Function at 0x4752b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x551f20
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x57f7c4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x57f7c4]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x54]
mov ebx, ecx
movzx eax, word [ebx]
add eax, 0xfffff4fe
cmp eax, 0x19
ja case.0x4752f9.2820
jmp dword [eax*4 + 0x476004]
mov ecx, dword [ebx + 2]
cmp ecx, dword [ebp + 0xdc]
jne 0x475318
push 4
push ebp
call fcn.00475250
jmp case.0x4752f9.2828
cmp dword [ebp + 0x1638], 0
je 0x47532e
push 1
push ebp
call fcn.00475250
jmp case.0x4752f9.2828
mov edi, ebp
lea esi, [esp + 0x14]
call fcn.0044e110
mov dword [esp + 0x4c], 0
mov esi, dword [ebp + 0x17f4]
test esi, esi
je 0x475371
push ebp
call fcn.0044e260
test al, al
je 0x475361
mov eax, dword [ebp + 0x17f4]
cmp dword [eax + 0x10], 7
jl 0x475371
mov ecx, dword [ebx + 2]
push 2
push ebp
call fcn.00475250
jmp 0x475417
mov ecx, dword [ebx + 2]
push ecx
mov ecx, dword [ebp + 0xe0]
call fcn.0041c6e0
mov esi, eax
test esi, esi
jne 0x475396
mov ecx, dword [ebx + 2]
push 4
push ebp
call fcn.00475250
jmp 0x475417
mov dl, byte [esi + 0x12d]
cmp dl, byte [ebp + 0x12d]
je 0x4753b1
mov ecx, dword [ebx + 2]
push 4
push ebp
call fcn.00475250
jmp 0x475417
mov ecx, dword [esi + 0x17f4]
test ecx, ecx
jne 0x475434
cmp dword [esi + 0x17f8], ecx
jne 0x475434
cmp dword [esi + 0x1638], ecx
je 0x4753d8
mov ecx, dword [ebx + 2]
push 1
push ebp
call fcn.00475250
jmp 0x475417
mov eax, dword [ebp + 0xdc]
mov dword [esi + 0x17f8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0xb02
add eax, 0x7530
mov dword [esi + 0x58d0], eax
mov edx, dword [ebp + 0xdc]
mov word [esp + 0x1c], cx
mov dword [esp + 0x1e], edx
push 6
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.004ed0e0
mov eax, dword [esp + 0x14]
test eax, eax
je case.0x4752f9.2828
add eax, 0x118
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x4752f9.2828
mov eax, dword [ebp + 0x17f4]
test eax, eax
je 0x47544f
cmp eax, ecx
jne 0x47544f
mov ecx, dword [ebx + 2]
push 5
push ebp
call fcn.00475250
jmp 0x475417
mov ecx, dword [ebx + 2]
push 3
push ebp
call fcn.00475250
jmp 0x475417
mov edi, ebp
lea esi, [esp + 0x14]
mov byte [ebx + 0x16], 0
call fcn.0044e110
lea eax, [ebx + 2]
mov dword [esp + 0x4c], 1
call fcn.00414db0
mov edi, eax
test edi, edi
jne 0x47548d
push 4
push ebp
xor ecx, ecx
call fcn.00475250
jmp 0x475417
mov esi, dword [ebp + 0x17f4]
test esi, esi
je 0x4754c0
push ebp
call fcn.0044e260
test al, al
je 0x4754ad
mov esi, dword [ebp + 0x17f4]
cmp dword [esi + 0x10], 7
jl 0x4754c0
mov ecx, dword [edi + 0xdc]
push 2
push ebp
call fcn.00475250
jmp 0x475417
cmp dword [ebp + 0x1638], 0
je 0x4754dc
mov ecx, dword [edi + 0xdc]
push 1
push ebp
call fcn.00475250
jmp 0x475417
mov ebx, dword [edi + 0xdc]
cmp ebx, dword [ebp + 0xdc]
je 0x475505
mov eax, edi
mov ecx, ebp
call fcn.00457cf0
test al, al
je 0x475505
mov cl, byte [edi + 0x12d]
cmp cl, byte [ebp + 0x12d]
je 0x475514
push 4
push ebp
mov ecx, ebx
call fcn.00475250
jmp 0x475417
mov eax, dword [edi + 0x17f4]
test eax, eax
jne 0x475588
cmp dword [edi + 0x17f8], eax
jne 0x475588
cmp dword [edi + 0x1638], eax
je 0x47553d
push 1
push ebp
mov ecx, ebx
call fcn.00475250
jmp 0x475417
mov eax, dword [ebp + 0xdc]
mov dword [edi + 0x17f8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x7530
mov edx, 0xb09
add ebp, 0x184
lea ecx, [esp + 0x26]
mov dword [edi + 0x58d0], eax
mov word [esp + 0x24], dx
sub ecx, ebp
mov al, byte [ebp]
mov byte [ecx + ebp], al
inc ebp
test al, al
jne 0x475570
push 0x17
lea eax, [esp + 0x28]
mov ecx, edi
jmp 0x475411
test esi, esi
je 0x47559f
cmp esi, eax
jne 0x47559f
push 5
push ebp
mov ecx, ebx
call fcn.00475250
jmp 0x475417
push 3
push ebp
mov ecx, ebx
call fcn.00475250
jmp 0x475417
mov eax, dword [ebp + 0x17f8]
xor esi, esi
cmp eax, esi
je case.0x4752f9.2828
cmp dword [ebp + 0x17f4], esi
jne case.0x4752f9.2828
mov ecx, dword [ebp + 0xe0]
push eax
call fcn.0041c6e0
mov edi, eax
mov dword [ebp + 0x17f8], esi
mov dword [ebp + 0x58d0], esi
cmp edi, esi
je case.0x4752f9.2828
cmp dword [edi + 0x1638], esi
jne 0x475664
cmp dword [ebp + 0x1638], esi
jne 0x475664
cmp byte [ebx + 2], 0
jne 0x475677
lea esi, [esp + 0x1c]
call fcn.0044e110
mov dword [esp + 0x4c], 2
mov esi, dword [edi + 0x17f4]
test esi, esi
je 0x47563d
push edi
call fcn.0044e260
test al, al
je 0x475648
mov eax, esi
mov ecx, ebp
call fcn.0044ed70
test al, al
je 0x475648
mov eax, dword [esp + 0x1c]
jmp 0x47541b
mov eax, edi
call fcn.00450c80
test eax, eax
jne 0x475629
mov dword [esp + 0x4c], 0xffffffff
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x475664
add eax, 0x118
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp + 0xdc]
push 1
push edi
call fcn.00475250
jmp case.0x4752f9.2828
mov ecx, dword [ebp + 0xdc]
push esi
push edi
call fcn.00475250
jmp case.0x4752f9.2828
mov ecx, dword [ebp + 0x17f4]
test ecx, ecx
je case.0x4752f9.2828
mov eax, ebp
call fcn.0044f5f0
jmp case.0x4752f9.2828
mov esi, dword [ebp + 0x17f4]
test esi, esi
je case.0x4752f9.2828
push ebp
call fcn.0044e260
test al, al
je case.0x4752f9.2828
mov ecx, dword [ebx + 2]
push ecx
mov edi, esi
call fcn.0044e8b0
test eax, eax
je case.0x4752f9.2828
mov ecx, eax
mov ebx, esi
call fcn.00450220
jmp case.0x4752f9.2828
mov edi, ebp
lea esi, [esp + 0x1c]
call fcn.0044e110
mov dword [esp + 0x4c], 3
mov esi, dword [ebp + 0x17f4]
test esi, esi
je 0x47571e
push ebp
call fcn.0044e260
test al, al
je 0x47571e
mov edx, dword [ebx + 2]
mov eax, dword [ebp + 0x17f4]
push edx
call fcn.0044e7c0
test al, al
jne 0x475634
push 6
lea ecx, [esp + 0x18]
mov eax, 0xb07
push ecx
mov ecx, ebp
mov word [esp + 0x1c], ax
mov dword [esp + 0x1e], 0
call fcn.004ed0e0
mov eax, dword [esp + 0x1c]
jmp 0x47541b
mov eax, dword [ebp + 0x17f4]
test eax, eax
jne case.0x4752f9.2828
mov byte [ebx + 0x16], al
lea eax, [ebx + 2]
call fcn.00414ce0
mov edi, eax
test edi, edi
jne 0x475776
push ebp
xor ecx, ecx
lea edx, [eax + 0xc]
call fcn.00475280
jmp case.0x4752f9.2828
lea esi, [esp + 0x14]
call fcn.0044e110
mov dword [esp + 0x4c], 4
mov esi, dword [edi + 0x17f4]
test esi, esi
jne 0x4757a1
push ebp
xor ecx, ecx
lea edx, [esi + 0xc]
call fcn.00475280
jmp 0x475417
call fcn.0044e2f0
test eax, eax
jne 0x4757ba
push ebp
xor ecx, ecx
lea edx, [eax + 0xc]
call fcn.00475280
jmp 0x475417
mov dl, byte [ebp + 0x12d]
cmp dl, byte [edi + 0x12d]
je 0x4757d8
xor ecx, ecx
push ebp
lea edx, [ecx + 0xc]
call fcn.00475280
jmp 0x475417
mov eax, dword [edi + 0x17f4]
cmp byte [eax + 0x115], 0
jne 0x4757f7
xor ecx, ecx
push ebp
lea edx, [ecx + 0xd]
call fcn.00475280
jmp 0x475417
cmp dword [eax + 0x10], 0x1e
jl 0x47580d
xor ecx, ecx
push ebp
lea edx, [ecx + 0xe]
call fcn.00475280
jmp 0x475417
mov ebx, ebp
call fcn.004504f0
jmp 0x475417
mov edi, ebp
lea esi, [esp + 0x14]
call fcn.0044e110
mov dword [esp + 0x4c], 5
mov esi, dword [ebp + 0x17f4]
test esi, esi
je 0x475417
cmp byte [esi + 0x114], 0
je 0x475417
push ebp
call fcn.0044e260
test al, al
je 0x475417
mov eax, dword [ebx + 2]
mov edi, dword [ebp + 0x17f4]
push eax
call fcn.0044e8b0
test eax, eax
je 0x475417
mov ebx, dword [ebp + 0x17f4]
mov ecx, eax
call fcn.0044fdd0
test al, al
jmp 0x475417
mov edi, ebp
lea esi, [esp + 0x14]
call fcn.0044e110
mov dword [esp + 0x4c], 6
mov esi, dword [ebp + 0x17f4]
test esi, esi
je 0x475417
mov ecx, dword [esi + 0xc]
cmp dword [esi + ecx*8 + 0x18], ebp
jne 0x475417
cmp byte [ebx + 2], 0
je 0x475417
call fcn.0044ec70
movzx eax, byte [ebx + 2]
mov edx, dword [ebp + 0x17f4]
mov byte [edx + 0x114], al
mov ecx, dword [ebp + 0x17f4]
mov edx, dword [ebx + 4]
mov dword [ecx + 0x104], edx
movzx ecx, byte [ebx + 3]
mov eax, dword [ebp + 0x17f4]
mov byte [eax + 0x115], cl
mov esi, dword [ebp + 0x17f4]
mov edx, 0xb0e
mov word [esp + 0x24], dx
movzx eax, byte [esi + 0x114]
mov byte [esp + 0x26], al
movzx ecx, byte [esi + 0x115]
mov byte [esp + 0x27], cl
mov edx, dword [esi + 0x104]
mov dword [esp + 0x28], edx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + eax*8 + 0x14]
mov dword [esp + 0x2c], ecx
mov edx, dword [esi + 0x110]
mov eax, dword [esi + edx*8 + 0x14]
mov dword [esp + 0x30], eax
mov eax, 0x10
lea ecx, [esp + 0x24]
call fcn.0044e950
jmp 0x475417
mov edi, ebp
lea esi, [esp + 0x14]
call fcn.0044e110
mov dword [esp + 0x4c], 7
mov eax, dword [ebp + 0x17f4]
test eax, eax
je 0x475417
mov ecx, dword [eax + 0xc]
cmp dword [eax + ecx*8 + 0x18], ebp
jne 0x475417
cmp byte [eax + 0x114], 0
je 0x475417
mov edx, dword [ebx + 2]
mov dword [eax + 0x104], edx
mov ecx, dword [ebx + 2]
mov esi, dword [ebp + 0x17f4]
mov eax, 0xb0f
mov word [esp + 0x1c], ax
mov dword [esp + 0x1e], ecx
mov eax, 6
lea ecx, [esp + 0x1c]
call fcn.0044e950
jmp 0x475417
mov edi, ebp
lea esi, [esp + 0x1c]
call fcn.0044e110
mov dword [esp + 0x4c], 8
mov eax, dword [ebp + 0x17f4]
test eax, eax
je 0x475634
mov edx, dword [eax + 0xc]
cmp dword [eax + edx*8 + 0x18], ebp
jne 0x475634
cmp byte [eax + 0x114], 0
je 0x475634
mov cl, byte [ebx + 2]
mov byte [eax + 0x115], cl
mov esi, dword [ebp + 0x17f4]
mov edx, 0xb10
mov word [esp + 0x14], dx
mov al, byte [esi + 0x115]
mov byte [esp + 0x16], al
mov eax, 3
lea ecx, [esp + 0x14]
call fcn.0044e950
mov eax, dword [esp + 0x1c]
jmp 0x47541b
mov edi, ebp
lea esi, [esp + 0x1c]
call fcn.0044e110
mov dword [esp + 0x4c], 9
mov eax, dword [ebp + 0x17f4]
test eax, eax
je 0x475634
cmp byte [eax + 0x114], 0
je 0x475634
mov ecx, dword [eax + 0xc]
cmp dword [eax + ecx*8 + 0x18], ebp
jne 0x475634
mov edx, dword [ebx + 2]
push edx
call fcn.0044e660
mov eax, dword [esp + 0x1c]
jmp 0x47541b
mov edi, ebp
lea esi, [esp + 0x1c]
call fcn.0044e110
mov dword [esp + 0x4c], 0xa
mov eax, dword [ebp + 0x17f4]
test eax, eax
je 0x475634
cmp byte [eax + 0x114], 0
je 0x475634
mov ecx, dword [eax + 0xc]
cmp dword [eax + ecx*8 + 0x18], ebp
jne 0x475634
mov ebx, dword [ebx + 2]
call fcn.0044e590
mov eax, dword [esp + 0x1c]
jmp 0x47541b
mov ecx, dword [ebx + 2]
cmp ecx, dword [ebp + 0xdc]
jne 0x475adf
push ebp
mov edx, 4
call fcn.00475280
jmp case.0x4752f9.2828
cmp dword [ebp + 0x1638], 0
je 0x475af8
push ebp
mov edx, 1
call fcn.00475280
jmp case.0x4752f9.2828
mov edi, ebp
lea esi, [esp + 0x14]
call fcn.0044e110
mov dword [esp + 0x4c], 0xb
mov esi, dword [ebp + 0x17f4]
test esi, esi
je 0x475b5d
push ebp
call fcn.0044e260
mov edi, 0x1e
test al, al
je 0x475b2f
mov edx, dword [ebp + 0x17f4]
cmp dword [edx + 0x10], edi
jl 0x475b5d
mov esi, dword [ebp + 0x17f4]
push ebp
call fcn.0044e2a0
test al, al
je 0x475b4a
mov eax, dword [ebp + 0x17f4]
cmp dword [eax + 0x10], edi
jl 0x475b5d
mov ecx, dword [ebx + 2]
push ebp
mov edx, 2
call fcn.00475280
jmp 0x475417
mov ecx, dword [ebx + 2]
push ecx
mov ecx, dword [ebp + 0xe0]
call fcn.0041c6e0
mov esi, eax
test esi, esi
jne 0x475b83
mov ecx, dword [ebx + 2]
push ebp
lea edx, [eax + 4]
call fcn.00475280
jmp 0x475417
mov dl, byte [esi + 0x12d]
cmp dl, byte [ebp + 0x12d]
je 0x475ba4
mov ecx, dword [ebx + 2]
push ebp
mov edx, 4
call fcn.00475280
jmp 0x475417
mov ecx, dword [esi + 0x17f4]
test ecx, ecx
jne 0x475bed
cmp dword [esi + 0x17f8], ecx
jne 0x475bed
cmp dword [esi + 0x1638], ecx
je 0x475bd1
mov ecx, dword [ebx + 2]
push ebp
mov edx, 1
call fcn.00475280
jmp 0x475417
mov eax, dword [ebp + 0xdc]
mov dword [esi + 0x17f8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0xb14
jmp 0x4753ef
mov eax, dword [ebp + 0x17f4]
test eax, eax
je 0x475c0e
cmp eax, ecx
jne 0x475c0e
mov ecx, dword [ebx + 2]
push ebp
mov edx, 5
call fcn.00475280
jmp 0x475417
mov ecx, dword [ebx + 2]
push ebp
mov edx, 3
call fcn.00475280
jmp 0x475417
mov eax, dword [ebp + 0x17f8]
xor esi, esi
cmp eax, esi
je case.0x4752f9.2828
cmp dword [ebp + 0x17f4], esi
jne case.0x4752f9.2828
mov ecx, dword [ebp + 0xe0]
push eax
call fcn.0041c6e0
mov edi, eax
mov dword [ebp + 0x17f8], esi
mov dword [ebp + 0x58d0], esi
cmp edi, esi
je case.0x4752f9.2828
cmp dword [edi + 0x1638], esi
jne 0x475cfc
cmp dword [ebp + 0x1638], esi
jne 0x475cfc
cmp byte [ebx + 2], 0
jne 0x475d12
lea esi, [esp + 0x1c]
call fcn.0044e110
mov dword [esp + 0x4c], 0xc
mov esi, dword [edi + 0x17f4]
test esi, esi
je 0x475cc6
push edi
call fcn.0044e260
test al, al
jne 0x475cb0
push edi
call fcn.0044e2a0
test al, al
je 0x475ce0
mov ecx, ebp
mov eax, esi
call fcn.0044ed70
test al, al
je 0x475ce0
mov eax, dword [esp + 0x1c]
jmp 0x47541b
mov eax, edi
call fcn.00450c80
test eax, eax
je 0x475ce0
mov ecx, ebp
call fcn.0044ed70
test al, al
jne 0x475634
mov dword [esp + 0x4c], 0xffffffff
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x475cfc
add eax, 0x118
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp + 0xdc]
push edi
mov edx, 1
call fcn.00475280
jmp case.0x4752f9.2828
mov ecx, dword [ebp + 0xdc]
push edi
xor edx, edx
call fcn.00475280
jmp case.0x4752f9.2828
mov edi, ebp
lea esi, [esp + 0x1c]
call fcn.0044e110
mov dword [esp + 0x4c], 0xd
mov edi, dword [ebp + 0x17f4]
test edi, edi
je 0x475634
cmp byte [edi + 0x114], 0
je 0x475634
mov ecx, dword [edi + 0xc]
cmp dword [edi + ecx*8 + 0x18], ebp
je 0x475d6c
mov edx, dword [edi + 0x110]
cmp dword [edi + edx*8 + 0x18], ebp
jne 0x475634
mov eax, dword [ebx + 6]
mov ecx, dword [ebx + 2]
push eax
push ecx
call fcn.0044e480
mov esi, dword [ebp + 0x17f4]
mov eax, dword [ebx + 2]
mov ecx, dword [ebx + 6]
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], ecx
mov edx, 0xb12
mov word [esp + 0x24], dx
mov edx, dword [esi + 0xc]
mov eax, dword [esi + edx*8 + 0x14]
mov dword [esp + 0x2e], eax
mov ecx, dword [esi + 0x110]
mov edx, dword [esi + ecx*8 + 0x14]
mov eax, 0x12
lea ecx, [esp + 0x24]
mov dword [esp + 0x32], edx
call fcn.0044e950
mov eax, dword [esp + 0x1c]
jmp 0x47541b
mov edi, ebp
lea esi, [esp + 0x1c]
call fcn.0044e110
mov dword [esp + 0x4c], 0xe
mov esi, dword [ebp + 0x17f4]
test esi, esi
je 0x475634
mov eax, dword [esi + 0xc]
cmp dword [esi + eax*8 + 0x18], ebp
jne 0x475634
cmp byte [esi + 0x114], 0
je 0x475634
mov ecx, 0xb16
mov word [esp + 0x14], cx
mov eax, 2
lea ecx, [esp + 0x14]
call fcn.0044e950
mov edx, dword [ebp + 0x17f4]
push edx
call fcn.0044e360
mov eax, dword [esp + 0x1c]
jmp 0x47541b
mov edi, ebp
lea esi, [esp + 0x14]
mov byte [ebx + 0x16], 0
call fcn.0044e110
lea eax, [ebx + 2]
mov dword [esp + 0x4c], 0xf
call fcn.00414db0
mov ebx, eax
test ebx, ebx
jne 0x475e63
push 4
push ebp
xor ecx, ecx
call fcn.00475250
jmp 0x475417
mov esi, dword [ebp + 0x17f4]
test esi, esi
je 0x475eb5
push ebp
call fcn.0044e260
mov edi, 0x1e
test al, al
je 0x475e87
mov esi, dword [ebp + 0x17f4]
cmp dword [esi + 0x10], edi
jl 0x475eb5
mov esi, dword [ebp + 0x17f4]
push ebp
call fcn.0044e2a0
test al, al
je 0x475ea2
mov esi, dword [ebp + 0x17f4]
cmp dword [esi + 0x10], edi
jl 0x475eb5
mov ecx, dword [ebx + 0xdc]
push 2
push ebp
call fcn.00475250
jmp 0x475417
cmp dword [ebp + 0x1638], 0
je 0x475ed1
mov ecx, dword [ebx + 0xdc]
push 1
push ebp
call fcn.00475250
jmp 0x475417
mov edi, dword [ebx + 0xdc]
cmp edi, dword [ebp + 0xdc]
je 0x475efa
mov eax, ebx
mov ecx, ebp
call fcn.00457cf0
test al, al
je 0x475efa
mov al, byte [ebx + 0x12d]
cmp al, byte [ebp + 0x12d]
je 0x475f09
push 4
push ebp
mov ecx, edi
call fcn.00475250
jmp 0x475417
mov eax, dword [ebx + 0x17f4]
test eax, eax
jne 0x475f7e
cmp dword [ebx + 0x17f8], eax
jne 0x475f7e
cmp dword [ebx + 0x1638], eax
je 0x475f32
push 1
push ebp
mov ecx, edi
call fcn.00475250
jmp 0x475417
mov eax, dword [ebp + 0xdc]
mov dword [ebx + 0x17f8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x7530
mov ecx, 0xb18
mov dword [ebx + 0x58d0], eax
mov word [esp + 0x24], cx
add ebp, 0x184
lea ecx, [esp + 0x26]
sub ecx, ebp
mov al, byte [ebp]
mov byte [ecx + ebp], al
inc ebp
test al, al
jne 0x475f65
push 0x17
lea edx, [esp + 0x28]
push edx
mov ecx, ebx
jmp 0x475412
test esi, esi
je 0x475f95
cmp esi, eax
jne 0x475f95
push 5
push ebp
mov ecx, edi
call fcn.00475250
jmp 0x475417
push 3
push ebp
mov ecx, edi
call fcn.00475250
jmp 0x475417
mov ecx, dword [ebp + 0xdc]
mov dl, byte [ebx + 6]
mov eax, 0x520
mov word [esp + 0x14], ax
lea eax, [esp + 0x14]
mov dword [esp + 0x16], ecx
mov byte [esp + 0x1a], dl
push eax
lea ecx, [ebp + 0xd0]
mov edx, 7
call fcn.004d5250
jmp case.0x4752f9.2828
push 0
push 9
mov ecx, ebp
call fcn.004ec760
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0051a8be
add esp, 0x3c
ret 4