Well, your ebx gets overwritten, so like I said you're clearing it for nothing. :D
D mov ebx,[edx+0078]
add ebx,0x01
mov [edx+0078],ebx
Right here, you reload the timer into ebx, overwriting whatever value you put into it before.
You should follow manually where your code goes in all 3 states...