Function at 0x4ded00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2a
push 0
push 0
dec ecx
jne 0x4ded08
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4dfab0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xb0]
lea eax, [ebp - 0x34]
mov ecx, 0x4dfad0
call fcn.00407404
xor eax, eax
mov dword [ebp - 0x24], eax
mov cl, 1
mov dl, 1
mov eax, dword [0x4c9d94]
call fcn.004ca6a0
mov dword [ebp - 0x14], eax
mov dl, 1
mov eax, dword [0x427200]
call fcn.00405008
mov dword [ebp - 0x54], eax
mov dl, 1
mov eax, dword [0x427200]
call fcn.00405008
mov dword [ebp - 0x58], eax
xor eax, eax
push ebp
push 0x4dfa23
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x34]
call fcn.00428310
test al, al
jne 0x4dee9e
push 0x4dfad0
push 1
push 0
push 0
push 0
push 0x3ff00000
push 0
push 0x40000000
push 0
mov ecx, 0x4dfaf4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004de960
mov dl, 1
mov eax, dword [0x426504]
call fcn.00405008
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
call fcn.004e03e0
lea eax, [ebp - 0x68]
mov edx, 0x4dfb20
call fcn.00406ce8
mov edx, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004de8f0
test al, al
jne 0x4dee20
lea eax, [ebp - 0x24]
call fcn.004244f8
mov edx, 0x4dfb38
mov eax, dword [ebp - 4]
call fcn.004e05d0
mov byte [ebp - 5], 0
call fcn.00405dfc
jmp 0x4dfa2d
xor edx, edx
mov eax, dword [ebp - 0x34]
call fcn.0042c260
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x4dee50
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 0x34]
mov edx, 0x4dfb70
call fcn.00407404
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 4]
call fcn.004e05d0
jmp 0x4dee96
xor eax, eax
push ebp
push 0x4dee8f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 0x24]
call fcn.00428a70
push 0
push 0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
call fcn.00428de0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dee96
lea eax, [ebp - 0x4c]
call fcn.004244f8
ret
lea eax, [ebp - 0x24]
call fcn.004244f8
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
mov ecx, 0x4dfbac
mov edx, 0x4dfbc8
call fcn.004792a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
call fcn.004785e0
mov eax, dword [ebp - 0x34]
push eax
push 0
push 0
push 0x3ff00000
push 0
push 0x3ff00000
push 0
push 0x40000000
push 0
mov ecx, 0x4dfbe4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004de960
xor ecx, ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
call fcn.004cb7d0
test al, al
je 0x4df97e
mov edx, 0x4dfc0c
mov eax, dword [ebp - 0x14]
call fcn.004ca9f0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4def38
mov edx, 0x4dfc3c
mov eax, dword [ebp - 4]
call fcn.004e0620
mov byte [ebp - 5], 0
call fcn.00405dfc
jmp 0x4dfa2d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, dword [ebp - 0x24]
call fcn.004ccb20
lea eax, [ebp - 0x24]
call fcn.004244f8
mov edx, 0x4dfc7c
mov eax, dword [ebp - 0x14]
call fcn.004ca9f0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4def82
mov edx, 0x4dfcac
mov eax, dword [ebp - 4]
call fcn.004e0620
mov byte [ebp - 5], 0
call fcn.00405dfc
jmp 0x4dfa2d
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
call fcn.004ccb20
lea eax, [ebp - 0x24]
call fcn.004244f8
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
mov ecx, 0x4dfce8
mov edx, 0x4dfcfc
call fcn.00478b50
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x4df084
push 0x3e7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
mov ecx, 0x4dfd14
mov edx, 0x4dfcfc
call fcn.00478b50
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.0042cca0
cmp eax, dword [ebp - 0x3c]
jle 0x4df084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.0042cca0
mov edx, dword [ebp - 0x3c]
add edx, dword [ebp - 0x40]
cmp eax, edx
jne 0x4df07f
lea ecx, [ebp - 0x88]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, dword [ebp - 0x3c]
call fcn.0042ca50
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0x84]
call fcn.00407310
mov eax, dword [ebp - 0x84]
lea edx, [ebp - 0x80]
call fcn.00446e60
lea eax, [ebp - 0x80]
lea edx, [ebp - 0x70]
call fcn.004470c0
mov eax, dword [ebp - 0x70]
push eax
push 0
lea eax, [ebp - 0x8c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
mov ecx, 0x4dfd28
mov edx, 0x4dfcfc
call fcn.00478cf0
mov edx, dword [ebp - 0x8c]
pop eax
call fcn.0040759c
je 0x4df084
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.0042cca0
dec eax
pop edx
sub eax, edx
jl 0x4df967
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x2c], edx
lea ecx, [ebp - 0x94]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, dword [ebp - 0x2c]
call fcn.0042ca50
mov ecx, dword [ebp - 0x94]
lea eax, [ebp - 0x90]
mov edx, 0x4dfd3c
call fcn.00407404
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 4]
call fcn.004e0620
push ebp
mov eax, dword [ebp - 0x2c]
call fcn.004deb80
pop ecx
xor eax, eax
push ebp
push 0x4df92c
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x98]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, dword [ebp - 0x2c]
call fcn.0042ca50
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xb0]
lea eax, [ebp - 0x28]
call fcn.00407404
mov eax, dword [ebp - 0x28]
call fcn.00428310
test al, al
je 0x4df8fd
lea eax, [ebp - 0xc]
call fcn.004244f8
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4c9d94]
call fcn.004ca6a0
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x9c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, dword [ebp - 0x2c]
call fcn.0042ca50
mov eax, dword [ebp - 0x9c]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0x40140000
push 0
push 0x40590000
push 0
mov edx, dword [ebp - 0x2c]
inc edx
mov ecx, 0x4dfd7c
mov eax, dword [ebp - 4]
call fcn.004de960
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.004cb7d0
mov byte [ebp - 0x2d], al
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0xa4]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.004e03b0
mov ecx, dword [ebp - 0xa4]
lea eax, [ebp - 0xa0]
mov edx, 0x4dfda4
call fcn.00407404
mov edx, dword [ebp - 0xa0]
mov eax, dword [ebp - 4]
call fcn.004e0620
cmp byte [ebp - 0x2d], 0
jne 0x4df22a
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x144]
lea eax, [ebp - 0xa8]
mov edx, 0x4dfe18
call fcn.00407404
mov edx, dword [ebp - 0xa8]
mov eax, dword [ebp - 4]
call fcn.004e0620
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4df95b
lea ecx, [ebp - 0xb0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, dword [ebp - 0x2c]
call fcn.0042ca50
mov eax, dword [ebp - 0xb0]
lea ecx, [ebp - 0xac]
xor edx, edx
call fcn.0042c160
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0x18]
call fcn.00428170
lea edx, [ebp - 0xb8]
mov eax, dword [ebp - 0xc]
call fcn.004caaa0
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb4]
call fcn.00428170
mov edx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x18]
call fcn.0040759c
je 0x4df30d
push 0x4dfe5c
lea ecx, [ebp - 0xc0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, dword [ebp - 0x2c]
call fcn.0042ca50
push dword [ebp - 0xc0]
push 0x4dfe74
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 0xc]
call fcn.004caaa0
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0xc4]
call fcn.00428170
push dword [ebp - 0xc4]
push 0x4dfebc
lea eax, [ebp - 0xbc]
mov edx, 5
call fcn.0040748c
mov edx, dword [ebp - 0xbc]
mov eax, dword [ebp - 4]
call fcn.004e0620
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4df95b
lea eax, [ebp - 0x10]
call fcn.004244f8
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4c9d94]
call fcn.004ca6a0
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xcc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, dword [ebp - 0x2c]
call fcn.0042ca50
mov eax, dword [ebp - 0xcc]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0x40140000
push 0
push 0x404e0000
push 0
push 0x40590000
push 0
mov edx, dword [ebp - 0x2c]
inc edx
mov ecx, 0x4dfecc
mov eax, dword [ebp - 4]
call fcn.004de960
lea ecx, [ebp - 0x50]
mov edx, 0x4dfef8
mov eax, dword [ebp - 0x28]
call fcn.0042c160
mov cl, 1
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
call fcn.004cb7d0
test al, al
je 0x4df8b2
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004cb210
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0xd4]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.004e03b0
mov ecx, dword [ebp - 0xd4]
lea eax, [ebp - 0xd0]
mov edx, 0x4dff14
call fcn.00407404
mov edx, dword [ebp - 0xd0]
mov eax, dword [ebp - 4]
call fcn.004e0620
mov eax, dword [ebp - 0x58]
call fcn.0042cca0
test eax, eax
jle 0x4df61a
mov eax, dword [ebp - 0x58]
call fcn.0042cca0
lea edx, [ebp - 0xdc]
call fcn.0041d1b8
mov ecx, dword [ebp - 0xdc]
lea eax, [ebp - 0xd8]
mov edx, 0x4dff4c
call fcn.00407404
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 4]
call fcn.004e0620
mov dl, 1
mov eax, dword [0x426504]
call fcn.00405008
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x58]
call fcn.0042cca0
dec eax
test eax, eax
jl 0x4df612
inc eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0xe0]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x58]
call fcn.0042ca50
mov eax, dword [ebp - 0xe0]
push eax
push 1
push 0
mov eax, dword [ebp - 0x58]
call fcn.0042cca0
mov dword [ebp - 0xe4], eax
fild dword [ebp - 0xe4]
fild dword [ebp - 0x38]
fdivrp st(1)
fmul dword [0x4dff84]
fadd dword [0x4dff88]
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x58]
call fcn.0042cca0
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
mov dword [ebp - 0xe8], eax
fild dword [ebp - 0xe8]
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0x40590000
push 0
mov edx, dword [ebp - 0x2c]
inc edx
mov ecx, 0x4dff98
mov eax, dword [ebp - 4]
call fcn.004de960
mov eax, dword [ebp - 0x24]
call fcn.004291d0
lea edx, [ebp - 0xec]
mov eax, dword [ebp - 4]
call fcn.004e03e0
lea eax, [ebp - 0xec]
push eax
lea ecx, [ebp - 0xf8]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x58]
call fcn.0042ca50
mov edx, dword [ebp - 0xf8]
lea ecx, [ebp - 0xf4]
mov eax, dword [0x4c9d94]
call fcn.004cadb0
mov edx, dword [ebp - 0xf4]
lea eax, [ebp - 0xf0]
mov ecx, 0
call fcn.004070ac
mov edx, dword [ebp - 0xf0]
pop eax
call fcn.00406ce8
mov edx, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004de8f0
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x4df5d1
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x18]
lea ecx, [ebp - 0xfc]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x58]
call fcn.0042ca50
mov edx, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.004cbe30
push 0x4dffc8
lea ecx, [ebp - 0x104]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x58]
call fcn.0042ca50
push dword [ebp - 0x104]
push 0x4dffe4
lea eax, [ebp - 0x100]
mov edx, 3
call fcn.0040748c
mov edx, dword [ebp - 0x100]
mov eax, dword [ebp - 4]
call fcn.004e0620
jmp 0x4df606
lea ecx, [ebp - 0x10c]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x58]
call fcn.0042ca50
mov ecx, dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
mov edx, 0x4e0018
call fcn.00407404
mov edx, dword [ebp - 0x108]
mov eax, dword [ebp - 4]
call fcn.004e0620
inc dword [ebp - 0x38]
dec dword [ebp - 0x60]
jne 0x4df461
lea eax, [ebp - 0x24]
call fcn.004244f8
mov eax, dword [ebp - 0x50]
push eax
push 0
push 0
push 0x40568000
push 0
push 0x40240000
push 0
push 0x40590000
push 0
mov edx, dword [ebp - 0x2c]
inc edx
mov ecx, 0x4e0078
mov eax, dword [ebp - 4]
call fcn.004de960
lea eax, [ebp - 0xc]
call fcn.004244f8
lea eax, [ebp - 0x10]
call fcn.004244f8
mov edx, 1
mov eax, dword [ebp - 0x50]
call fcn.0042c260
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x4df7b1
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x80]
mov edx, 0x40000
mov eax, dword [ebp - 0x20]
call fcn.00446ec0
lea eax, [ebp - 0x80]
lea edx, [ebp - 0x1c]
call fcn.004470c0
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x110]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x54]
call fcn.0042ca50
mov edx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x1c]
call fcn.0040759c
sete byte [ebp - 0x2d]
cmp byte [ebp - 0x2d], 0
je 0x4df735
push 0x4e00b8
lea ecx, [ebp - 0x118]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.004e03b0
push dword [ebp - 0x118]
push 0x4e012c
push dword [ebp - 0x1c]
push 0x4e0148
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
lea eax, [ebp - 0x11c]
call fcn.0041d1e0
push dword [ebp - 0x11c]
push 0x4e0168
lea eax, [ebp - 0x114]
mov edx, 7
call fcn.0040748c
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 4]
call fcn.004e0620
jmp 0x4df79b
push 0x4e00b8
lea ecx, [ebp - 0x124]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.004e03b0
push dword [ebp - 0x124]
push 0x4e012c
push dword [ebp - 0x1c]
push 0x4e0148
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
lea eax, [ebp - 0x128]
call fcn.0041d1e0
push dword [ebp - 0x128]
push 0x4e0188
lea eax, [ebp - 0x120]
mov edx, 7
call fcn.0040748c
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp - 4]
call fcn.004e0620
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df7b8
lea eax, [ebp - 0x20]
call fcn.004244f8
ret
push 0x4e0288
lea ecx, [ebp - 0x148]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, dword [ebp - 0x2c]
call fcn.0042ca50
push dword [ebp - 0x148]
push 0x4e02a4
lea eax, [ebp - 0x144]
mov edx, 3
call fcn.0040748c
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 4]
call fcn.004e0620
mov byte [ebp - 5], 6
jmp 0x4df922
lea eax, [ebp - 0x14c]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4e02d0
call fcn.00407404
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp - 4]
call fcn.004e0620
mov byte [ebp - 5], 6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4df95b
inc dword [ebp - 0x2c]
dec dword [ebp - 0x5c]
jne 0x4df0a7
push ebp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.0042cca0
call fcn.004deb80
pop ecx
jmp 0x4df98f
mov edx, 0x4e0334
mov eax, dword [ebp - 4]
call fcn.004e05d0
mov byte [ebp - 5], 6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfa2d
cmp byte [ebp - 5], 1
je 0x4df9da
lea edx, [ebp - 0x154]
xor eax, eax
mov al, byte [ebp - 5]
call fcn.0041d1b8
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, 0x4e0388
call fcn.00407404
mov edx, dword [ebp - 0x150]
mov eax, dword [ebp - 4]
call fcn.004e05d0
mov byte [ebp - 5], 1
push 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
mov ecx, 0x4dfbac
mov edx, 0x4dfbc8
call fcn.004792a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
call fcn.004785e0
lea eax, [ebp - 0x24]
call fcn.004244f8
lea eax, [ebp - 0x14]
call fcn.004244f8
lea eax, [ebp - 0x54]
call fcn.004244f8
lea eax, [ebp - 0x58]
call fcn.004244f8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfab7
lea eax, [ebp - 0x154]
mov edx, 0x19
call fcn.00406670
lea eax, [ebp - 0xf0]
mov edx, 2
call fcn.004066a0
lea eax, [ebp - 0xe0]
mov edx, 0x17
call fcn.00406670
lea eax, [ebp - 0x84]
call fcn.00406658
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.00406670
lea eax, [ebp - 0x68]
call fcn.00406634
lea eax, [ebp - 0x50]
call fcn.00406610
lea eax, [ebp - 0x34]
call fcn.00406610
lea eax, [ebp - 0x28]
call fcn.00406610
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00406670
ret