Function at 0x41eaf0
Capabilities:
Check for time delay via gettickcount
Create process on windows
Read .ini file
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a4ad8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x610
mov eax, dword [0x4cbba0]
xor eax, ebp
push ebx
mov dword [esp + 0x60c], eax
mov eax, dword [ebp + 8]
cmp eax, 1
push esi
push edi
mov esi, ecx
jne 0x41ebdf
cmp dword [0x4cc5e8], 3
jge 0x41f81f
mov ecx, 0x4cc110
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
lea ecx, [esp + 0x20]
call dword [0x4ab700]
mov ecx, 0x4cc2b0
mov dword [esp + 0x624], 0
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
lea ecx, [esp + 0x1c]
call dword [0x4ab700]
mov eax, dword [0x4cc10c]
test eax, eax
mov byte [esp + 0x624], 1
jbe 0x41ebc6
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
push ecx
lea edx, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
mov byte [esp + 0x630], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
mov eax, dword [0x4cc10c]
push eax
mov ecx, esi
mov byte [esp + 0x630], 1
call fcn.00413070
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
jmp 0x41f81f
cmp eax, 0x458
jne 0x41ec77
mov ecx, dword [esi + 0x548]
test ecx, ecx
je 0x41f81f
call fcn.00438b80
test eax, eax
je 0x41f81f
mov ecx, dword [esi + 0x548]
mov edx, dword [ecx + 0x2c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x548]
test ecx, ecx
je 0x41ec28
mov eax, dword [ecx]
push 1
call dword [eax + 4]
push 0x8c
call sub.MFC71.DLL_operator_new_1
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x624], 3
je 0x41ec52
push esi
mov ecx, eax
call fcn.00438b10
jmp 0x41ec54
xor eax, eax
push 0
push 0
push 0
mov ecx, eax
mov dword [esp + 0x630], 0xffffffff
mov dword [esi + 0x548], eax
call sub.MFC71.DLL_CWinThread::CreateThread
jmp 0x41f81f
cmp eax, 2
jne 0x41ed88
mov ecx, 0x4cc840
call fcn.0042fc10
mov eax, dword [esi + 0x174]
xor ebx, ebx
cmp eax, ebx
mov edi, 4
jne 0x41ed0e
cmp dword [0x4cc5e8], edi
jne 0x41ed0e
lea ecx, [esp + 0x14]
mov dword [esi + 0x174], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
mov ecx, dword [0x4cc10c]
mov edx, dword [0x4cbdc0]
push ecx
push edx
lea eax, [esp + 0x1c]
push str._sconfig_transmit_d.xml
push eax
mov dword [esp + 0x634], edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0x10
push ebx
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetBuffer_1]
push eax
mov ecx, esi
call fcn.00419010
mov ecx, esi
call fcn.0041cf20
lea ecx, [esp + 0x14]
mov dword [esp + 0x624], 0xffffffff
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, 0x4cc840
call fcn.00431ec0
cmp eax, 0xffffffff
je 0x41f81f
cmp dword [0x4cc5e8], edi
jne 0x41f81f
cmp dword [esi + 0x178], ebx
je 0x41ed7d
mov ecx, dword [esi + 0x17c]
inc ecx
mov eax, ecx
mov dword [esi + 0x17c], ecx
cdq
mov ecx, 0x1e
idiv ecx
test edx, edx
jne 0x41ed64
mov ecx, esi
call fcn.0040d090
mov ecx, esi
mov dword [esi + 0x178], eax
call fcn.0041a270
mov edx, dword [esi + 0x17c]
cmp edx, dword [esi + 0x55c]
jl 0x41f81f
mov ecx, esi
call fcn.0041dfe0
mov dword [esi + 0x17c], ebx
jmp 0x41f81f
cmp eax, 3
jne 0x41ee25
mov eax, dword [esi + 0x394]
test eax, eax
je 0x41ee14
cmp dword [eax + 0x23c], 1
jne 0x41ee14
mov eax, dword [0x4cbc38]
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push eax
call edi
test eax, eax
jne 0x41edc7
mov ecx, dword [0x4cbc3c]
push ecx
call edi
test eax, eax
je 0x41f81f
mov edx, dword [esi + 0x394]
push 2
push edx
mov ecx, esi
call fcn.0041a3a0
cmp eax, 1
jne 0x41eded
mov eax, dword [esi + 0x20]
push 3
push eax
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x41f81f
cmp eax, 2
jne 0x41f81f
push 0x4af218
call fcn.0049aab0
mov ecx, dword [esi + 0x20]
add esp, 4
push 3
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x41f81f
mov edx, dword [esi + 0x20]
push 3
push edx
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x41f81f
cmp eax, 6
jne 0x41ef0d
mov eax, dword [0x4cbc38]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_IsWindow]
je 0x41ee44
push eax
call edi
test eax, eax
jne 0x41ee5c
mov eax, dword [0x4cbc3c]
test eax, eax
je 0x41f81f
push eax
call edi
test eax, eax
je 0x41f81f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
cmp edi, dword [esi + 0x4b4]
jb 0x41f81f
mov eax, dword [esi + 0x394]
test eax, eax
je 0x41eed0
cmp dword [eax + 0x24], 4
jne 0x41eed0
mov ecx, dword [esi + 0x160]
push eax
call fcn.00405160
mov ecx, dword [esi + 0x394]
push eax
lea eax, [ecx + 0x244]
push eax
push ecx
mov ecx, 0x4cbda8
call fcn.00466600
mov eax, dword [esi + 0x4b4]
test eax, eax
jne 0x41eec0
add edi, 0x1b7740
mov dword [esi + 0x4b4], edi
jmp 0x41f81f
add eax, 0x1b7740
mov dword [esi + 0x4b4], eax
jmp 0x41f81f
xor eax, eax
push 3
mov ecx, 0x103
lea edi, [esp + 0x1fc]
rep stosd dword es:[edi], eax
push eax
lea ecx, [esp + 0x200]
push ecx
mov ecx, esi
mov dword [esp + 0x608], 0x40c
mov dword [esp + 0x204], 0x14
call fcn.0040cbb0
jmp 0x41f81f
mov ebx, 5
cmp eax, ebx
jne 0x41ef5d
call fcn.00407e20
call fcn.00407e60
mov eax, dword [0x4cbc38]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_IsWindow]
je 0x41ef3a
push eax
call edi
test eax, eax
jne 0x41f81f
mov eax, dword [0x4cbc3c]
test eax, eax
je 0x41ef4e
push eax
call edi
test eax, eax
jne 0x41f81f
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x158]
jmp 0x41f81f
cmp eax, 7
jne 0x41ef6e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x68]
jmp 0x41f81f
cmp eax, 8
jne 0x41ef9e
lea ecx, [esp + 0x1f8]
push ecx
mov ecx, dword [esi + 0x160]
call fcn.00405590
push 0
lea edx, [esp + 0x1fc]
push edx
push 0
mov ecx, esi
call fcn.0040b5c0
jmp 0x41f81f
cmp eax, 0xa
jne 0x41f015
call fcn.00407e20
call fcn.00407e60
mov eax, dword [0x4cbc38]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
xor edi, edi
cmp eax, edi
je 0x41efc5
push eax
call esi
test eax, eax
jne 0x41eff9
mov eax, dword [0x4cbc3c]
cmp eax, edi
je 0x41efd5
push eax
call esi
test eax, eax
jne 0x41eff9
mov eax, dword [0x4ccb50]
mov dword [eax + 0x71c], 0x1e
mov ecx, dword [0x4ccb50]
mov dword [ecx + 0x720], 0x19
jmp 0x41f81f
mov edx, dword [0x4ccb50]
mov dword [edx + 0x71c], edi
mov eax, dword [0x4ccb50]
mov dword [eax + 0x720], edi
jmp 0x41f81f
cmp eax, 0x11
jne 0x41f031
mov ecx, dword [esi + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, esi
call fcn.0040cb70
jmp 0x41f81f
cmp eax, 9
jne 0x41f125
mov ecx, dword [esi + 0x3a4]
xor eax, eax
cmp ecx, eax
mov dword [esp + 0x14], eax
jle 0x41f10c
mov ebx, eax
jmp 0x41f060
xor eax, eax
jmp 0x41f060
fld qword [0x4af210]
push ebx
lea ecx, [esi + 0x39c]
fstp qword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
call fcn.004097f0
mov edi, eax
test edi, edi
je 0x41f0f7
cmp dword [edi + 0x24], 4
jne 0x41f0f7
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esi + 0x160]
push edi
call fcn.00404a50
test eax, eax
je 0x41f0f7
fld qword [esp + 0x28]
xor ebx, ebx
mov bh, byte [edi + 1]
push 0
mov bl, byte [edi]
shl ebx, 0x10
call fcn.004a1970
movzx edx, ax
mov eax, dword [edi + 0x22c]
or ebx, edx
push ebx
push eax
push 0x7e7
call fcn.00408d90
mov ebx, dword [esp + 0x24]
add esp, 0x10
mov eax, dword [esi + 0x3a4]
inc ebx
cmp ebx, eax
mov dword [esp + 0x14], ebx
jl 0x41f052
xor eax, eax
mov ecx, dword [esi + 0x20]
push 3
push eax
push ecx
push 0x71e
call fcn.00408d90
add esp, 0x10
jmp 0x41f81f
cmp eax, 0xb
jne 0x41f136
mov ecx, esi
call fcn.0041cf20
jmp 0x41f81f
cmp eax, 0xd
jne 0x41f1cd
call fcn.00407e20
call fcn.00407e60
mov eax, dword [0x4cbc38]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_IsWindow]
je 0x41f163
push eax
call edi
test eax, eax
jne 0x41f81f
mov eax, dword [0x4cbc3c]
test eax, eax
je 0x41f177
push eax
call edi
test eax, eax
jne 0x41f81f
mov edx, dword [esi + 0x20]
push 0xd
push edx
call dword [sym.imp.USER32.dll_KillTimer]
push 0
lea ecx, [esp + 0x8c]
call fcn.0044d3b0
lea ecx, [esp + 0x88]
mov dword [esp + 0x624], ebx
call sub.MFC71.DLL_CDialog::DoModal
cmp eax, 1
jne 0x41f1b1
push eax
mov ecx, esi
call fcn.0040dd70
lea ecx, [esp + 0x88]
mov dword [esp + 0x624], 0xffffffff
call fcn.0044d290
jmp 0x41f81f
cmp eax, 0xe
jne 0x41f205
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x4dc]
test eax, eax
je 0x41f81f
mov eax, dword [esi + 0x160]
test eax, eax
je 0x41f81f
mov ecx, esi
call fcn.0040c9d0
jmp 0x41f81f
cmp eax, 0x14
jne 0x41f271
mov ecx, dword [0x4ccb50]
cmp dword [ecx + 0x840], 4
jne 0x41f260
mov ecx, dword [esi + 0x160]
test ecx, ecx
je 0x41f260
push 0
call fcn.00406130
test eax, eax
jl 0x41f81f
mov ecx, 0x4cca18
call fcn.0043af00
mov edx, dword [esi + 0x20]
push 0x14
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x20]
push 0
push 0x1036640
push 0x14
push eax
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x41f81f
mov ecx, dword [esi + 0x20]
push 0x14
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x41f81f
cmp eax, 0x15
jne 0x41f541
mov edx, dword [esi + 0x20]
push eax
push edx
call dword [sym.imp.USER32.dll_KillTimer]
push str.configconfig.ini
lea eax, [esp + 0x1c]
push 0x4cbdc0
push eax
call fcn.004010a0
add esp, 0xc
lea ecx, [esp + 0x18]
mov dword [esp + 0x624], 6
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0xc
lea ecx, [esp + 0x610]
push ecx
push 0x4acbb2
push str.LASTUPDATE
push str.ADVISE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x608]
push edx
lea ecx, [esp + 0x18]
call dword [0x4ab700]
lea ecx, [esp + 0x14]
mov byte [esp + 0x624], 7
xor edi, edi
xor ebx, ebx
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::IsEmpty]
test al, al
mov esi, dword [sym.imp.MSVCR71.dll_atoi]
jne 0x41f3db
push 4
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Left]
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call esi
add esp, 4
lea ecx, [esp + 0x10]
mov edi, eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
push 2
push 4
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Mid_1]
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call esi
add esp, 4
lea ecx, [esp + 0x10]
mov ebx, eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
push 2
push 6
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Mid_1]
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call esi
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
push 2
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Right]
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call esi
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push 0xffffffffffffffff
push 0
push 0
push ecx
push edx
push ebx
push edi
lea ecx, [esp + 0x4c]
call fcn.00407ad0
mov edi, dword [eax]
mov ebx, dword [eax + 4]
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0xa
lea eax, [esp + 0x610]
push eax
push 0x4af1fc
push str.NEXTUPDATE
push str.ADVISE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x608]
push ecx
call esi
add esp, 4
lea edx, [esp + 0x28]
push edx
mov esi, eax
call fcn.00409de0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
push 0
sub eax, edi
push 0xe10
sbb ecx, ebx
push ecx
push eax
call fcn.004a18c0
cmp eax, esi
jge 0x41f44b
cmp eax, 0xa8
jge 0x41f44b
test eax, eax
jge 0x41f528
call fcn.00407e20
mov eax, dword [0x4cbc38]
test eax, eax
je 0x41f468
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x41f528
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x3c], eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
mov ecx, dword [0x4cc908]
mov edx, dword [0x4cbdc0]
push ecx
push edx
lea eax, [esp + 0x24]
push str._s_s.exe___update_
push eax
mov byte [esp + 0x634], 9
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0x10
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x44]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x400
lea ecx, [esp + 0x40]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetBuffer_1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x34]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x41f509
push eax
call esi
mov eax, dword [esp + 0x30]
test eax, eax
je 0x41f514
push eax
call esi
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
jmp 0x41f81f
cmp eax, 0x16
jne 0x41f5b4
mov ecx, esi
call fcn.00408b80
test eax, eax
je 0x41f81f
mov ecx, esi
call fcn.00410f20
test eax, eax
je 0x41f81f
mov eax, dword [esi + 0x20]
push 0x16
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push str.configconfig.ini
lea ecx, [esp + 0x14]
push 0x4cbdc0
push ecx
call fcn.004010a0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x4add00
push str.CodecNeedReg
push 0x4ac6b4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
jmp 0x41f81f
cmp eax, 0x1ca5
jne 0x41f656
push str.plan:IDT_EXIT_APP_timer_enter
call fcn.0049aab0
mov eax, dword [esi + 0x568]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
add esp, 4
test eax, eax
jg 0x41f5e7
mov edx, dword [esi + 0x20]
push 0x1ca5
push edx
call edi
mov al, byte [esi + 0x564]
test al, al
je 0x41f81f
push str.plan:IDT_EXIT_APP_start
call fcn.0049aab0
mov eax, dword [esi + 0x568]
add esp, 4
dec eax
mov dword [esi + 0x568], eax
jne 0x41f81f
mov eax, dword [esi + 0x20]
push 0x1ca5
push eax
call edi
mov dword [esi + 0x180], 1
cmp dword [0x4cbc34], 2
jne 0x41f637
push 1
jmp 0x41f639
push 0
push 0
push 0xb
push 0x10
call fcn.00408d90
mov edx, dword [esi]
add esp, 0x10
mov ecx, esi
call dword [edx + 0x158]
jmp 0x41f81f
cmp eax, 0x1ca6
jne 0x41f6ca
push str.plan:IDT_CLOSE_SYSTEM_timer_enter
call fcn.0049aab0
mov eax, dword [esi + 0x56c]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
add esp, 4
test eax, eax
jg 0x41f685
mov eax, dword [esi + 0x20]
push 0x1ca6
push eax
call edi
mov al, byte [esi + 0x565]
test al, al
je 0x41f81f
push str.plan:IDT_CLOSE_SYSTEM_start
call fcn.0049aab0
mov eax, dword [esi + 0x56c]
add esp, 4
dec eax
mov dword [esi + 0x56c], eax
jne 0x41f81f
mov ecx, dword [esi + 0x20]
push 0x1ca6
push ecx
call edi
mov ecx, esi
call fcn.00409600
jmp 0x41f81f
cmp eax, 0x1ca8
jne 0x41f798
call fcn.00407e20
call fcn.00407e60
mov edx, dword [0x4cbc38]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push edx
call ebx
test eax, eax
jne 0x41f776
mov edi, dword [esi + 0x4e4]
test edi, edi
je 0x41f712
mov eax, edi
mov eax, dword [eax + 8]
mov edi, dword [edi]
push eax
call ebx
test eax, eax
jne 0x41f754
test edi, edi
jne 0x41f700
mov edi, dword [esi + 0x4ec]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0xf4240
div ecx
push edx
push edi
push 0x4af128
call fcn.0049aab0
mov edx, dword [esi + 0x20]
add esp, 0xc
push 0x1ca8
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x158]
jmp 0x41f81f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0xf4240
div ecx
push edx
push str._r_n_web
call fcn.0049aab0
add esp, 8
jmp 0x41f81f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0xf4240
div ecx
push edx
push 0x4af100
call fcn.0049aab0
add esp, 8
jmp 0x41f81f
cmp eax, 0x1ca7
jne 0x41f818
mov eax, dword [0x4cc934]
test eax, eax
jne 0x41f7de
mov ecx, esi
call fcn.0040d090
test eax, eax
je 0x41f7de
mov eax, dword [esi + 0x570]
test eax, eax
jg 0x41f7d5
mov edx, dword [esi + 0x20]
push 0x1ca7
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, esi
call fcn.00409600
jmp 0x41f81f
dec eax
mov dword [esi + 0x570], eax
jmp 0x41f81f
lea eax, [esp + 0x30]
push eax
call fcn.00409de0
lea ecx, [esp + 0x30]
call fcn.00407c30
test eax, eax
jl 0x41f7fa
cmp eax, 6
jle 0x41f804
cmp eax, 0x17
jl 0x41f810
cmp eax, 0x18
jg 0x41f810
mov dword [esi + 0x570], 0x1e
jmp 0x41f81f
mov dword [esi + 0x570], ebx
jmp 0x41f81f
mov ecx, esi
call sub.MFC71.DLL_CWnd::Default
mov ecx, dword [esp + 0x61c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x614]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a17d1
mov esp, ebp
pop ebp
ret 4