Function at 0x4cb8e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x5d44c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov edx, dword [0x6613bc]
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x28]
push ecx
push ecx
add edx, 0x144
xor ebx, ebx
mov ecx, esp
mov dword [esp + 0x4c], esp
push edx
mov dword [esp + 0x40], edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call fcn.00402dc0
mov dword [esp + 0x64], 0xffffffff
call fcn.004e5580
mov eax, dword [esp + 0x30]
add esp, 0xc
cmp eax, ebx
je 0x4cbfcb
mov ecx, dword [esp + 0x28]
push ebx
push ecx
push eax
call fcn.00520af0
mov ebp, eax
add esp, 0xc
cmp ebp, ebx
mov dword [esp + 0x20], ebp
je 0x4cbfbe
push str.text_ad
mov ecx, ebp
call fcn.004caff0
mov esi, eax
cmp esi, ebx
je 0x4cbc5e
push 1
lea edx, [edi + 0x20]
push edx
lea ecx, [esp + 0x4c]
call fcn.005789d4
mov dword [esp + 0x58], 1
push 0x5e2edc
push str.first
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call fcn.004c5960
mov byte [esp + 0x58], 2
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0057beb6
mov ebx, dword [esi + 0x18]
add esp, 4
test ebx, ebx
mov ebp, eax
mov dword [esp + 0x1c], ebp
je 0x4cbbe2
mov edi, edi
test ebx, ebx
mov eax, ebx
je 0x4cbfe3
mov esi, dword [eax + 8]
mov ebx, dword [ebx]
push str.desc
mov ecx, esi
call fcn.004caff0
push 0x5faf94
mov ecx, esi
mov edi, eax
call fcn.004caff0
push str.duration
mov ecx, esi
mov ebp, eax
call fcn.004caff0
mov esi, eax
call fcn.005afeed
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x58], 4
call fcn.005afeed
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x58], 6
call fcn.005afeed
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x58], 8
test edi, edi
je 0x4cba7e
lea eax, [esp + 0x38]
push eax
mov ecx, edi
call fcn.0048cbc0
mov byte [esp + 0x58], 9
push eax
lea ecx, [esp + 0x18]
call fcn.00405540
mov byte [esp + 0x58], 8
lea ecx, [esp + 0x38]
call fcn.00401b70
test ebp, ebp
je 0x4cbaab
lea ecx, [esp + 0x3c]
push ecx
mov ecx, ebp
call fcn.0048cbc0
mov byte [esp + 0x58], 0xa
push eax
lea ecx, [esp + 0x1c]
call fcn.00405540
mov byte [esp + 0x58], 8
lea ecx, [esp + 0x3c]
call fcn.00401b70
test esi, esi
je 0x4cbad8
lea edx, [esp + 0x40]
push edx
mov ecx, esi
call fcn.0048cbc0
mov byte [esp + 0x58], 0xb
push eax
lea ecx, [esp + 0x14]
call fcn.00405540
mov byte [esp + 0x58], 8
lea ecx, [esp + 0x40]
call fcn.00401b70
mov edi, dword [esp + 0x18]
mov eax, dword [edi - 0xc]
test eax, eax
jle 0x4cbb6d
push 0x5e4090
push edi
call fcn.0057aad0
add esp, 8
test eax, eax
je 0x4cbb6d
sub eax, edi
sar eax, 1
test eax, eax
jne 0x4cbb6d
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x4cbb6d
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 0xc]
test eax, eax
jle 0x4cbb6d
push 0xc
call fcn.005abebb
add esp, 4
test eax, eax
je 0x4cbb30
mov ecx, eax
call fcn.004caf80
mov esi, eax
jmp 0x4cbb32
xor esi, esi
mov edx, dword [esp + 0x10]
push edx
mov dword [esp + 0x30], esi
call fcn.0057beb6
mov dword [esi + 8], eax
add esp, 4
lea eax, [esp + 0x14]
lea ecx, [esi + 4]
push eax
call fcn.00405540
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.00405540
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x2c]
push edx
call fcn.004cb8a0
mov byte [esp + 0x58], 6
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4cbb90
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov byte [esp + 0x58], 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4cbbb3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov byte [esp + 0x58], 2
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4cbbd2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test ebx, ebx
jne 0x4cb9d0
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, eax
call esi
imul ebx, eax
imul ebx, ebx, 0x1fd
push ebx
call fcn.0057a74d
add esp, 4
cmp ebp, 0xffffffff
jne 0x4cbc1f
mov esi, dword [edi + 8]
test esi, esi
je 0x4cbc3b
call fcn.0057a75a
xor edx, edx
div esi
cmp edx, ebp
mov dword [esp + 0x1c], edx
je 0x4cbc3b
mov ebp, edx
test ebp, ebp
mov eax, dword [edi + 4]
mov eax, dword [eax]
mov dword [edi + 0xc], eax
jbe 0x4cbc3b
jmp 0x4cbc30
dec ebp
mov eax, dword [edi + 0xc]
mov eax, dword [eax]
mov dword [edi + 0xc], eax
jne 0x4cbc30
mov byte [esp + 0x58], 1
lea ecx, [esp + 0x34]
call fcn.00401b70
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x44]
call fcn.0057897a
mov ebp, dword [esp + 0x20]
push 0
push str.pop_ad
mov ecx, ebp
call fcn.004cb0b0
mov esi, eax
test esi, esi
je 0x4cbdba
push 0x5faf68
push str.width
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.004c5960
mov dword [esp + 0x58], 0xf
push 0x5faf60
push 0x5faaec
lea edx, [esp + 0x38]
push edx
mov ecx, esi
call fcn.004c5960
mov byte [esp + 0x58], 0x10
push 0x5e3a20
push str.wait
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call fcn.004c5960
mov byte [esp + 0x58], 0x11
push 0x5faf94
mov ecx, esi
call fcn.004caff0
push str.caption
mov ecx, esi
mov ebx, eax
call fcn.004caff0
test ebx, ebx
mov esi, eax
je 0x4cbd8d
test esi, esi
je 0x4cbd8d
mov eax, dword [esp + 0x34]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x4cbd8d
push eax
call fcn.0057beb6
mov ecx, dword [esp + 0x30]
push ecx
mov dword [edi + 0x4c], eax
call fcn.0057beb6
mov edx, dword [esp + 0x38]
push edx
mov dword [edi + 0x44], eax
call fcn.0057beb6
mov dword [edi + 0x48], eax
add esp, 0xc
lea eax, [esp + 0x40]
push eax
mov ecx, ebx
call fcn.0048cbc0
mov byte [esp + 0x58], 0x12
push eax
lea ecx, [edi + 0x50]
call fcn.004055b0
mov byte [esp + 0x58], 0x11
lea ecx, [esp + 0x40]
call fcn.00401b70
lea ecx, [esp + 0x40]
push ecx
mov ecx, esi
call fcn.0048cbc0
mov byte [esp + 0x58], 0x13
push eax
lea ecx, [edi + 0x54]
call fcn.004055b0
mov byte [esp + 0x58], 0x11
lea ecx, [esp + 0x40]
call fcn.00401b70
push 0
call fcn.0057bbd0
mov ecx, dword [edi + 0x4c]
add esp, 4
add eax, ecx
mov dword [edi + 0x40], eax
mov byte [esp + 0x58], 0x10
lea ecx, [esp + 0x34]
call fcn.00401b70
mov byte [esp + 0x58], 0xf
lea ecx, [esp + 0x30]
call fcn.00401b70
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x2c]
call fcn.00401b70
push 0
push str.browse_ad
mov ecx, ebp
call fcn.004cb0b0
mov esi, eax
test esi, esi
je 0x4cbf17
push 0x5faf94
mov ecx, esi
call fcn.004caff0
push 0x5faf38
mov ecx, esi
mov edi, eax
call fcn.004caff0
push 0x5faaec
mov ecx, esi
mov ebx, eax
call fcn.004caff0
push str.delay
mov ecx, esi
mov ebp, eax
call fcn.004caff0
test edi, edi
je 0x4cbf13
test eax, eax
je 0x4cbf13
test ebp, ebp
je 0x4cbf13
test ebx, ebx
je 0x4cbf13
lea edx, [esp + 0x40]
push edx
mov ecx, eax
call fcn.0048cbc0
mov dword [esp + 0x58], 0x14
mov eax, dword [eax]
push eax
call fcn.0057beb6
mov ecx, dword [0x6613bc]
or esi, 0xffffffff
add esp, 4
mov dword [ecx + 0x100], eax
mov dword [esp + 0x58], esi
lea ecx, [esp + 0x40]
call fcn.00401b70
lea edx, [esp + 0x40]
push edx
mov ecx, edi
call fcn.0048cbc0
mov dword [esp + 0x58], 0x15
mov ecx, dword [0x6613bc]
push eax
add ecx, 0x104
call fcn.004055b0
mov dword [esp + 0x58], esi
lea ecx, [esp + 0x40]
call fcn.00401b70
lea eax, [esp + 0x40]
push eax
mov ecx, ebx
call fcn.0048cbc0
mov dword [esp + 0x58], 0x16
mov eax, dword [eax]
push eax
call fcn.0057beb6
mov ecx, dword [0x6613bc]
add esp, 4
mov dword [ecx + 0xfc], eax
mov dword [esp + 0x58], esi
lea ecx, [esp + 0x40]
call fcn.00401b70
lea edx, [esp + 0x40]
push edx
mov ecx, ebp
call fcn.0048cbc0
mov dword [esp + 0x58], 0x17
mov eax, dword [eax]
push eax
call fcn.0057beb6
mov ecx, dword [0x6613bc]
add esp, 4
mov dword [ecx + 0xf8], eax
mov dword [esp + 0x58], esi
lea ecx, [esp + 0x40]
call fcn.00401b70
mov ecx, dword [0x6613bc]
push 0
call fcn.004b49c0
mov ebp, dword [esp + 0x20]
push 0
push 0x5faf1c
mov ecx, ebp
call fcn.004cb0b0
mov esi, eax
test esi, esi
je 0x4cbfb7
mov ecx, dword [0x6613d8]
add ecx, 0x1090
call fcn.0047d600
mov esi, dword [esi + 0x18]
test esi, esi
je 0x4cbfac
mov edi, 0x18
or ebx, 0xffffffff
nop
test esi, esi
mov eax, esi
je 0x4cbfe3
mov ecx, dword [eax + 8]
mov esi, dword [esi]
lea edx, [esp + 0x34]
push edx
call fcn.0048cbc0
mov dword [esp + 0x58], edi
mov eax, dword [esp + 0x34]
mov ecx, dword [0x6613d8]
push 0
push 0
push eax
add ecx, 0x1090
call fcn.0047e1a0
mov dword [esp + 0x58], ebx
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4cbfa8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test esi, esi
jne 0x4cbf50
mov ecx, dword [0x6613d8]
call fcn.0047ef80
mov ecx, ebp
call fcn.004cb3a0
mov eax, dword [esp + 0x24]
push eax
call fcn.0057aa32
add esp, 4
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x4c
ret
jmp fcn.005a8539