Function at 0x4b9660
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5a3a5c
mov eax, dword fs:[0]
push eax
mov eax, 0x4520
call fcn.00515150
mov eax, dword [0x61e69c]
xor eax, esp
mov dword [esp + 0x4518], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x61e69c]
xor eax, esp
push eax
lea eax, [esp + 0x4534]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x60]
mov eax, dword [eax - 0xc]
lea ecx, [esi + 0x60]
xor ebx, ebx
mov edi, edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x3c], ebx
lea ebp, [ebx + 1]
cmp eax, ebx
je 0x4b96eb
push ecx
push esi
mov ecx, edi
mov dword [esp + 0x44], ebp
call fcn.004bc530
test eax, eax
je 0x4b96eb
mov ecx, dword [esp + 0x454c]
push ebx
push 2
push ecx
call dword [esp + 0x4554]
add esp, 0xc
mov dword [esp + 0x3c], ebp
mov edx, dword [esi + 0x64]
mov ecx, dword [edx - 0xc]
lea eax, [esi + 0x64]
cmp ecx, ebx
je 0x4b971e
push eax
push esi
mov ecx, edi
call fcn.004bc530
test eax, eax
je 0x4b971e
mov eax, dword [esp + 0x454c]
push ebx
push 0xc
push eax
call dword [esp + 0x4554]
add esp, 0xc
mov dword [esp + 0x3c], ebp
cmp dword [0x627e28], ebx
je 0x4b973b
mov ecx, dword [esp + 0x4544]
push ecx
mov eax, esi
mov dword [0x627e28], ebx
call fcn.004b94a0
lea eax, [esp + 0x564]
call fcn.0041a520
lea edx, [esp + 0xc0]
mov dword [esp + 0x30], ebx
mov dword [esp + 0xc0], 0x41a020
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], 0x113
mov dword [esp + 0xcc], edx
mov dword [esp + 0x453c], ebx
mov eax, dword [0x66089c]
cmp eax, ebx
jne 0x4b97ab
call fcn.00410d40
cmp eax, ebx
je 0x4b97a2
push str.GetWorkFlowHWND
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x66089c], eax
jmp 0x4b97a7
mov eax, dword [0x66089c]
cmp eax, ebx
je 0x4b97af
call eax
jmp 0x4b97b1
xor eax, eax
push ebx
push 0x12c
lea ecx, [esp + 0xc8]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push ebx
call fcn.004f8fbf
add esp, 4
lea edx, [esp + 0x48]
push edx
mov dword [esp + 0xc0], eax
call fcn.004c16d0
lea eax, [esp + 0x74]
push eax
mov byte [esp + 0x4540], 1
call fcn.0042e0d0
lea eax, [esi + 0x88]
push eax
lea ecx, [esp + 0xd4]
push ecx
mov byte [esp + 0x4544], 2
call fcn.004c0b60
mov byte [esp + 0x453c], 3
mov edx, dword [esp + 0x60]
mov eax, dword [edx + 4]
push eax
lea ecx, [esp + 0x4c]
call fcn.004c1750
mov eax, dword [esp + 0x60]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x64], ebx
mov dword [eax], eax
mov eax, dword [esp + 0x60]
mov dword [eax + 8], eax
mov ecx, dword [esp + 0x8c]
mov edx, dword [ecx + 4]
push edx
lea ecx, [esp + 0x78]
call fcn.004302e0
mov eax, dword [esp + 0x8c]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x90], ebx
mov dword [eax], eax
mov eax, dword [esp + 0x8c]
mov dword [eax + 8], eax
lea eax, [esp + 0x94]
push eax
call fcn.004b7fb0
mov byte [esp + 0x453c], 4
lea esp, [esp]
xor ebx, ebx
cmp dword [esp + 0xa4], ebx
jne 0x4b98a8
cmp dword [esp + 0x94], ebx
je 0x4ba169
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x2c]
lea esi, [esp + 0x98]
call fcn.004c0c90
mov byte [esp + 0x453c], 5
mov edx, dword [0x6285c4]
mov eax, dword [edx + 0xc]
mov ecx, 0x6285c4
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x453c], 6
mov edx, dword [0x6285c4]
mov eax, dword [edx + 0xc]
mov ecx, 0x6285c4
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x453c], 7
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push ecx
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
add esi, 0xfffffff0
mov dword [esp + 0x40], esp
mov ebp, esp
call edx
cmp dword [esi + 0xc], ebx
lea edx, [esi + 0xc]
jl 0x4b993e
cmp eax, dword [esi]
jne 0x4b993e
mov edi, esi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x4b9979
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
cmp edi, ebx
je 0x4ba205
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004f745a
add esp, 0x10
add edi, 0x10
mov dword [ebp], edi
call fcn.004beff0
add esp, 0xc
cmp eax, ebx
jne 0x4b9a10
mov byte [esp + 0x453c], 6
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b99b7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x453c], 5
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b99df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x453c], 4
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b9890
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4b9890
push 0x40
lea ecx, [esp + 0x124]
push ebx
push ecx
mov dword [esp + 0x120], ebx
call fcn.004fe380
add esp, 0xc
push 0x400
lea edx, [esp + 0x164]
push ebx
push edx
call fcn.004fe380
add esp, 0xc
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
mov ebx, dword [esp + 0x18]
push 0x20
lea eax, [esp + 0x124]
push ebx
push eax
call fcn.004f8077
mov ebp, dword [esp + 0x28]
add esp, 0xc
push 0x200
lea ecx, [esp + 0x164]
push ebp
push ecx
call fcn.004f8077
add esp, 0xc
cmp dword [esp + 0x24], 0
je 0x4b9a8e
mov dword [esp + 0x3c], 1
lea edx, [esp + 0x74]
push edx
lea ecx, [esp + 0x20]
call fcn.004c0a00
cmp dword [esp + 0x30], 0
mov ecx, 0x113
lea esi, [esp + 0x114]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
je 0x4b9ac3
mov byte [esp + 0x453c], 6
lea eax, [ebp - 0x10]
jmp 0x4b9b4f
cmp dword [esp + 0x4544], 0
jne 0x4b9b78
mov ebp, dword [esp + 0xe8]
mov edi, dword [esp + 0xd0]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x110]
push edx
lea esi, [esp + 0xd8]
call fcn.004c0c10
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x4b9b04
cmp eax, edi
je 0x4b9b09
call fcn.004f825e
cmp dword [esi + 4], ebp
je 0x4b9b78
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x20]
call fcn.004c0a00
add eax, 0xc
mov ecx, 0
setne cl
test ecx, ecx
je 0x4ba20a
push eax
push ebx
call fcn.004f69f9
add esp, 8
test eax, eax
jne 0x4b9b78
mov byte [esp + 0x453c], 6
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b9b68
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x453c], 5
lea eax, [ebx - 0x10]
jmp 0x4b99c6
sub esp, 0x20
mov esi, esp
mov dword [esp + 0x54], esp
push 0
push 1
call fcn.004c0250
mov ebx, dword [esp + 0x54]
push ebx
mov edx, eax
mov ecx, esi
call fcn.004bf270
mov byte [esp + 0x455c], 8
mov esi, dword [esp + 0x40]
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
mov dword [esp + 0x5c], esp
mov ebp, esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x4b9bd2
cmp eax, dword [esi]
jne 0x4b9bd2
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4b9c0d
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4ba205
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004f745a
add esp, 0x10
add edi, 0x10
mov dword [ebp], edi
mov byte [esp + 0x4560], 7
call fcn.004bcff0
test eax, eax
je 0x4b9d1f
mov ecx, dword [esp + 0x18]
push 0x20
push ecx
lea edx, [esp + 0x56c]
push edx
call fcn.004f8077
mov eax, dword [esp + 0x28]
add esp, 0xc
push 0x200
push eax
lea ecx, [esp + 0x5ac]
push ecx
call fcn.004f8077
mov esi, dword [esp + 0x38]
mov ebp, dword [esi + 0x58]
mov ebx, dword [esi + 0x40]
add esp, 0xc
lea edx, [esp + 0x18]
add esi, 0x40
push edx
lea eax, [esp + 0xf4]
push eax
mov dword [esp + 0x3e84], 1
call fcn.004c0980
mov edi, eax
mov eax, dword [edi]
test eax, eax
je 0x4b9c8f
cmp eax, ebx
je 0x4b9c94
call fcn.004f825e
mov ebx, esi
cmp dword [edi + 4], ebp
jne 0x4b9cec
push 0x3fc8
lea ecx, [esp + 0x568]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.004c0840
push eax
call fcn.00500790
add esp, 0xc
push 0
call fcn.004f8fbf
mov edi, eax
add esp, 4
lea eax, [esp + 0x18]
push eax
mov ebp, edx
call fcn.004c0840
mov dword [eax + 0x3910], edi
mov dword [eax + 0x3914], ebp
mov dword [esp + 0x30], 1
jmp 0x4b9e69
push 0x20
push ecx
lea ecx, [esp + 0x20]
push ecx
call fcn.004c0840
add esp, 4
add eax, 0x440
push eax
lea edx, [esp + 0x9ac]
push edx
call fcn.004f8077
add esp, 0xc
mov dword [esp + 0x30], 1
jmp 0x4b9e69
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
lea esi, [ebx + 0x40]
push ecx
call fcn.004c0980
mov edi, dword [esp + 0x40]
mov ebp, dword [esi + 0x18]
mov esi, dword [esi]
test edi, edi
je 0x4b9d42
cmp edi, esi
je 0x4b9d47
call fcn.004f825e
mov esi, dword [esp + 0x44]
cmp esi, ebp
je 0x4b9e69
test edi, edi
jne 0x4b9e0c
call fcn.004f825e
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x4b9d6c
call fcn.004f825e
xor ecx, ecx
lea eax, [esi + 0x58]
test eax, eax
setne cl
test ecx, ecx
je 0x4ba20a
mov edx, dword [esp + 0x1c]
push eax
push edx
call fcn.004f69f9
add esp, 8
test eax, eax
jne 0x4b9e69
test edi, edi
jne 0x4b9e13
call fcn.004f825e
cmp esi, dword [edi + 0x18]
jne 0x4b9da7
call fcn.004f825e
push 0x3fc8
add esi, 0x18
lea eax, [esp + 0x568]
push esi
push eax
call fcn.00500790
mov eax, dword [esp + 0x3e88]
mov esi, 1
add esp, 0xc
cmp eax, esi
je 0x4b9dfb
cmp eax, 3
je 0x4b9dfb
call fcn.004b8a90
test eax, eax
je 0x4b9de8
cmp dword [esp + 0x3e7c], 4
je 0x4b9dfb
call fcn.004b8b70
test eax, eax
je 0x4b9e17
cmp dword [esp + 0x3e7c], 5
jne 0x4b9e17
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4b9e1b
mov dword [esp + 0x3e7c], eax
jmp 0x4b9e65
mov eax, dword [edi]
jmp 0x4b9d62
mov edi, dword [edi]
jmp 0x4b9d9d
mov eax, dword [esp + 0x24]
cmp eax, esi
jne 0x4b9e28
mov dword [esp + 0x3e7c], esi
jmp 0x4b9e65
cmp eax, 3
jne 0x4b9e36
mov dword [esp + 0x3e7c], eax
jmp 0x4b9e65
call fcn.004b8a90
test eax, eax
je 0x4b9e4a
mov eax, 4
cmp dword [esp + 0x24], eax
je 0x4b9e5e
call fcn.004b8b70
test eax, eax
je 0x4b9e65
mov eax, 5
cmp dword [esp + 0x24], eax
jne 0x4b9e65
mov dword [esp + 0x3e7c], eax
mov dword [esp + 0x30], esi
mov ebp, dword [esp + 0x60]
mov edi, dword [esp + 0x48]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0xfc]
push edx
lea esi, [esp + 0x50]
call fcn.004c1080
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x4b9e93
cmp eax, edi
je 0x4b9e98
call fcn.004f825e
cmp dword [esi + 4], ebp
jne 0x4b998f
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
sub esp, 8
mov ebx, esp
mov dword [esp + 0x40], esp
push eax
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x44], esp
mov ebp, esp
call eax
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x4b9ee1
cmp eax, dword [edi]
jne 0x4b9ee1
mov esi, edi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4b9f1c
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x4ba205
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.004f745a
add esp, 0x10
add esi, 0x10
mov dword [ebp], esi
mov esi, ebx
call fcn.004c3050
mov byte [esp + 0x454c], 9
mov esi, dword [esp + 0x28]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 4
mov dword [esp + 0x40], esp
mov ebx, esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x4b9f65
cmp eax, dword [esi]
jne 0x4b9f65
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4b9fa0
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4ba205
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004f745a
add esp, 0x10
add edi, 0x10
mov dword [ebx], edi
lea esi, [esp + 0xb4]
mov byte [esp + 0x4548], 7
call fcn.004c30d0
add esp, 0xc
mov ebx, eax
mov byte [esp + 0x453c], 0xa
mov esi, dword [ebx]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
sub esi, 0x10
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x4b9fef
cmp eax, dword [esi]
jne 0x4b9fef
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4ba02a
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4ba205
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004f745a
add esp, 0x10
add edi, 0x10
mov dword [esp + 0x68], edi
mov byte [esp + 0x453c], 0xb
mov esi, dword [ebx + 4]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
sub esi, 0x10
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x4ba063
cmp eax, dword [esi]
jne 0x4ba063
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4ba09e
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4ba205
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004f745a
add esp, 0x10
mov ecx, dword [ebx + 8]
add edi, 0x10
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], ecx
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x4c]
push eax
lea ebx, [esp + 0x108]
mov byte [esp + 0x4544], 0xc
call fcn.004c0f50
mov byte [esp + 0x453c], 0xa
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ba0f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ba112
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x453c], 7
mov eax, dword [esp + 0xac]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ba13d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xa8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b998f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4b998f
mov ebp, dword [esp + 0x30]
cmp ebp, ebx
jne 0x4ba214
cmp dword [esp + 0x3c], ebx
jne 0x4ba214
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
lea eax, [esp + 0xc0]
push eax
call edx
push 0
call fcn.004f8fbf
mov ecx, dword [esp + 0xd4]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0xe8]
mov edx, dword [eax]
push eax
push ecx
push edx
push ecx
lea eax, [esp + 0xc4]
push eax
lea eax, [esp + 0xe4]
call fcn.0042eff0
lea ebx, [esp + 0x74]
lea eax, [esp + 0xd0]
call fcn.004c1650
lea ecx, [esp + 0x94]
push ecx
mov byte [esp + 0x4540], 3
call fcn.004bac00
sub esi, dword [esp + 0xbc]
mov edx, dword [esp + 0x2c]
xor ebx, ebx
cmp esi, dword [edx + 0xf8]
ja 0x4ba231
jmp 0x4b9816
call fcn.00407390
push 0x80004005
call fcn.00401050
lea eax, [esp + 0x94]
push eax
mov byte [esp + 0x4540], 3
call fcn.004bac00
cmp ebp, ebx
jne 0x4ba7bc
mov ecx, dword [esp + 0x60]
mov edx, dword [ecx + 4]
push edx
lea ecx, [esp + 0x4c]
call fcn.004c1750
mov eax, dword [esp + 0x60]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x64], ebx
mov dword [eax], eax
mov eax, dword [esp + 0x60]
mov dword [eax + 8], eax
mov eax, dword [esp + 0x8c]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [esp + 0x78]
call fcn.004302e0
mov eax, dword [esp + 0x8c]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x90], ebx
mov dword [eax], eax
mov eax, dword [esp + 0x8c]
lea edx, [esp + 0x94]
push edx
mov dword [eax + 8], eax
call fcn.004b7fb0
mov byte [esp + 0x453c], 0xd
jmp 0x4ba2b0
xor edi, edi
cmp dword [esp + 0xa4], edi
jne 0x4ba2c8
cmp dword [esp + 0x94], edi
je 0x4ba7a1
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x20]
push eax
lea esi, [esp + 0x98]
call fcn.004c0c90
mov byte [esp + 0x453c], 0xe
mov edx, dword [0x6285c4]
mov eax, dword [edx + 0xc]
mov ecx, 0x6285c4
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x453c], 0xf
mov edx, dword [0x6285c4]
mov eax, dword [edx + 0xc]
mov ecx, 0x6285c4
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
mov byte [esp + 0x4540], 0x10
mov eax, dword [esp + 0x24]
push edx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x44], esp
mov esi, esp
call fcn.004073f0
add eax, 0x10
mov dword [esi], eax
call fcn.004beff0
add esp, 0xc
cmp eax, edi
jne 0x4ba3d6
mov byte [esp + 0x453c], 0xf
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ba37d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x453c], 0xe
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ba3a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x453c], 0xd
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ba2b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4ba2b0
push 0x40
lea ecx, [esp + 0x124]
push edi
push ecx
mov dword [esp + 0x120], edi
call fcn.004fe380
add esp, 0xc
push 0x400
lea edx, [esp + 0x164]
push edi
push edx
call fcn.004fe380
mov ebx, dword [esp + 0x28]
add esp, 0xc
push 0x20
lea eax, [esp + 0x124]
push ebx
push eax
mov dword [esp + 0x124], edi
mov dword [esp + 0x128], edi
call fcn.004f8077
mov ebp, dword [esp + 0x24]
add esp, 0xc
push 0x200
lea ecx, [esp + 0x164]
push ebp
push ecx
call fcn.004f8077
add esp, 0xc
lea edx, [esp + 0x74]
push edx
lea ecx, [esp + 0x1c]
call fcn.004c0a00
cmp dword [esp + 0x30], 0
mov ecx, 0x113
lea esi, [esp + 0x114]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
je 0x4ba49e
lea eax, [ebp - 0x10]
mov byte [esp + 0x453c], 0xf
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ba48e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x453c], 0xe
lea eax, [ebx - 0x10]
jmp 0x4ba38c
cmp dword [esp + 0x4544], 0
jne 0x4ba519
mov esi, dword [esp + 0x2c]
mov ebp, dword [esi + 0xa0]
mov ebx, dword [esi + 0x88]
lea ecx, [esp + 0x18]
add esi, 0x88
push ecx
lea edx, [esp + 0xb8]
push edx
call fcn.004c0c10
mov edi, eax
mov eax, dword [edi]
test eax, eax
je 0x4ba4dc
cmp eax, ebx
je 0x4ba4e1
call fcn.004f825e
cmp dword [edi + 4], ebp
je 0x4ba519
push esi
lea ecx, [esp + 0x1c]
call fcn.004c0a00
add eax, 0xc
mov ecx, 0
setne cl
test ecx, ecx
je 0x4ba20a
push eax
mov eax, dword [esp + 0x20]
push eax
call fcn.004f69f9
add esp, 8
test eax, eax
je 0x4ba355
mov ebp, dword [esp + 0x2c]
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0xfc]
push edx
mov esi, ebp
call fcn.0042cf90
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x4ba543
cmp eax, edi
je 0x4ba548
call fcn.004f825e
cmp dword [esi + 4], ebx
je 0x4ba558
cmp dword [esp + 0x24], 0
je 0x4ba355
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x44]
lea esi, [ebp + 0x40]
push edx
call fcn.004c0980
mov edi, dword [esp + 0x40]
mov ebx, dword [esi + 0x18]
mov esi, dword [esi]
test edi, edi
je 0x4ba57b
cmp edi, esi
je 0x4ba580
call fcn.004f825e
mov esi, dword [esp + 0x44]
cmp esi, ebx
je 0x4ba62d
test edi, edi
jne 0x4ba622
call fcn.004f825e
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x4ba5a5
call fcn.004f825e
xor ecx, ecx
lea eax, [esi + 0x58]
test eax, eax
setne cl
test ecx, ecx
je 0x4ba20a
mov ebp, dword [esp + 0x18]
push eax
push ebp
call fcn.004f69f9
add esp, 8
test eax, eax
jne 0x4ba631
test edi, edi
jne 0x4ba629
call fcn.004f825e
cmp esi, dword [edi + 0x18]
jne 0x4ba5dc
call fcn.004f825e
push 0x3fc8
add esi, 0x18
lea eax, [esp + 0x568]
push esi
push eax
call fcn.00500790
mov eax, dword [esp + 0x3e88]
add esp, 0xc
cmp eax, 1
je 0x4ba606
cmp eax, 3
jne 0x4ba618
cmp dword [esp + 0x24], 0
jne 0x4ba618
mov dword [esp + 0x3e7c], 0
mov dword [esp + 0x30], 1
jmp 0x4ba631
mov eax, dword [edi]
jmp 0x4ba59b
mov edi, dword [edi]
jmp 0x4ba5d2
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x60]
mov edi, dword [esp + 0x48]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0xf4]
push edx
lea esi, [esp + 0x50]
call fcn.004c1080
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x4ba65b
cmp eax, edi
je 0x4ba660
call fcn.004f825e
cmp dword [esi + 4], ebx
jne 0x4ba791
mov eax, dword [esp + 0x24]
sub esp, 8
mov esi, esp
mov dword [esp + 0x40], esp
push eax
push ecx
lea eax, [ebp - 0x10]
mov dword [esp + 0x44], esp
mov edi, esp
call fcn.004073f0
add eax, 0x10
mov dword [edi], eax
call fcn.004c3050
mov byte [esp + 0x454c], 0x11
mov eax, dword [esp + 0x2c]
add esp, 4
add eax, 0xfffffff0
mov dword [esp + 0x40], esp
mov esi, esp
call fcn.004073f0
add eax, 0x10
mov dword [esi], eax
lea esi, [esp + 0xb4]
mov byte [esp + 0x4548], 0x10
call fcn.004c30d0
add esp, 0xc
lea ecx, [esp + 0x68]
push ecx
mov edi, eax
mov byte [esp + 0x4540], 0x12
call fcn.004c2fc0
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x4c]
push eax
lea ebx, [esp + 0x108]
mov byte [esp + 0x4544], 0x13
call fcn.004c0f50
mov byte [esp + 0x453c], 0x12
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ba723
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ba743
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x453c], 0x10
mov eax, dword [esp + 0xac]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ba76e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xa8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ba791
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x453c], 0xf
lea eax, [ebp - 0x10]
jmp 0x4ba364
lea ecx, [esp + 0x94]
push ecx
mov byte [esp + 0x4540], 3
call fcn.004bac00
mov ebp, dword [esp + 0x30]
xor ebx, ebx
mov edi, dword [esp + 0x2c]
lea edx, [esp + 0x74]
lea esi, [edi + 0x88]
cmp esi, edx
je 0x4ba7f5
mov eax, dword [esi + 0x18]
mov ecx, dword [esi]
mov edx, dword [eax]
push eax
push ecx
push edx
push ecx
lea eax, [esp + 0xc4]
push eax
mov eax, esi
call fcn.0042eff0
lea ebx, [esp + 0x74]
mov eax, esi
call fcn.004c1650
xor ebx, ebx
cmp ebp, ebx
jne 0x4ba823
cmp dword [esp + 0x64], ebx
jbe 0x4bab40
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x568]
push edx
lea eax, [esp + 0x50]
push eax
push edi
call fcn.004bb0c0
cmp eax, ebx
je 0x4ba9d1
mov ecx, dword [edi + 0x60]
add edi, 0x60
cmp dword [ecx - 0xc], ebx
jne 0x4bab54
push 1
push ecx
mov edx, esp
mov dword [esp + 0x40], esp
push edx
lea ecx, [esp + 0x5b0]
call fcn.004066b0
push ecx
mov byte [esp + 0x4548], 0x14
mov eax, esp
mov dword [esp + 0x40], esp
push eax
lea ecx, [esp + 0x574]
call fcn.004066b0
lea ecx, [esp + 0x34]
mov byte [esp + 0x4548], 3
call fcn.004bc710
mov byte [esp + 0x453c], 0x15
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x4ba8f3
cmp eax, 0x19
jg 0x4ba8f3
xor eax, eax
mov dword [esp + 0x9a4], eax
mov dword [esp + 0x9a8], eax
mov dword [esp + 0x9ac], eax
mov dword [esp + 0x9b0], eax
mov dword [esp + 0x9b4], eax
mov dword [esp + 0x9b8], eax
mov dword [esp + 0x9bc], eax
mov dword [esp + 0x9c0], eax
cmp dword [ecx - 4], 1
mov esi, dword [ecx - 0xc]
jle 0x4ba8e1
mov ecx, esi
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00407090
mov ecx, dword [esp + 0x28]
push esi
push ecx
lea eax, [esp + 0x9ac]
push eax
call fcn.004f8077
add esp, 0xc
lea edx, [esp + 0x5a4]
call fcn.00406780
mov ebx, dword [esp + 0x2c]
mov ecx, dword [ebx + 0x20]
mov ebp, dword [ebx + 0x38]
add ebx, 0x20
push edi
lea edx, [esp + 0xb8]
push edx
mov esi, ebx
mov dword [esp + 0x4530], 0
mov dword [esp + 0x48], ecx
call fcn.0047c9a0
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x4ba939
cmp eax, dword [esp + 0x40]
je 0x4ba93e
call fcn.004f825e
cmp dword [esi + 4], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x4ba95c
push edi
call fcn.0047c850
mov esi, eax
call ebp
sub eax, dword [esi]
cmp eax, 0x1388
jbe 0x4ba984
push edi
call fcn.0047c850
mov esi, eax
call ebp
mov dword [esi], eax
mov ecx, dword [esp + 0x454c]
lea eax, [esp + 0x564]
push eax
push 3
push ecx
call dword [esp + 0x4554]
add esp, 0xc
mov eax, dword [esp + 0x454c]
lea edx, [esp + 0x564]
push edx
push 1
push eax
call dword [esp + 0x4554]
mov byte [esp + 0x4548], 3
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4bab54
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4bab54
cmp dword [esp + 0x64], ebx
jbe 0x4bab40
mov ecx, dword [esp + 0x60]
mov ebp, dword [ecx]
mov edi, dword [esp + 0x48]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], edi
lea ecx, [ecx]
mov esi, dword [esp + 0x60]
cmp edi, ebx
je 0x4ba9fe
cmp edi, dword [esp + 0x48]
je 0x4baa03
call fcn.004f825e
cmp ebp, esi
je 0x4bab40
cmp edi, ebx
jne 0x4bab35
call fcn.004f825e
xor eax, eax
cmp ebp, dword [eax + 0x18]
jne 0x4baa24
call fcn.004f825e
mov eax, dword [ebp + 0xc]
sub eax, 0x10
call fcn.004073f0
add eax, 0x10
mov dword [esp + 0x28], eax
lea edi, [esp + 0x28]
mov byte [esp + 0x453c], 0x16
call fcn.0042ca00
mov esi, dword [esp + 0x28]
cmp dword [esi - 0xc], ebx
jl 0x4baa8f
push str.VID_05AC
push esi
call fcn.004f7373
add esp, 8
cmp eax, ebx
je 0x4baa8f
sub eax, esi
sar eax, 1
js 0x4baa8f
mov eax, dword [esp + 0x454c]
lea edx, [esp + 0x564]
push edx
push 5
push eax
mov dword [esp + 0x4534], 1
call dword [esp + 0x4554]
add esp, 0xc
lea ecx, [esp + 0x564]
push ecx
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x40], esp
mov edi, esp
call fcn.004073f0
add eax, 0x10
mov dword [edi], eax
mov edi, dword [esp + 0x34]
mov ebx, edi
call fcn.004bfed0
test eax, eax
je 0x4baafc
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4bab3c
call fcn.004f825e
xor eax, eax
cmp ebp, dword [eax + 0x18]
jne 0x4baad5
call fcn.004f825e
lea eax, [ebp + 0x10]
add edi, 0x64
call fcn.00406fe0
mov eax, dword [esp + 0x454c]
lea edx, [esp + 0x564]
push edx
push 0xb
push eax
call dword [esp + 0x4554]
add esp, 0xc
mov byte [esp + 0x453c], 3
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4bab1d
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
lea esi, [esp + 0x20]
call fcn.004c2f50
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
xor ebx, ebx
jmp 0x4ba9f0
mov eax, dword [edi]
jmp 0x4baa1a
mov eax, dword [eax]
jmp 0x4baacb
mov eax, dword [esp + 0x454c]
push ebx
push ebx
push eax
call dword [esp + 0x4554]
add esp, 0xc
mov esi, dword [esp + 0x2c]
mov ecx, esi
call fcn.004be0b0
push esi
call fcn.004be990
lea esi, [esp + 0xd0]
mov byte [esp + 0x453c], 0x17
call fcn.0042e150
mov ecx, dword [esp + 0xd0]
push ecx
call fcn.004f6734
add esp, 4
lea edx, [esp + 0x74]
push edx
mov byte [esp + 0x4540], 1
call fcn.0042d200
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0x4540], 0
call fcn.004c0f00
lea ecx, [esp + 0xc0]
push ecx
mov dword [esp + 0x4540], 0xffffffff
call fcn.0041a430
mov ecx, dword [esp + 0x4534]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4518]
xor ecx, esp
call fcn.004f673f
add esp, 0x452c
ret 0xc