edi, eax
mov eax, dword [ebp + 0x11c]
shl eax, 5
sar edi, 7
mov ecx, dword [eax + 0x4216e8]
and esi, 0xfffffe00
mov edx, ecx
and edx, 0x7f8000
shl edi, 7
cmp edx, 0xc8000
jb 0x40fca3
test cl, 0x20
je 0x40fca3
xor ecx, ecx
mov cl, byte [eax + 0x421704]
mov eax, dword [eax + 0x4216f4]
sub eax, ecx
cmp edi, eax
jl 0x40fca3
mov edi, eax
mov edx, dword [ebp + 0xfc]
push edx
call fcn.0041e500
push edi
mov dword [ebx + 6], eax
call fcn.0041e500
push esi
mov dword [ebx + 0x1b5], eax
call fcn.0041e500
mov dword [ebx + 0x19d], eax
mov al, byte [ebp + 0x25]
add esp, 0xc
test al, al
je 0x40fe52
mov eax, dword [ebp + 0xf0]
mov cl, byte [ebp + 0x10c]
neg eax
sbb al, al
lea edx, [esp + 0x15]
and al, 2
push edx
push 2
add al, 3
mov byte [esp + 0x1e], cl
push 0
push 0x40
mov ecx, ebp
mov byte [esp + 0x24], 0xff
mov byte [esp + 0x25], al
call fcn.00411cd0
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x13]
mov ecx, ebp
push eax
push 1
push 0
push 1
mov byte [esp + 0x23], 4
call fcn.00411cd0
mov eax, dword [ebp + 0x16c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
shl ecx, 3
push ecx
mov ecx, ebp
call fcn.00403930
push 1
push 0
mov ecx, ebp
call fcn.004036c0
mov al, byte [ebp + 0x23]
test al, al
je 0x410064
mov ecx, ebp
call fcn.00403950
test al, al
jne 0x410071
lea edx, [ebp + 0x6ae]
push 1
push edx
mov ecx, ebp
call fcn.004036c0
test al, al
je 0x40fd4f
mov al, byte [ebp + 0x25]
test al, al
je 0x40fd9b
mov eax, dword [ebp + 0x1c4]
test eax, eax
je 0x40fd9b
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
xor eax, eax
lea esi, [ebx + 0x1a1]
mov ah, byte [ebp + 0x6ae]
mov al, byte [ebp + 0x6af]
push eax
call fcn.0041e520
mov word [esi], ax
mov al, byte [ebp + 0x170]
add esp, 4
mov byte [ebx + 0x1a7], al
mov cl, byte [ebp + 0x174]
push esi
push 2
mov byte [ebx + 0x1a8], cl
push 0
push 2
mov ecx, ebp
call fcn.00411cd0
mov eax, dword [ebp + 0x16c]
mov ecx, ebp
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
push edx
call fcn.00403930
push 1
push 0
mov ecx, ebp
call fcn.004036c0
mov al, byte [ebp + 0x23]
test al, al
je 0x410064
mov ecx, ebp
call fcn.00403950
test al, al
jne 0x410071
lea eax, [ebp + 0x6ae]
push 1
push eax
mov ecx, ebp
call fcn.004036c0
test al, al
je 0x40fe06
mov al, byte [ebp + 0x25]
test al, al
je 0x40fe52
mov eax, dword [ebp + 0x1c4]
test eax, eax
je 0x40fe52
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
mov eax, dword [ebp + 0x660]
push 4
push 0x3fc
push eax
mov ecx, ebp
call fcn.00403060
push eax
call fcn.0041e520
add esp, 4
add edi, 0x800
mov word [ebx + 2], ax
mov ecx, ebp
push 0x5222
mov dword [ebp + 0x100], edi
call fcn.00402e90
push eax
push ebp
call fcn.00402ed0
add esp, 8
mov ecx, ebp
push 0
push 0
call fcn.00403000
mov eax, dword [ebp + 0x100]
xor ebx, ebx
test eax, eax
mov dword [esp + 0x14], eax
mov byte [ebp + 0xaae], 0xf4
jle 0x410011
jmp 0x40fec2
mov eax, dword [esp + 0x14]
mov cl, byte [ebp + 0x25]
test cl, cl
je 0x40fedb
cmp eax, 0x38
jge 0x40fed4
mov byte [esp + 0x18], al
jmp 0x40feeb
mov byte [esp + 0x18], 0x38
jmp 0x40feeb
cmp eax, 0x80
mov byte [esp + 0x18], al
jl 0x40feeb
mov byte [esp + 0x18], 0x80
test cl, cl
je 0x40ff09
mov ecx, dword [ebp + 0x660]
mov esi, dword [esp + 0x18]
add ecx, ebx
push ecx
push esi
push ebx
push 0x49
mov ecx, ebp
call fcn.00411cd0
jmp 0x40ff57
mov esi, dword [ebp + 0x660]
mov edx, ebx
xor eax, eax
add esi, ebx
shr edx, 0x10
mov al, bh
lea edi, [ebp + 0xab2]
mov ecx, 0x20
mov byte [ebp + 0xaaf], dl
mov byte [ebp + 0xab0], al
mov byte [ebp + 0xab1], bl
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x18]
lea eax, [ebp + 0xaae]
mov ecx, esi
and ecx, 0xff
add ecx, 4
push ecx
push eax
mov ecx, ebp
call fcn.00403520
push 0x7d0
mov ecx, ebp
call fcn.00403930
push 1
push 0
mov ecx, ebp
call fcn.004036c0
mov al, byte [ebp + 0x23]
test al, al
je 0x410064
mov ecx, ebp
call fcn.00403950
test al, al
jne 0x410071
lea edx, [ebp + 0x6ae]
push 1
push edx
mov ecx, ebp
call fcn.004036c0
test al, al
je 0x40ff6e
mov al, byte [ebp + 0x25]
test al, al
je 0x40ffc6
mov ecx, dword [ebp + 0x1c4]
test ecx, ecx
jne 0x40fe45
test al, al
je 0x40ffc6
cmp byte [ebp + 0x6ae], 0x54
je 0x40ffe7
test al, al
jne 0x40fe45
mov al, byte [ebp + 0x6ae]
mov cl, byte [ebp + 0xaae]
cmp al, cl
jne 0x40fe45
cmp byte [ebp + 0x6af], 0x54
jne 0x40fe45
mov ecx, dword [ebp + 0x100]
push ecx
push ebx
mov ecx, ebp
call fcn.00403000
mov ecx, dword [esp + 0x14]
mov eax, esi
and eax, 0xff
sub ecx, eax
add ebx, eax
test ecx, ecx
mov dword [esp + 0x14], ecx
jg 0x40febe
push 0
push 0
mov ecx, ebp
call fcn.00403000
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
sub eax, ebx
sub esp, 8
mov dword [esp + 0x24], eax
mov ecx, ebp
fild qword [esp + 0x24]
fmul dword [0x42a8a0]
fstp qword [esp]
push 0x521f
call fcn.00402e90
push eax
push ebp
call fcn.00402ed0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x14
ret