Function at 0x472e00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb61c
mov eax, dword fs:[0]
push eax
mov eax, 0x676c
call fcn.004aeb70
mov eax, dword [0x50dc94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x6778]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x6730], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6718], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x6728], eax
mov dword [ebp - 0x671c], 0
call dword [0x4c5d94]
lea ecx, [ebp - 0x6774]
call dword [0x4c5d94]
lea ecx, [ebp - 0x6770]
call dword [0x4c5d94]
lea ecx, [ebp - 0x676c]
call dword [0x4c5d94]
lea ecx, [ebp - 0x6768]
call dword [0x4c5d94]
xor eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x854], 0
mov dword [ebp - 0x850], 7
mov word [ebp - 0x864], ax
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x838], 7
mov word [ebp - 0x84c], ax
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x820], 7
mov word [ebp - 0x834], ax
xor edi, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x81c], eax
mov dword [ebp - 0x818], eax
cmp dword [esi + 0x614], edi
je 0x472f66
push 0xffffffffffffffff
push dword [esi + 0x604]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x614]
push 0xffffffffffffffff
push ebx
push 0x400
mov edi, dword [eax + 0x1f008]
mov dword [eax + 0x28], 3
mov eax, dword [esi + 0x614]
mov dword [eax + 0x18], 0
mov eax, dword [esi + 0x614]
mov dword [eax + 4], 0
mov eax, dword [esi + 0x614]
add eax, 0x2c
push eax
call dword [0x4c5af0]
add esp, 0x10
push dword [esi + 0x604]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
lea eax, [ebp - 0x6778]
push eax
push ebx
call fcn.00446580
add esp, 0xc
cmp dword [esi + 0x614], 0
je 0x472fd4
push 0xffffffffffffffff
push dword [esi + 0x604]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x6768]
cmp dword [eax - 0xc], 0
jne 0x472fab
mov eax, dword [esi + 0x614]
xor ecx, ecx
mov word [eax + 0x1f03c], cx
jmp 0x472fc8
push 0xffffffffffffffff
push eax
mov eax, dword [esi + 0x614]
add eax, 0x1f03c
push 0x400
push eax
call dword [0x4c5af0]
add esp, 0x10
push dword [esi + 0x604]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x5620
lea eax, [ebp - 0x670c]
push 0
push eax
call fcn.004b493e
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x670c]
mov dword [ebp - 0x6710], 3
push 0x104
push eax
call dword [0x4c5af0]
lea eax, [ebp - 0x6710]
push eax
call fcn.004a815a
add esp, 0x20
test eax, eax
je 0x473305
lea eax, [ebp - 0x60ec]
push eax
lea eax, [ebp - 0x62f8]
push eax
lea eax, [ebp - 0x6504]
push eax
lea eax, [ebp - 0x670c]
push eax
push str.CFortiTrayDlg::StartIPSecTunnel
push str._ws_tun_s_allowtag_s_prohibittag_s_notification_s
call fcn.0047c780
push str.softwareFortinetFortiClientFA_ESNACHost_Verification
push reloc.SHELL32.dll_SHChangeNotifyRegister
call fcn.004a7eca
add esp, 0x20
mov dword [ebp - 0x6720], eax
test eax, eax
je 0x4732f3
push 0
lea ecx, [ebp - 0x672c]
mov dword [ebp - 0x672c], 0
push ecx
push str.host_verification_tags
push eax
call fcn.004a7edc
add esp, 0x10
test al, al
je 0x4732d1
mov eax, dword [ebp - 0x672c]
test eax, eax
je 0x4732d1
push eax
lea ecx, [ebp - 0x87c]
call fcn.004106c0
push dword [ebp - 0x672c]
mov byte [ebp - 4], 2
call dword [0x4c5958]
add esp, 4
mov dword [ebp - 0x672c], 0
cmp word [ebp - 0x6504], 0
mov dword [ebp - 0x60f0], 0xffffffff
mov dword [ebp - 0x62fc], 0xffffffff
je 0x4730fc
lea eax, [ebp - 0x62fc]
push eax
lea eax, [ebp - 0x6504]
push eax
call fcn.0047ce90
add esp, 8
cmp word [ebp - 0x62f8], 0
je 0x47311c
lea eax, [ebp - 0x60f0]
push eax
lea eax, [ebp - 0x62f8]
push eax
call fcn.0047ce90
add esp, 8
push dword [ebp - 0x60f0]
push dword [ebp - 0x62fc]
push str.allowed:0x_x_prohibited:0x_x
call fcn.0047c780
mov edi, dword [ebp - 0x87c]
add esp, 0xc
cmp word [ebp - 0x6504], 0
mov eax, dword [ebp - 0x86c]
je 0x473222
mov edx, dword [ebp - 0x62fc]
cmp edx, eax
jae 0x473222
mov ecx, dword [ebp - 0x868]
lea eax, [ebp - 0x87c]
cmp ecx, 8
cmovae eax, edi
cmp word [eax + edx*2], 0x31
je 0x47325b
push 0x420
lea eax, [ebp - 0xccc]
push 0
push eax
call fcn.004b493e
push 0xffffffffffffffff
lea eax, [ebp - 0x60ec]
push eax
lea eax, [ebp - 0xac2]
push 0x105
push eax
call dword [0x4c5af0]
add esp, 0x1c
mov byte [ebp - 0x8b0], 1
lea eax, [ebp - 0xccc]
mov ecx, esi
push eax
call fcn.00472180
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x671
mov ecx, esi
call fcn.0046a5c0
push dword [ebp - 0x6720]
call fcn.004a7ed0
mov eax, dword [ebp - 0x868]
add esp, 4
cmp eax, 8
jb 0x473c07
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x4732c2
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4732c2
call dword [0x4c59b0]
cmp word [ebp - 0x62f8], 0
je 0x47317a
mov edx, dword [ebp - 0x60f0]
cmp edx, eax
jae 0x47317a
mov ecx, dword [ebp - 0x868]
lea eax, [ebp - 0x87c]
cmp ecx, 8
cmovae eax, edi
cmp word [eax + edx*2], 0x30
jne 0x47317a
mov byte [ebp - 4], 1
cmp ecx, 8
jb 0x473295
lea ecx, [ecx*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x47328b
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x47328b
call dword [0x4c59b0]
push ecx
push edi
call fcn.004aebf7
add esp, 8
push dword [ebp - 0x6720]
xor eax, eax
mov dword [ebp - 0x86c], 0
mov dword [ebp - 0x868], 7
mov word [ebp - 0x87c], ax
call fcn.004a7ed0
add esp, 4
jmp 0x473305
push ecx
push edi
call fcn.004aebf7
add esp, 8
jmp 0x473c07
push str.CFortiTrayDlg::StartIPSecTunnel
push str._ws_failed_to_get_tagbitmap
call fcn.0047c780
add esp, 8
push dword [ebp - 0x6720]
call fcn.004a7ed0
add esp, 4
jmp 0x473305
push str.CFortiTrayDlg::StartIPSecTunnel
push str._ws_no_comliance_result_info
call fcn.0047c780
add esp, 8
mov ecx, ebx
mov dword [ebp - 0x884], 0
xor eax, eax
mov dword [ebp - 0x880], 7
mov word [ebp - 0x894], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473327
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x894]
call fcn.00410410
lea eax, [ebp - 0x894]
mov byte [ebp - 4], 3
push eax
mov ecx, esi
call fcn.00463710
mov edx, dword [ebp - 0x880]
test al, al
mov byte [ebp - 4], 1
sete al
mov byte [ebp - 0x6711], al
cmp edx, 8
jb 0x4733ac
mov ecx, dword [ebp - 0x894]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47339c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x47339c
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
mov al, byte [ebp - 0x6711]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x884], 0
mov dword [ebp - 0x880], 7
mov word [ebp - 0x894], cx
test al, al
je 0x4734aa
push str.FA_SSLVPN
call fcn.004a8052
push ebx
push str.vpntunnel
push 2
push 0x1793e
call fcn.004a8136
push 0x420
lea eax, [ebp - 0x10ec]
push 0
push eax
call fcn.004b493e
add esp, 0x20
lea ecx, [ebp - 0x6720]
call dword [0x4c5d94]
push 0x80
lea ecx, [ebp - 0x6720]
mov byte [ebp - 4], 4
call dword [0x4c5fac]
lea ecx, [ebp - 0x671c]
call dword [0x4c5d94]
push 0x27
lea ecx, [ebp - 0x671c]
mov byte [ebp - 4], 5
call dword [0x4c5fac]
push 0xffffffffffffffff
push dword [ebp - 0x6720]
lea eax, [ebp - 0x10ec]
push 0x104
push eax
call dword [0x4c5af0]
push 0xffffffffffffffff
push dword [ebp - 0x671c]
lea eax, [ebp - 0xee2]
push 0x104
push eax
call dword [0x4c5af0]
add esp, 0x20
lea eax, [ebp - 0x10ec]
push 0
push eax
push 0x54b
call fcn.004a7fb4
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x671c]
call dword [0x4c5d9c]
lea ecx, [ebp - 0x6720]
jmp 0x473c01
call dword [0x4c63a0]
test eax, eax
jne 0x473c07
mov edi, dword [ebp - 0x6730]
mov dword [ebp - 0x81c], 1
test edi, edi
je 0x4734ed
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4734d1
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x864]
call fcn.00410410
mov edi, dword [ebp - 0x6718]
test edi, edi
je 0x47351c
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473500
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x84c]
call fcn.00410410
push 0xffffffffffffffff
push dword [esi + 0x604]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x614]
test eax, eax
je 0x4735e1
push 0x202
add eax, 0x1132
push 0
push eax
call fcn.004b493e
cmp dword [ebp - 0x850], 8
lea eax, [ebp - 0x864]
push 0xffffffffffffffff
cmovae eax, dword [ebp - 0x864]
push eax
mov eax, dword [esi + 0x614]
add eax, 0x1132
push 0x100
push eax
call dword [0x4c5af0]
mov eax, dword [esi + 0x614]
push 0x202
add eax, 0x1334
push 0
push eax
call fcn.004b493e
cmp dword [ebp - 0x838], 8
lea eax, [ebp - 0x84c]
push 0xffffffffffffffff
cmovae eax, dword [ebp - 0x84c]
push eax
mov eax, dword [esi + 0x614]
add eax, 0x1334
push 0x100
push eax
call dword [0x4c5af0]
mov eax, dword [esi + 0x614]
add eax, 0x1334
push eax
call sub.libcfg.dll_cfg_hash_stringW
add esp, 0x3c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 0x614]
mov dword [ecx + 0x1c], eax
push dword [esi + 0x604]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [ebp - 0x6728]
push edi
push 0xc7b
push str.CFortiTrayDlg::StartIPSecTunnel
push str._ws__d_pCertificate_s
call fcn.0047c780
add esp, 0x10
test edi, edi
je 0x473630
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473614
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x834]
call fcn.00410410
cmp dword [ebp - 0x675c], 0
jne 0x473642
cmp dword [ebp - 0x824], 0
jbe 0x47364c
mov dword [ebp - 0x818], 1
cmp dword [ebp - 0x820], 8
lea eax, [ebp - 0x834]
cmovae eax, dword [ebp - 0x834]
push eax
push 0xc83
push str.CFortiTrayDlg::StartIPSecTunnel
push str._ws__d_ondemand.m_strCertificate_s
call fcn.0047c780
add esp, 0x10
cmp dword [esi + 0x614], 0
je 0x4738b7
push 0xffffffffffffffff
push dword [esi + 0x604]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x614]
mov dword [eax], 0
test byte [0x50f810], 2
je 0x4736c3
push str.m_pInfo__m_nConnectionState__CONN_STATE_STARTING_
push str.__debug
push 0xc8a
push 0
push 0
call fcn.00421090
add esp, 0x14
mov eax, dword [esi + 0x614]
mov dword [eax + 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 0x614]
push 0xffffffffffffffff
push ebx
push 0x400
mov dword [ecx + 0x1c], eax
xor ecx, ecx
mov eax, dword [esi + 0x614]
mov dword [eax + 0x24], 2
mov eax, dword [esi + 0x614]
mov dword [eax + 0x28], 3
mov eax, dword [esi + 0x614]
mov word [eax + 0x82c], cx
mov eax, dword [esi + 0x614]
add eax, 0x2c
push eax
call dword [0x4c5af0]
add esp, 0x10
mov dword [ebp - 0x6730], 0
cmp dword [0x540d64], 0
jne 0x473795
lea eax, [ebp - 0x6730]
push eax
push str.KeepRunning
push ebx
push str.softwareFortinetFortiClientIPSecTunnels
sub esp, 0x18
mov ecx, esp
push str._s_s
call fcn.004106c0
lea eax, [ebp - 0x8ac]
push eax
call fcn.0045dd90
add esp, 0x24
mov dword [ebp - 0x671c], 1
cmp dword [eax + 0x14], 8
jb 0x473778
mov eax, dword [eax]
push eax
call fcn.004a8016
add esp, 0xc
test al, al
je 0x473795
cmp dword [ebp - 0x6730], 0
je 0x473795
mov ecx, 1
jmp 0x473797
xor ecx, ecx
test byte [ebp - 0x671c], 1
mov eax, dword [esi + 0x614]
mov dword [eax + 0x1f00c], ecx
je 0x47380b
mov edx, dword [ebp - 0x898]
cmp edx, 8
jb 0x4737ee
mov ecx, dword [ebp - 0x8ac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4737e4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4737e4
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
xor eax, eax
mov dword [ebp - 0x89c], 0
mov dword [ebp - 0x898], 7
mov word [ebp - 0x8ac], ax
mov eax, dword [esi + 0x614]
push dword [eax + 0x1f00c]
push 0xc9e
push str.CFortiTrayDlg::StartIPSecTunnel
push str._ws__d_m_pInfo__m_bKeepConnected_d
call fcn.0047c780
mov eax, dword [esi + 0x614]
add esp, 0x10
cmp dword [eax + 0x1f00c], 0
je 0x47386b
cmp dword [eax + 0x1f014], 0
jne 0x47386b
mov ecx, esi
call fcn.00466660
mov ecx, dword [esi + 0x614]
mov dword [ecx + 0x1f014], eax
mov ecx, dword [esi + 0x614]
mov eax, dword [ecx + 0x1f014]
mov dword [ecx + 0x1f010], eax
cmp dword [0x540c1c], 0
jne 0x473895
cmp dword [esi + 0x624], 0
jne 0x473895
mov eax, dword [esi + 0x614]
cmp dword [eax + 0x1f00c], 0
je 0x473895
mov ecx, esi
call fcn.00473c90
jmp 0x4738ab
mov eax, dword [esi + 0x614]
cmp dword [eax + 0x1f00c], 0
jne 0x4738ab
mov ecx, esi
call fcn.00467b90
push dword [esi + 0x604]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ecx
mov ecx, esp
push ebx
call dword [0x4c5f74]
mov ecx, esi
call fcn.00467150
test eax, eax
jne 0x473948
lea ecx, [ebp - 0x6718]
call dword [0x4c5d94]
push 0xe3
lea ecx, [ebp - 0x6718]
mov byte [ebp - 4], 6
call dword [0x4c5fac]
cmp dword [esi + 0x620], 0
jne 0x47393c
push 0x1000
push 0
push dword [ebp - 0x6718]
mov dword [esi + 0x620], 1
push dword [esi + 0x628]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
push 0x671
mov ecx, esi
mov dword [esi + 0x620], 0
call fcn.0046a5c0
lea ecx, [ebp - 0x6718]
jmp 0x473c01
lea ecx, [ebp - 0x6718]
call dword [0x4c5d9c]
lea ecx, [ebp - 0x6724]
call dword [0x4c5d94]
push ebx
push dword [esi + 0x610]
mov byte [ebp - 4], 7
call fcn.004a822c
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 3
mov edi, eax
call fcn.004a8022
add esp, 4
test eax, eax
je 0x4739a5
nop dword [eax]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x2710
ja 0x4739a5
push 3
call fcn.004a8022
add esp, 4
test eax, eax
jne 0x473980
push dword [esi + 0x610]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0x400
lea eax, [ebp - 0x814]
push eax
push ebx
call fcn.004a8232
add esp, 0x10
test al, al
je 0x473ac4
lea eax, [ebp - 0x6724]
push eax
lea eax, [ebp - 0x864]
push eax
push ebx
call fcn.00466180
add esp, 0xc
cmp dword [esi + 0x614], 0
je 0x473a88
push 0xffffffffffffffff
push dword [esi + 0x604]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x614]
push 0xffffffffffffffff
mov dword [eax + 0x1f000], 0
mov eax, dword [esi + 0x614]
mov dword [eax + 0x1effc], 1
push dword [ebp - 0x6724]
mov eax, dword [esi + 0x614]
add eax, 0x82e
push 0x400
push eax
call dword [0x4c5af0]
mov eax, dword [esi + 0x614]
push 0x102
add eax, 0x1030
push 0
push eax
call fcn.004b493e
push 0xffffffffffffffff
lea eax, [ebp - 0x814]
push eax
mov eax, dword [esi + 0x614]
add eax, 0x1030
push 0x80
push eax
call dword [0x4c5af0]
add esp, 0x2c
push dword [esi + 0x604]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 0x6724]
lea ecx, [ebp - 0x6724]
mov eax, dword [eax - 0xc]
push eax
lea edi, [eax + eax]
call dword [0x4c6298]
test edi, edi
je 0x473ab0
mov byte [eax], 0
lea eax, [eax + 1]
sub edi, 1
jne 0x473aa5
lea eax, [ebp - 0x864]
push eax
push 0
push 1
lea eax, [ebp - 0x814]
push eax
jmp 0x473ad1
lea eax, [ebp - 0x864]
push eax
push 0
push 1
push 0
push ecx
mov ecx, esp
mov dword [0x541800], 1
push ebx
call dword [0x4c5f74]
call fcn.0047e8d0
add esp, 0x14
cmp dword [ebp - 0x818], 0
je 0x473b53
cmp dword [esi + 0x614], 0
je 0x473bca
push 0xffffffffffffffff
push dword [esi + 0x604]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x820], 8
lea eax, [ebp - 0x834]
push 0xffffffffffffffff
cmovae eax, dword [ebp - 0x834]
push eax
mov eax, dword [esi + 0x614]
add eax, 0x1536
push 0x100
push eax
call dword [0x4c5af0]
mov eax, dword [esi + 0x614]
add esp, 0x10
xor ecx, ecx
mov word [eax + 0x1736], cx
jmp 0x473b79
cmp dword [esi + 0x614], 0
je 0x473bca
push 0xffffffffffffffff
push dword [esi + 0x604]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x614]
xor ecx, ecx
mov word [eax + 0x1536], cx
push dword [esi + 0x604]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [esi + 0x614], 0
je 0x473bca
push 0xffffffffffffffff
push dword [esi + 0x604]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x614]
cmp dword [eax + 0x1effc], 0
je 0x473bbe
cmp dword [eax + 0x1f00c], 0
je 0x473bbe
mov dword [eax + 0x1f01c], 1
push dword [esi + 0x604]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0x838], 8
lea ecx, [ebp - 0x84c]
mov eax, dword [ebp - 0x83c]
cmovae ecx, dword [ebp - 0x84c]
add eax, eax
je 0x473bfb
nop dword [eax + eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x473bf0
lea ecx, [ebp - 0x6724]
call dword [0x4c5d9c]
lea ecx, [ebp - 0x834]
call fcn.00413170
lea ecx, [ebp - 0x84c]
call fcn.00413170
lea ecx, [ebp - 0x864]
call fcn.00413170
lea ecx, [ebp - 0x6768]
call dword [0x4c5d9c]
lea ecx, [ebp - 0x676c]
call dword [0x4c5d9c]
lea ecx, [ebp - 0x6770]
call dword [0x4c5d9c]
lea ecx, [ebp - 0x6774]
call dword [0x4c5d9c]
lea ecx, [ebp - 0x6778]
call dword [0x4c5d9c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret 0x10