Function at 0x4f8a88
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7ad2ee
mov eax, dword fs:[0]
push eax
sub esp, 0x1a4
mov eax, dword [0x89b044]
xor eax, ebp
mov dword [ebp - 0x40], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0x112
ja 0x4f8655
cmp dword [ebp - 0x180], 0x112
je 0x4f87dd
mov ecx, dword [ebp - 0x180]
sub ecx, 1
mov dword [ebp - 0x180], ecx
cmp dword [ebp - 0x180], 0x83
ja case.0x4f8727.1
mov edx, dword [ebp - 0x180]
movzx eax, byte [edx + 0x4f9338]
jmp dword [eax*4 + 0x4f9308]
cmp dword [ebp - 0x180], 0x52d
ja 0x4f86fb
cmp dword [ebp - 0x180], 0x52d
je 0x4f8a74
cmp dword [ebp - 0x180], 0x46b
ja 0x4f86c6
cmp dword [ebp - 0x180], 0x46b
je 0x4f8bfc
cmp dword [ebp - 0x180], 0x113
je 0x4f87ba
cmp dword [ebp - 0x180], 0x312
je 0x4f8846
cmp dword [ebp - 0x180], 0x46a
je 0x4f89a1
jmp case.0x4f8727.1
cmp dword [ebp - 0x180], 0x478
je 0x4f88fa
cmp dword [ebp - 0x180], 0x479
je 0x4f891d
cmp dword [ebp - 0x180], 0x4c9
je 0x4f8869
jmp case.0x4f8727.1
mov ecx, dword [ebp - 0x180]
sub ecx, 0x591
mov dword [ebp - 0x180], ecx
cmp dword [ebp - 0x180], 0x6e
ja case.0x4f8727.1
mov edx, dword [ebp - 0x180]
movzx eax, byte [edx + 0x4f93e4]
jmp dword [eax*4 + 0x4f93bc]
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x17c]
call fcn.004f9490
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x17c]
call fcn.004f99d0
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x17c]
call fcn.004f9a60
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x17c]
call fcn.004f9a90
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x17c]
call fcn.004fc9b0
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x17c]
call fcn.004f9cb0
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x17c]
call fcn.004f9d50
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x17c]
call fcn.004f9e00
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x17c]
call fcn.00502880
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x17c]
call fcn.005029e0
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x17c]
call fcn.00502920
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x17c]
call fcn.00502950
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
jmp 0x4f8e15
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x17c]
call fcn.00502990
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x17c]
call fcn.00502a10
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x17c]
call fcn.005036c0
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0043b4e0
mov ecx, eax
call fcn.00518ea0
cmp dword [ebp - 0x18], 0
je 0x4f897e
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x108], edx
mov eax, dword [ebp - 0x108]
push eax
call fcn.00725356
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x4f899c
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10c], ecx
mov edx, dword [ebp - 0x10c]
push edx
call fcn.00725356
add esp, 4
jmp 0x4f8e15
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax + 0x414]
call fcn.004a2f00
push eax
mov ecx, dword [ebp - 0x17c]
call fcn.00500790
jmp 0x4f8e15
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0
je 0x4f89ef
push 0
call fcn.0043ce50
mov ecx, eax
call fcn.0046fe80
push eax
mov ecx, dword [ebp - 0x20]
call fcn.0047f670
mov dword [ebp - 0x10], 1
jmp 0x4f89f6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 1
jmp 0x4f8e15
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0
je 0x4f8a5f
mov ecx, dword [ebp - 0x24]
call fcn.0045b460
test eax, eax
je 0x4f8a22
mov ecx, dword [ebp - 0x24]
call fcn.00459e90
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
mov dword [ebp - 0x110], ecx
cmp dword [ebp - 0x110], 0
je 0x4f8a55
push 1
mov ecx, dword [ebp - 0x110]
call fcn.00451ee0
mov dword [ebp - 0x184], eax
jmp 0x4f8a5f
mov dword [ebp - 0x184], 0
jmp 0x4f8e15
mov ecx, dword [ebp - 0x17c]
call fcn.00502010
jmp 0x4f8e15
push 1
push 1
mov ecx, dword [ebp - 0x17c]
call fcn.004f83e0
jmp 0x4f8e15
push 0
push 0xf060
push 0x112
mov ecx, dword [ebp - 0x17c]
call fcn.005a45f0
jmp 0x4f8e15
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x17c]
call fcn.005054f0
jmp 0x4f8e15
call fcn.0043b4e0
mov ecx, eax
call fcn.0051ec50
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0043b4e0
mov ecx, eax
call fcn.0051ec10
jmp 0x4f8e15
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x17c]
call fcn.00505570
jmp 0x4f8e15
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x4f8bf5
mov dword [ebp - 0x118], 0xc
mov ecx, dword [ebp - 0x118]
push ecx
call fcn.00704930
add esp, 4
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x4f8b66
mov edx, dword [ebp - 0x118]
push edx
push 0
mov eax, dword [ebp - 0x11c]
push eax
call fcn.007202b0
add esp, 0xc
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x188], ecx
jmp 0x4f8b70
mov dword [ebp - 0x188], 0
mov edx, dword [ebp - 0x188]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 8], 0
je 0x4f8bdf
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx + 4], 0
je 0x4f8bdf
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 4]
push eax
call fcn.0070a654
add esp, 4
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x120]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 8]
push edx
call fcn.007248d0
add esp, 0xc
mov eax, dword [ebp - 0x30]
push eax
push 0
push 0x46b
mov ecx, dword [ebp - 0x17c]
call fcn.005a45f0
xor eax, eax
jmp 0x4f92ed
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0
je 0x4f8de7
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
mov dword [ebp - 0x18c], eax
mov ecx, dword [ebp - 0x18c]
sub ecx, 0x5f5
mov dword [ebp - 0x18c], ecx
cmp dword [ebp - 0x18c], 7
ja case.0x4f8c3c.1
mov edx, dword [ebp - 0x18c]
jmp dword [edx*4 + 0x4f9454]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], 0
je 0x4f8c64
push 1
mov edx, dword [ebp - 0x38]
push edx
call fcn.0043b4e0
mov ecx, eax
call fcn.00519870
jmp case.0x4f8c3c.1
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], 0
je 0x4f8c88
mov edx, dword [ebp - 0x3c]
push edx
call fcn.0043b4e0
mov ecx, eax
call fcn.0051a0d0
jmp case.0x4f8c3c.1
mov eax, dword [ebp - 0x34]
cmp dword [eax + 8], 0
je 0x4f8d4a
lea ecx, [ebp - 0xb4]
call fcn.0043a3d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 8]
push edx
lea ecx, [ebp - 0xb4]
call fcn.0043aa00
lea ecx, [ebp - 0x5c]
call fcn.0040cd50
mov byte [ebp - 4], 1
push str.charge_cmd
lea ecx, [ebp - 0x140]
call fcn.00403bf0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0xb4]
call fcn.0043afa0
mov dword [ebp - 0x124], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x140]
call fcn.00403c30
cmp dword [ebp - 0x124], 0
je 0x4f8d2c
push 0x7ec470
lea ecx, [ebp - 0x5c]
call fcn.00403c80
push eax
call fcn.0043b4e0
mov ecx, eax
call fcn.00518ea0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.00403c30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call fcn.0043a460
jmp case.0x4f8c3c.1
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 8]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
je case.0x4f8c3c.1
mov ecx, dword [ebp - 0xb8]
push ecx
lea ecx, [ebp - 0x15c]
call fcn.00403bf0
mov dword [ebp - 4], 3
push 0
lea edx, [ebp - 0x15c]
push edx
call fcn.0043b4e0
mov ecx, eax
call fcn.00519270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15c]
call fcn.00403c30
mov eax, dword [ebp - 0x34]
cmp dword [eax + 8], 0
je 0x4f8dcf
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x160], edx
mov eax, dword [ebp - 0x160]
push eax
call fcn.00725356
add esp, 4
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x164], edx
mov eax, dword [ebp - 0x164]
push eax
call fcn.00704960
add esp, 4
xor eax, eax
jmp 0x4f92ed
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x17c]
call fcn.005061f0
mov dword [ebp - 0x10], eax
jmp 0x4f8e15
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x17c]
cmp dword [edx + 0x4c0], 0
je 0x4f8e51
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax + 0x4c0]
cmp ecx, dword [ebp + 8]
jne 0x4f8e51
mov edx, dword [ebp - 0x17c]
movzx eax, byte [edx + 0x488]
test eax, eax
je 0x4f8e51
mov ecx, dword [ebp - 0x17c]
call fcn.005052a0
mov ecx, dword [ebp - 0x17c]
cmp dword [ecx + 0x418], 0
je 0x4f929e
mov edx, dword [ebp - 0x17c]
mov eax, dword [edx + 0x418]
cmp eax, dword [ebp + 8]
jne 0x4f929e
mov ecx, dword [ebp - 0x17c]
movzx edx, byte [ecx + 0x4bd]
test edx, edx
je 0x4f929e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0x202
jl 0x4f929e
cmp dword [ebp - 0x190], 0x203
jle 0x4f8ec8
cmp dword [ebp - 0x190], 0x205
je 0x4f8fc4
jmp 0x4f929e
cmp dword [0x89f44c], 0
je 0x4f8ee8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x89f44c]
cmp eax, 0x1f4
jb 0x4f8fb8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x89f44c], eax
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x168], esp
push 0
call fcn.00432bb0
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x198], ecx
mov dword [ebp - 4], 4
push 1
push 0
push str.icon_click
push 0x7ec48c
call fcn.00403df0
mov dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.00402730
call fcn.0043b4e0
mov ecx, eax
call fcn.0051ee70
test eax, eax
jne 0x4f8f9b
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x16c], esp
push 0
call fcn.00432bb0
mov dword [ebp - 0x19c], eax
mov edx, dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], edx
mov dword [ebp - 4], 5
push 1
push 0
push str.tray_click
push 0x7ec4b0
call fcn.00403df0
mov dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.00402730
push 1
push 1
call fcn.0043b4e0
mov ecx, eax
call fcn.00516fd0
push 0x7ec4bc
call fcn.00609080
add esp, 4
mov dword [ebp - 0x1c], 1
jmp 0x4f929e
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x170], esp
push 0
call fcn.00432bb0
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 4], 6
push 1
push 0
push str.icon_rclick
push 0x7ec4f0
call fcn.00403df0
mov dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.00402730
mov dword [ebp - 0xf4], 0
xor ecx, ecx
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0xf4], 0x24
lea edx, [ebp - 0xf4]
push edx
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
mov dword [ebp - 0xc0], 0
xor eax, eax
mov dword [ebp - 0xbc], eax
lea ecx, [ebp - 0xc0]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov dword [ebp - 0xfc], 0x8c
mov dword [ebp - 0xf8], 0x50
push str.TrayMenuNoSettings.xml
lea ecx, [ebp - 0x104]
call fcn.004068d0
mov dword [ebp - 4], 7
mov edx, dword [ebp - 0xe8]
mov dword [ebp - 0x1ac], edx
cmp dword [ebp - 0x1ac], 3
ja case.default.0x4f90ce
mov eax, dword [ebp - 0x1ac]
jmp dword [eax*4 + 0x4f9474]
mov ecx, dword [ebp - 0xc0]
add ecx, 5
mov dword [ebp - 0xc0], ecx
mov edx, dword [ebp - 0xbc]
sub edx, 5
mov dword [ebp - 0xbc], edx
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0xf8]
mov dword [ebp - 0xbc], eax
jmp case.default.0x4f90ce
mov ecx, dword [ebp - 0xc0]
add ecx, 5
mov dword [ebp - 0xc0], ecx
mov edx, dword [ebp - 0xbc]
add edx, 5
mov dword [ebp - 0xbc], edx
jmp case.default.0x4f90ce
mov eax, dword [ebp - 0xc0]
add eax, 5
mov dword [ebp - 0xc0], eax
mov ecx, dword [ebp - 0xbc]
sub ecx, 5
mov dword [ebp - 0xbc], ecx
mov edx, dword [ebp - 0xbc]
sub edx, dword [ebp - 0xf8]
mov dword [ebp - 0xbc], edx
jmp case.default.0x4f90ce
mov eax, dword [ebp - 0xc0]
sub eax, 5
mov dword [ebp - 0xc0], eax
mov ecx, dword [ebp - 0xc0]
sub ecx, dword [ebp - 0xfc]
mov dword [ebp - 0xc0], ecx
mov edx, dword [ebp - 0xbc]
sub edx, 5
mov dword [ebp - 0xbc], edx
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0xf8]
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0xbc]
add ecx, dword [ebp - 0xf8]
push ecx
mov edx, dword [ebp - 0xc0]
add edx, dword [ebp - 0xfc]
push edx
mov eax, dword [ebp - 0xbc]
push eax
mov ecx, dword [ebp - 0xc0]
push ecx
lea ecx, [ebp - 0xd0]
call fcn.005081e0
push 0x2a8
call fcn.00704930
add esp, 4
mov dword [ebp - 0x178], eax
mov byte [ebp - 4], 8
cmp dword [ebp - 0x178], 0
je 0x4f9204
mov ecx, dword [ebp - 0x178]
call fcn.00539dd0
mov dword [ebp - 0x1b0], eax
jmp 0x4f920e
mov dword [ebp - 0x1b0], 0
mov edx, dword [ebp - 0x1b0]
mov dword [ebp - 0x174], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x100], eax
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp - 0xd0]
mov dword [ecx], edx
mov eax, dword [ebp - 0xcc]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0xc8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0xc4]
mov dword [ecx + 0xc], eax
lea ecx, [ebp - 0x104]
call fcn.00405e80
push eax
push 0
mov ecx, dword [ebp - 0x100]
call fcn.00539ef0
push 0x478
mov ecx, dword [ebp - 0x17c]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp - 0x100]
call fcn.00539fe0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x104]
call fcn.00405ef0
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0
je 0x4f92a9
mov eax, dword [ebp - 0x10]
jmp 0x4f92ed
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x17c]
add ecx, 0xb8
call fcn.0059a3e0
movzx ecx, al
test ecx, ecx
je 0x4f92d6
mov eax, dword [ebp - 0x10]
jmp 0x4f92ed
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x17c]
call fcn.005a4730
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.0071fe0b
mov esp, ebp
pop ebp
ret 0xc