Function at 0x4a16c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1e
push 0
push 0
dec ecx
jne 0x4a16d0
push ebx
push esi
push edi
mov dword [ebp - 0x28], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a2242
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4a219a
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
test eax, eax
je 0x4a170f
sub eax, 4
mov eax, dword [eax]
add dword [esi + 0x450], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
test eax, eax
jl 0x4a2190
cmp eax, 0x3e8
jge 0x4a2190
mov eax, dword [ebp - 0x28]
imul ebx, dword [eax], 0x13
mov eax, dword [0x4ad8f8]
mov eax, dword [eax + ebx*4 + 0x38]
mov edx, dword [ebp - 0x28]
cmp eax, dword [edx + 4]
jne 0x4a2182
mov eax, dword [0x4ad8f8]
cmp dword [eax + ebx*4 + 0x14], 0xa
jge 0x4a2182
mov eax, dword [0x4ad8f8]
mov eax, dword [eax + ebx*4 + 4]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x4a1776
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x4e20
jle 0x4a17a3
mov eax, dword [0x4ad8f8]
lea eax, [eax + ebx*4 + 4]
call fcn.00404dd0
mov eax, dword [0x4ad8f8]
mov dword [eax + ebx*4 + 0x14], 0x63
mov eax, dword [ebp - 0x28]
add eax, 8
call fcn.00404dd0
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
mov edx, dword [edx + eax*4 + 4]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 8]
lea eax, [ebp - 4]
call fcn.004050e8
lea eax, [ebp - 8]
call fcn.00404dd0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x9c]
push eax
mov cl, 0x21
mov dl, 0x23
mov eax, dword [ebp - 4]
call fcn.0049ccfc
mov edx, dword [ebp - 0x9c]
lea eax, [ebp - 4]
call fcn.00404e68
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4a17fa
sub ebx, 4
mov ebx, dword [ebx]
cmp ebx, 2
jle 0x4a2141
lea eax, [ebp - 0xa0]
mov edx, dword [ebp - 8]
movzx edx, byte [edx]
call fcn.00404fb8
mov eax, dword [ebp - 0xa0]
mov edx, 0x63
call fcn.0049caa4
mov edi, eax
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
cmp edi, dword [edx + eax*4 + 0x10]
jne 0x4a184d
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
inc dword [edx + eax*4 + 0x14]
jmp 0x4a2154
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
mov dword [edx + eax*4 + 0x10], edi
mov eax, dword [ebp - 8]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x4a1874
mov eax, dword [ebp - 0x50]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.004052c8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x4a18a0
mov eax, dword [ebp - 0x54]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x10
jl 0x4a2154
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
cmp byte [edx + eax*4 + 0x18], 0
je 0x4a1c06
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 0x28]
imul edx, dword [edx], 0x13
mov ecx, dword [0x4ad8f8]
mov dword [ecx + edx*4 + 0x48], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x4a18f3
mov eax, dword [ebp - 0x58]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
add dword [esi + 0x454], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0047d114
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x4a191e
mov eax, dword [ebp - 0x5c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jle 0x4a1930
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0x2a
sete byte [ebp - 0x5d]
jmp 0x4a1934
mov byte [ebp - 0x5d], 0
cmp byte [ebp - 0x5d], 0
je 0x4a1b17
mov eax, dword [ebp - 0x14]
cmp byte [eax + 1], 0x2a
jne 0x4a1b17
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x4a1962
mov eax, dword [ebp - 0x64]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x64]
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 0x14]
call fcn.004052c8
push 0
lea eax, [ebp - 0xa4]
push eax
mov byte [ebp - 0xa8], 0x2f
lea ecx, [ebp - 0xa8]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call fcn.0049cb44
mov edx, dword [ebp - 0xa4]
lea eax, [ebp - 0x14]
call fcn.00404e68
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, 0x4a2258
call fcn.004050e8
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0047d210
call fcn.0040cf44
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0x4a]
lea edx, [ebp - 0x48]
lea eax, [ebp - 0x46]
call fcn.0040cefc
lea eax, [ebp - 0xac]
push eax
movzx eax, word [ebp - 0x46]
mov dword [ebp - 0xc4], eax
mov byte [ebp - 0xc0], 0
movzx eax, word [ebp - 0x48]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
movzx eax, word [ebp - 0x4a]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xc4]
mov ecx, 2
mov eax, 0x4a2264
call fcn.0040c2b4
mov edx, dword [ebp - 0xac]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
call fcn.0047d2a0
lea eax, [ebp - 0xc8]
push eax
movzx eax, word [ebp - 0x46]
mov dword [ebp - 0xc4], eax
mov byte [ebp - 0xc0], 0
movzx eax, word [ebp - 0x48]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
movzx eax, word [ebp - 0x4a]
inc eax
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xc4]
mov ecx, 2
mov eax, 0x4a2264
call fcn.0040c2b4
mov edx, dword [ebp - 0xc8]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
call fcn.0047d2a0
mov edx, dword [0x4ad3cc]
mov edx, dword [edx]
mov eax, dword [ebp - 0x20]
call fcn.0040b0d8
test eax, eax
je 0x4a1b17
mov edx, dword [0x4ad3cc]
mov edx, dword [edx]
mov eax, dword [ebp - 0x24]
call fcn.0040b0d8
test eax, eax
je 0x4a1b17
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
mov ecx, dword [edx + eax*4 + 0x3c]
lea eax, [ebp - 0xcc]
mov edx, 0x4a2274
call fcn.004050e8
mov eax, dword [ebp - 0xcc]
mov edx, 1
call fcn.00499bb4
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
mov eax, dword [edx + eax*4]
call fcn.00473518
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a21fc
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
mov byte [edx + eax*4 + 0x18], 0
push 0x4a2288
lea edx, [ebp - 0xd0]
mov eax, edi
call fcn.0040b4e0
push dword [ebp - 0xd0]
push dword [ebp - 8]
push 0x4a2294
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405164
mov eax, dword [ebp - 8]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x4a1b6c
mov eax, dword [ebp - 0x68]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
inc eax
call fcn.0040309c
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x4a1b8f
mov eax, dword [ebp - 0x6c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 8]
call fcn.004052c0
mov ecx, dword [ebp - 0x6c]
inc ecx
mov edx, dword [ebp - 0x2c]
call fcn.004032fc
mov eax, dword [ebp - 8]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x4a1bba
mov eax, dword [ebp - 0x70]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
mov eax, dword [edx + eax*4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
mov eax, dword [edx + eax*4 + 0xc]
push eax
mov eax, dword [ebp - 0x70]
inc eax
push eax
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
movzx ecx, word [eax]
mov edx, 5
mov eax, esi
call fcn.004a0f54
mov eax, dword [ebp - 0x2c]
call fcn.004030b8
jmp 0x4a2154
mov eax, dword [ebp - 8]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
je 0x4a1c1d
mov eax, dword [ebp - 0x74]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
add dword [esi + 0x458], eax
cmp dword [ebp - 0x34], 0x10
jne 0x4a1c41
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404e68
lea eax, [ebp - 0x10]
call fcn.00404dd0
jmp 0x4a1c85
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x10
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004052c8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
je 0x4a1c6e
mov eax, dword [ebp - 0x78]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x78]
sub ecx, 0x10
mov edx, 0x11
mov eax, dword [ebp - 8]
call fcn.004052c8
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0xc]
call fcn.0047d064
mov byte [ebp - 0x39], 1
mov eax, dword [0x4ad8d4]
cmp byte [eax], 0
je 0x4a1fdf
movzx eax, word [ebp - 0x90]
cmp eax, 0xbdc
jge 0x4a1ccf
sub eax, 0xbbd
je 0x4a1cf5
add eax, 0xfffffffc
sub eax, 0xb
jb 0x4a1cf5
add eax, 0xfffffffc
sub eax, 2
jb 0x4a1cf5
jmp 0x4a1fdf
add eax, 0xfffff424
sub eax, 3
jb 0x4a1cf5
dec eax
sub eax, 3
jb 0x4a1cf5
add eax, 0xffffffef
sub eax, 9
jb 0x4a1cf5
add eax, 0xffffff19
sub eax, 4
jae 0x4a1fdf
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
mov eax, dword [edx + eax*4 + 0x48]
mov dword [ebp - 0x44], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 0x28]
imul edx, dword [edx], 0x13
mov ecx, dword [0x4ad8f8]
mov dword [ecx + edx*4 + 0x48], eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 0x44]
xor edx, edx
push edx
push eax
mov eax, dword [0x4ad488]
mov eax, dword [eax]
cdq
cmp edx, dword [esp + 4]
jne 0x4a1d44
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x4a1fdf
jmp 0x4a1d4c
pop edx
pop eax
jle 0x4a1fdf
push 0x4a22a0
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
push dword [edx + eax*4 + 0x3c]
push 0x4a22b4
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 0x44]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xd8]
call fcn.0040b5cc
push dword [ebp - 0xd8]
lea eax, [ebp - 0xd4]
mov edx, 4
call fcn.00405164
mov eax, dword [ebp - 0xd4]
mov edx, 1
call fcn.00499bb4
mov eax, dword [0x4ad954]
mov eax, dword [eax]
sub eax, 1
jb 0x4a1db9
je 0x4a1dc2
dec eax
je 0x4a1dc8
jmp 0x4a1e43
mov byte [ebp - 0x39], 0
jmp 0x4a1e43
mov byte [ebp - 0x39], 0
jmp 0x4a1e43
mov byte [ebp - 0x39], 0
push 0x4a22c4
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xdc]
call fcn.0040b5cc
push dword [ebp - 0xdc]
push 0x4a2294
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405164
mov edx, dword [0x499a84]
mov eax, 0xc
call fcn.00405c64
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov edx, dword [ebp - 0x40]
mov dword [edx], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x40]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x40]
add eax, 8
mov edx, dword [ebp - 0x10]
call fcn.00404e24
mov eax, dword [0x4ad620]
mov eax, dword [eax]
mov edx, dword [ebp - 0x40]
call fcn.0041bfd8
mov eax, dword [0x4ad940]
cmp byte [eax], 0
je 0x4a1fdf
mov eax, dword [0x4ad4a8]
mov eax, dword [eax]
sub eax, 1
jb 0x4a1e68
je 0x4a1f3b
jmp 0x4a1fdf
mov eax, dword [0x4ad5f4]
movzx eax, byte [eax]
mov byte [ebp - 0x79], al
mov eax, dword [0x4ad748]
movzx eax, byte [eax]
mov byte [ebp - 0x7a], al
movzx eax, byte [ebp - 0x79]
movzx edx, byte [ebp - 0x7a]
shl edx, 8
or ax, dx
mov word [ebp - 0x7c], ax
push 0
push 1
lea eax, [ebp - 0x94]
push eax
movzx ecx, word [ebp - 0x7c]
xor edx, edx
mov ax, 0x64
call fcn.0047ce9c
push 0x4a2288
lea edx, [ebp - 0xe0]
lea eax, [ebp - 0x94]
call fcn.0047d1a4
push dword [ebp - 0xe0]
lea edx, [ebp - 0xe4]
mov eax, dword [0x4ad840]
mov eax, dword [eax]
call fcn.0047d210
push dword [ebp - 0xe4]
push 0x4a2294
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405164
mov edx, dword [0x499a84]
mov eax, 0xc
call fcn.00405c64
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov edx, dword [ebp - 0x40]
mov dword [edx], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x40]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x40]
add eax, 8
mov edx, dword [ebp - 0x10]
call fcn.00404e24
mov eax, dword [0x4ad620]
mov eax, dword [eax]
mov edx, dword [ebp - 0x40]
call fcn.0041bfd8
jmp 0x4a1fdf
push 0
push 0
lea eax, [ebp - 0x94]
push eax
xor ecx, ecx
xor edx, edx
mov ax, 0x2ff
call fcn.0047ce9c
push 0x4a2288
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0x94]
call fcn.0047d1a4
push dword [ebp - 0xe8]
lea edx, [ebp - 0xec]
mov eax, dword [0x4ad840]
mov eax, dword [eax]
call fcn.0047d210
push dword [ebp - 0xec]
push 0x4a2294
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405164
mov edx, dword [0x499a84]
mov eax, 0xc
call fcn.00405c64
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov edx, dword [ebp - 0x40]
mov dword [edx], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x40]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x40]
add eax, 8
mov edx, dword [ebp - 0x10]
call fcn.00404e24
mov eax, dword [0x4ad620]
mov eax, dword [eax]
mov edx, dword [ebp - 0x40]
call fcn.0041bfd8
cmp byte [ebp - 0x39], 0
je 0x4a2154
cmp dword [ebp - 0x10], 0
je 0x4a20db
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x4a200a
mov eax, dword [ebp - 0x80]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
add eax, 0xc
inc eax
call fcn.0040309c
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x94]
mov ecx, 0xc
call fcn.004032fc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x4a204f
mov eax, dword [ebp - 0x84]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x10]
call fcn.004052c0
mov ecx, dword [ebp - 0x84]
inc ecx
mov edx, dword [ebp - 0x2c]
add edx, 0xc
call fcn.004032fc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4a208c
mov eax, dword [ebp - 0x88]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
mov eax, dword [edx + eax*4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
mov eax, dword [edx + eax*4 + 0xc]
push eax
mov eax, dword [ebp - 0x88]
add eax, 0xc
inc eax
push eax
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
movzx ecx, word [eax]
mov edx, 5
mov eax, esi
call fcn.004a0f54
mov eax, dword [ebp - 0x2c]
call fcn.004030b8
jmp 0x4a2154
mov eax, 0xc
call fcn.0040309c
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x94]
mov ecx, 0xc
call fcn.004032fc
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
mov eax, dword [edx + eax*4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
mov eax, dword [edx + eax*4 + 0xc]
push eax
push 0xc
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
movzx ecx, word [eax]
mov edx, 5
mov eax, esi
call fcn.004a0f54
mov eax, dword [ebp - 0x2c]
call fcn.004030b8
jmp 0x4a2154
cmp dword [ebp - 0x38], 1
jl 0x4a2151
lea eax, [ebp - 4]
call fcn.00404dd0
jmp 0x4a2154
inc dword [ebp - 0x38]
mov edx, dword [ebp - 4]
mov eax, 0x4a2294
call fcn.004053ac
dec eax
jge 0x4a17c1
mov eax, dword [ebp - 0x28]
imul eax, dword [eax], 0x13
mov edx, dword [0x4ad8f8]
lea eax, [edx + eax*4 + 4]
mov edx, dword [ebp - 4]
call fcn.00404e24
jmp 0x4a2190
mov eax, dword [0x4ad8f8]
lea eax, [eax + ebx*4 + 4]
call fcn.00404dd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a21fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2249
lea eax, [ebp - 0xf0]
mov edx, 0xb
call fcn.00404df4
lea eax, [ebp - 0xac]
call fcn.00404dd0
lea eax, [ebp - 0xa4]
mov edx, 3
call fcn.00404df4
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00404df4
ret