Function at 0x473eec
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x88
push 0
push 0
dec ecx
jne 0x473ef4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x474e06
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [0x9ae537]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
shl edx, 5
lea edx, [edx*8 + 0x9aee63]
call fcn.00403f3c
mov edx, dword [ebp - 0x30]
mov eax, 0x474e1c
call fcn.00404280
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x30]
mov eax, 0x474e2c
call fcn.00404280
mov dword [0x9b0170], eax
xor eax, eax
push ebp
push 0x473fa2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x30]
call fcn.0040415c
push eax
push 0x474e34
call sub.kernel32.dll_SetEnvironmentVariableA
push 0x474e3c
push 0x474e44
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x473fac
lea eax, [ebp - 0x48]
mov edx, 0x9adbfa
call fcn.00403f3c
xor eax, eax
push ebp
push 0x473fe4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x48]
call fcn.0040415c
push eax
push 0x474e50
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x473fee
lea eax, [ebp - 0x40]
mov edx, 0x9afd98
call fcn.00403f3c
xor eax, eax
push ebp
push 0x47406f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x40], 0
je 0x474022
mov eax, dword [ebp - 0x40]
call fcn.0040415c
push eax
push 0x474e58
call sub.kernel32.dll_SetEnvironmentVariableA
cmp dword [ebp - 0x40], 0
je 0x47403b
mov eax, dword [ebp - 0x40]
call fcn.0040415c
push eax
push 0x474e64
call sub.kernel32.dll_SetEnvironmentVariableA
cmp dword [ebp - 0x40], 0
jne 0x474050
push 0x474e70
push 0x474e58
call sub.kernel32.dll_SetEnvironmentVariableA
cmp dword [ebp - 0x40], 0
jne 0x474065
push 0x474e70
push 0x474e64
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x474079
cmp dword [ebp - 0x40], 0
je 0x47408e
mov eax, dword [0x483d3c]
mov edx, 0x474e88
call fcn.00403d70
cmp dword [ebp - 0x40], 0
jne 0x4740a3
mov eax, dword [0x483d3c]
mov edx, 0x474e9c
call fcn.00403d70
mov eax, dword [ebp - 8]
cmp dword [eax*4 + 0x9adadc], 0
je 0x4740bd
mov eax, dword [ebp - 8]
mov eax, dword [eax*4 + 0x9adadc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
cmp dword [eax*4 + 0x9adb04], 0
je 0x4740d7
mov eax, dword [ebp - 8]
mov eax, dword [eax*4 + 0x9adb04]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
imul edx, dword [ebp - 8], 0xd
add edx, 0x9add80
call fcn.00403f3c
cmp byte [0x9afe98], 1
jne 0x4740f9
mov byte [0x9b010b], 1
xor eax, eax
push ebp
push 0x47413d
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00409ebc
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00473e50
mov ebx, eax
mov eax, dword [ebp - 0x1c]
call fcn.0040b264
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00473e50
sub ebx, eax
mov dword [ebp - 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x474147
mov eax, dword [ebp - 0x1c]
mov edx, 0x474eb4
call fcn.004040a8
jne 0x47415b
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov edx, 0x474eb4
call fcn.004040a8
jne 0x4744d8
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x338]
mov eax, dword [0x483f48]
mov eax, dword [eax]
call fcn.004561f8
lea ecx, [ebp - 0x338]
mov edx, 0x474ec8
mov eax, 0x474ed8
call fcn.00472664
mov edx, dword [ebp - 0x20]
mov eax, 0x474eec
call fcn.00404280
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov edx, 1
call fcn.004041dc
xor eax, eax
push ebp
push 0x474266
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x483f7c]
cmp dword [eax], 2
jne 0x474200
mov edx, dword [0x483f24]
mov edx, dword [edx]
lea eax, [ebp - 0x33c]
mov ecx, 0x474ef8
call fcn.00403fe4
mov ecx, dword [ebp - 0x33c]
mov dl, 1
mov eax, dword [0x456424]
call fcn.004564cc
mov dword [0x9b00fc], eax
mov eax, dword [0x483f7c]
cmp dword [eax], 2
je 0x474220
mov ecx, 0x474f10
mov dl, 1
mov eax, dword [0x456424]
call fcn.004564cc
mov dword [0x9b00fc], eax
call fcn.00409e90
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x33c]
call fcn.0040aa78
mov eax, dword [ebp - 0x33c]
push eax
mov ecx, 0x474f24
mov edx, dword [ebp - 0x20]
mov eax, dword [0x9b00fc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov dl, 1
mov eax, dword [0x9b00fc]
mov ecx, dword [eax]
call dword [ecx - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x474270
mov eax, dword [0x483f24]
push dword [eax]
push 0x474f38
push dword [ebp - 0x20]
push 0x474f44
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00404058
mov eax, dword [ebp - 0x28]
call fcn.00408bb4
test al, al
je 0x4742a9
mov byte [0x9b0120], 1
jmp 0x474dc8
xor eax, eax
push ebp
push 0x47433d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x483f7c]
cmp dword [eax], 2
jne 0x4742f0
mov edx, dword [0x483f24]
mov edx, dword [edx]
lea eax, [ebp - 0x33c]
mov ecx, 0x474ef8
call fcn.00403fe4
mov ecx, dword [ebp - 0x33c]
mov dl, 1
mov eax, dword [0x456424]
call fcn.004564cc
mov dword [0x9b00fc], eax
mov eax, dword [0x483f7c]
cmp dword [eax], 2
je 0x474310
mov ecx, 0x474f10
mov dl, 1
mov eax, dword [0x456424]
call fcn.004564cc
mov dword [0x9b00fc], eax
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x474f54
mov edx, dword [ebp - 0x20]
mov eax, dword [0x9b00fc]
mov ebx, dword [eax]
call dword [ebx]
mov dl, 1
mov eax, dword [0x9b00fc]
mov ecx, dword [eax]
call dword [ecx - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x474347
mov eax, dword [ebp - 0x24]
mov edx, 0x474f6c
call fcn.004040a8
jne 0x474362
mov byte [0x9b0120], 1
jmp 0x474dc8
mov eax, dword [0x483f24]
push dword [eax]
push 0x474f38
push dword [ebp - 0x20]
push 0x474f44
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00404058
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x328]
call fcn.00405e0e
lea eax, [ebp - 0x328]
call fcn.00405ff6
mov edx, 0x474f7c
lea eax, [ebp - 0x328]
call fcn.00404358
call fcn.00406207
lea eax, [ebp - 0x328]
call fcn.00405f78
xor eax, eax
push ebp
push 0x474450
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x483f7c]
cmp dword [eax], 2
jne 0x474403
mov edx, dword [0x483f24]
mov edx, dword [edx]
lea eax, [ebp - 0x33c]
mov ecx, 0x474ef8
call fcn.00403fe4
mov ecx, dword [ebp - 0x33c]
mov dl, 1
mov eax, dword [0x456424]
call fcn.004564cc
mov dword [0x9b00fc], eax
mov eax, dword [0x483f7c]
cmp dword [eax], 2
je 0x474423
mov ecx, 0x474f10
mov dl, 1
mov eax, dword [0x456424]
call fcn.004564cc
mov dword [0x9b00fc], eax
push 0x474f6c
mov ecx, 0x474f54
mov edx, dword [ebp - 0x20]
mov eax, dword [0x9b00fc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov dl, 1
mov eax, dword [0x9b00fc]
mov ecx, dword [eax]
call dword [ecx - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47445a
call fcn.00409e90
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x33c]
call fcn.0040aa78
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x43c]
mov ecx, 0xff
call fcn.00403f74
lea edx, [ebp - 0x43c]
imul eax, dword [ebp - 8], 0xd
add eax, 0x9add80
mov cl, 0xc
call fcn.00402bfc
lea eax, [ebp - 0x440]
call fcn.00457898
push dword [ebp - 0x440]
push 0x474f38
mov eax, dword [0x483f48]
push dword [eax]
lea eax, [ebp - 0x33c]
mov edx, 3
call fcn.00404058
mov edx, dword [ebp - 0x33c]
mov eax, dword [ebp - 4]
call fcn.004755c8
call fcn.00473894
mov eax, dword [0x483dac]
mov edx, 0x9ae021
call fcn.00403f3c
cmp byte [0x9afea1], 1
jne 0x474521
push dword [0x9afe9d]
push dword [0x9afe99]
call fcn.00473e50
mov ebx, eax
call fcn.00409ebc
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00473e50
sub ebx, eax
mov dword [0x9b012c], ebx
cmp dword [ebp - 0x10], 0
je 0x4745e3
lea edx, [ebp - 0x33c]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
call fcn.004089c0
mov edx, dword [ebp - 0x33c]
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f0]
call fcn.0042b2fc
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov dword [0x9b0110], eax
mov eax, dword [0x9b0110]
mov dword [0x9b0114], eax
cmp byte [0x9afea1], 1
jne 0x4745e3
push dword [0x9afe9d]
push dword [0x9afe99]
call fcn.00473e50
mov ebx, eax
call fcn.00409ebc
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00473e50
sub ebx, eax
mov dword [0x9b012c], ebx
cmp dword [0x9b012c], 0
jge 0x4745ae
xor eax, eax
mov dword [0x9b012c], eax
mov eax, dword [0x9b0110]
cmp eax, dword [0x9b012c]
jle 0x4745e3
lea edx, [ebp - 0x33c]
mov eax, dword [0x9b012c]
call fcn.004089c0
mov edx, dword [ebp - 0x33c]
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f0]
call fcn.0042b2fc
cmp dword [ebp - 0x14], 0
je 0x474615
lea edx, [ebp - 0x33c]
mov eax, dword [ebp - 0x14]
sub eax, dword [0x9adf1d]
call fcn.004089c0
mov edx, dword [ebp - 0x33c]
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f0]
call fcn.0042b2fc
cmp dword [ebp - 0x10], 0
je 0x4746dc
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
xor edx, edx
call fcn.00461d54
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
mov edx, dword [ebp - 0x10]
call fcn.00461d60
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x18]
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
call fcn.00461d70
cmp byte [0x9afea1], 1
jne 0x47468e
mov eax, dword [0x9b0110]
cmp eax, dword [0x9b012c]
jle 0x47468e
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
mov edx, dword [0x9b012c]
call fcn.00461d70
xor eax, eax
push ebp
push 0x4746d2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x33c]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
call fcn.004089c0
mov eax, dword [ebp - 0x33c]
call fcn.0040415c
push eax
push 0x474fac
call sub.kernel32.dll_SetEnvironmentVariableA
call fcn.0040cfc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4746dc
cmp dword [ebp - 0x14], 0
je 0x4747b3
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
xor edx, edx
call fcn.00461d54
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
mov edx, dword [ebp - 0x14]
call fcn.00461d60
mov edx, dword [ebp - 0x14]
sub edx, dword [0x9adf1d]
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
call fcn.00461d70
inc dword [0x9adf1d]
lea eax, [ebp - 0x440]
call fcn.00457898
push dword [ebp - 0x440]
push 0x474f38
mov eax, dword [0x483f48]
push dword [eax]
lea eax, [ebp - 0x33c]
mov edx, 3
call fcn.00404058
mov edx, dword [ebp - 0x33c]
mov eax, dword [ebp - 4]
call fcn.004755c8
xor eax, eax
push ebp
push 0x4747a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x33c]
mov eax, dword [0x9adf1d]
call fcn.004089c0
mov eax, dword [ebp - 0x33c]
call fcn.0040415c
push eax
push 0x474fb8
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4747b3
mov eax, dword [0x9ae127]
and eax, 0x40
cmp eax, 0x40
jne 0x47482d
xor eax, eax
push ebp
push 0x474823
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40f1c4]
call fcn.004030c8
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x33c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e4]
mov eax, dword [eax + 0x58]
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x33c]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea ecx, [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x4c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x4c]
call fcn.004030f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47482d
mov eax, dword [0x9ae127]
and eax, 0x10
cmp eax, 0x10
jne 0x474875
mov eax, dword [0x483da4]
cmp dword [eax], 0x1770
jge 0x47484f
lea eax, [ebp - 0x2c]
call fcn.00472580
cmp dword [ebp - 0x2c], 0
jne 0x474875
call fcn.0045785c
mov dword [ebp - 0x444], eax
fild dword [ebp - 0x444]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x2c]
call fcn.0040999c
mov eax, dword [0x9ae127]
and eax, 1
dec eax
jne 0x474899
lea eax, [ebp - 0x33c]
call fcn.004575cc
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x2c]
call fcn.00403fa0
mov eax, dword [0x9ae127]
and eax, 2
cmp eax, 2
jne 0x4748d7
call fcn.0045785c
mov dword [ebp - 0x444], eax
fild dword [ebp - 0x444]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x33c]
call fcn.0040999c
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x2c]
call fcn.00403fa0
mov eax, dword [0x9ae127]
and eax, 4
cmp eax, 4
jne 0x4748fd
lea eax, [ebp - 0x33c]
call fcn.00457814
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x2c]
call fcn.00403fa0
mov eax, dword [0x9ae127]
and eax, 8
cmp eax, 8
jne 0x47491d
lea eax, [ebp - 0x44]
call fcn.00468468
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x44]
call fcn.00403fa0
mov eax, dword [0x9ae127]
and eax, 0x20
cmp eax, 0x20
jne 0x47495b
call fcn.0047244c
mov dword [ebp - 0x444], eax
fild dword [ebp - 0x444]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x33c]
call fcn.0040999c
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x2c]
call fcn.00403fa0
mov eax, dword [ebp - 8]
mov eax, dword [eax*4 + 0x9af95f]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x2c]
lea edx, [ebp - 0x440]
mov eax, dword [ebp - 0x38]
call fcn.004089c0
push dword [ebp - 0x440]
mov eax, dword [0x483f48]
push dword [eax]
lea eax, [ebp - 0x33c]
mov edx, 3
call fcn.00404058
mov eax, dword [ebp - 0x33c]
lea edx, [ebp - 0x338]
call fcn.004561f8
lea ecx, [ebp - 0x338]
mov edx, 0x474fc8
mov eax, 0x474ed8
call fcn.00472664
mov edx, dword [ebp - 0x20]
mov eax, 0x474eec
call fcn.00404280
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
mov edx, 1
call fcn.004041dc
mov eax, dword [ebp - 0x20]
call fcn.00403f98
mov ecx, eax
sub ecx, 8
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.004041dc
lea edx, [ebp - 0x20]
mov ecx, 5
mov eax, 0x474fdc
call fcn.00404224
lea edx, [ebp - 0x33c]
mov eax, dword [ebp - 0x2c]
call fcn.004088a4
cmp dword [ebp - 0x33c], 0
jne 0x474a30
lea eax, [ebp - 0x20]
mov edx, 0x474fe8
call fcn.00403db4
lea edx, [ebp - 0x33c]
mov eax, dword [ebp - 0x20]
call fcn.004086c0
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x20]
call fcn.00403db4
xor eax, eax
push ebp
push 0x474aaa
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40f1c4]
call fcn.004030c8
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x33c]
mov ecx, 0x474ffc
mov edx, dword [0x9b00f0]
call fcn.00403fe4
mov edx, dword [ebp - 0x33c]
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 0x50]
call fcn.004030f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x474ab4
xor eax, eax
push ebp
push 0x474b35
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x9adc5f], 0
jne 0x474ade
mov eax, dword [ebp - 0x20]
call fcn.0040415c
push eax
push 0x475008
call sub.kernel32.dll_SetEnvironmentVariableA
cmp byte [0x9adc5f], 0
je 0x474b2b
push dword [ebp - 0x20]
push 0x474fdc
lea eax, [ebp - 0x440]
mov edx, 0x9adc5f
call fcn.00403f3c
push dword [ebp - 0x440]
lea eax, [ebp - 0x33c]
mov edx, 3
call fcn.00404058
mov eax, dword [ebp - 0x33c]
call fcn.0040415c
push eax
push 0x475008
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x474b3f
cmp byte [0x9adc5f], 0
je 0x474b8e
push dword [ebp - 0x20]
push 0x474fdc
lea eax, [ebp - 0x440]
mov edx, 0x9adc5f
call fcn.00403f3c
push dword [ebp - 0x440]
lea eax, [ebp - 0x33c]
mov edx, 3
call fcn.00404058
mov edx, dword [ebp - 0x33c]
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x334]
call fcn.0042b2fc
cmp byte [0x9adc5f], 0
jne 0x474bac
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x334]
mov edx, dword [ebp - 0x20]
call fcn.0042b2fc
mov eax, dword [ebp - 0x20]
mov edx, 0x474fe8
call fcn.004040a8
mov eax, 0x186a0
call fcn.00402d40
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x33c]
mov eax, dword [ebp - 0x34]
call fcn.004089c0
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x43c]
mov ecx, 0xff
call fcn.00403f74
lea edx, [ebp - 0x43c]
mov eax, 0x9afd8d
mov cl, 0xa
call fcn.00402bfc
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x338]
mov eax, dword [0x483f48]
mov eax, dword [eax]
call fcn.004561f8
lea ecx, [ebp - 0x338]
mov edx, 0x474ec8
mov eax, 0x474ed8
call fcn.00472664
mov edx, dword [ebp - 0x20]
mov eax, 0x474eec
call fcn.00404280
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov edx, 1
call fcn.004041dc
mov eax, dword [0x483f7c]
cmp dword [eax], 2
jne 0x474c80
mov edx, dword [0x483f24]
mov edx, dword [edx]
lea eax, [ebp - 0x33c]
mov ecx, 0x474ef8
call fcn.00403fe4
mov ecx, dword [ebp - 0x33c]
mov dl, 1
mov eax, dword [0x456424]
call fcn.004564cc
mov dword [0x9b00fc], eax
mov eax, dword [0x483f7c]
cmp dword [eax], 2
je 0x474ca0
mov ecx, 0x474f10
mov dl, 1
mov eax, dword [0x456424]
call fcn.004564cc
mov dword [0x9b00fc], eax
lea edx, [ebp - 0x33c]
mov eax, dword [ebp - 0x34]
call fcn.004089c0
mov eax, dword [ebp - 0x33c]
push eax
mov ecx, 0x47501c
mov edx, dword [ebp - 0x20]
mov eax, dword [0x9b00fc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov dl, 1
mov eax, dword [0x9b00fc]
mov ecx, dword [eax]
call dword [ecx - 4]
lea eax, [ebp - 0x440]
call fcn.00457898
push dword [ebp - 0x440]
push 0x474f38
mov eax, dword [0x483f48]
push dword [eax]
lea eax, [ebp - 0x33c]
mov edx, 3
call fcn.00404058
mov edx, dword [ebp - 0x33c]
mov eax, dword [ebp - 4]
call fcn.004755c8
cmp dword [ebp - 0x3c], 0
jle 0x474d31
cmp byte [0x9b0109], 1
jne 0x474d31
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xcc]
jmp 0x474dc8
cmp dword [ebp - 0x3c], 0
jg 0x474dc8
cmp dword [0x9b0170], 0
jg 0x474dc8
cmp byte [0x9ae122], 1
jne 0x474d66
cmp dword [ebp - 0x3c], 0
jne 0x474d66
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xcc]
cmp byte [0x9b0109], 1
jne 0x474d7e
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xcc]
cmp dword [0x9affa6], 0
jle 0x474dc8
cmp dword [ebp - 0x10], 0
je 0x474dc8
xor eax, eax
push ebp
push 0x474dbe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x9affa6]
cmp eax, dword [ebp - 0x18]
jne 0x474db4
mov eax, dword [0x483c4c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xcc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x474dc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474e0d
lea eax, [ebp - 0x440]
call fcn.00403d1c
lea eax, [ebp - 0x33c]
call fcn.00403d1c
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.00403d40
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.00403d40
ret