Function at 0x46f933
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101278e0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x101badf4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x2c]
add eax, dword [esi]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x30]
add eax, dword [esi + 4]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0x34]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 0x38]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x44]
sub eax, dword [esi + 0x40]
sar eax, 2
cmp eax, 1
jb 0x4703d4
cmp dword [esi + 0x20], 0
mov eax, dword [esi + 0x24]
je 0x46feb2
test eax, eax
jne 0x46fba2
mov eax, dword [esi + 0x28]
cmp eax, 1
je 0x46fea8
cmp eax, 3
jne 0x46fab9
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0
push eax
call fcn.0046ec23
mov eax, dword [esi + 0x10]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
sub eax, edx
sar eax, 4
mov dword [ebp - 0x30], eax
test eax, eax
jle 0x46fa82
lea edi, [edx + 0xc]
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push dword [edi]
call fcn.0046f6b3
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
sub eax, dword [edi - 4]
cmp dword [ebp - 0x28], 1
mov dword [ebp - 0x48], eax
jne 0x46fa52
mov eax, dword [esi + 0x10]
mov ecx, esi
mov dword [ebp - 0x4c], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
jmp 0x46fa76
mov ecx, dword [ebp - 0x50]
mov eax, dword [edi - 8]
add eax, ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x44], eax
mov ecx, esi
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
mov eax, dword [esi + 0x3c]
add eax, dword [edi - 8]
add dword [ebp - 0x50], eax
add edi, 0x10
sub dword [ebp - 0x30], 1
jne 0x46fa18
mov edx, dword [ebp - 0x3c]
test edx, edx
je 0x4703d4
mov ecx, dword [ebp - 0x34]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffff0
cmp ecx, 0x1000
jb 0x470382
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4703f2
jmp 0x470382
cmp eax, 4
jne 0x46fea8
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.0046ec23
mov eax, dword [esi + 0x10]
mov edi, dword [ebp - 0x38]
sub edi, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [esi + 0x1c]
sub eax, dword [esi + 0x14]
cdq
sub eax, edx
sar edi, 4
sar eax, 1
add eax, dword [esi + 0x14]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], 0
test edi, edi
jle 0x46fa7f
mov edi, dword [ebp - 0x3c]
add edi, 0xc
mov dword [ebp - 0x2c], edi
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push dword [edi]
call fcn.0046f6b3
mov edi, dword [edi - 4]
mov eax, edi
mov ecx, dword [ebp - 0x54]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
cmp dword [ebp - 0x28], 1
mov dword [ebp - 0x48], ecx
lea eax, [ecx + edi]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
jne 0x46fb6d
mov eax, dword [esi + 0x10]
mov ecx, esi
mov dword [ebp - 0x4c], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
jmp 0x46fb91
mov ecx, dword [ebp - 0x50]
mov eax, dword [edi - 8]
add eax, ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x44], eax
mov ecx, esi
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
mov eax, dword [esi + 0x3c]
add eax, dword [edi - 8]
add dword [ebp - 0x50], eax
add edi, 0x10
sub dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], edi
jne 0x46fb24
jmp 0x46fa7f
cmp eax, 2
jne 0x46fe3e
mov eax, dword [esi + 0x28]
cmp eax, 1
jne 0x46fc78
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 2
push eax
mov ecx, esi
call fcn.0046ec23
mov eax, dword [esi + 0x14]
mov edx, dword [ebp - 0x3c]
mov ecx, dword [esi + 0x18]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
sub eax, edx
mov dword [ebp - 0x2c], ecx
sar eax, 4
sub eax, 1
mov dword [ebp - 0x30], eax
js 0x46fa82
shl eax, 4
lea edi, [edx + 0xc]
add edi, eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push dword [edi]
call fcn.0046f6b3
mov ecx, dword [ebp - 0x54]
mov eax, dword [edi - 4]
add eax, ecx
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x28], 1
mov ecx, esi
mov dword [ebp - 0x40], eax
jne 0x46fc45
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
jmp 0x46fc65
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
sub eax, dword [edi - 8]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
mov eax, dword [esi + 0x3c]
add eax, dword [edi - 8]
sub dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
sub edi, 0x10
dec eax
mov dword [ebp - 0x30], eax
test eax, eax
jns 0x46fc09
jmp 0x46fa7f
cmp eax, 3
jne 0x46fd40
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], eax
mov ecx, esi
lea eax, [ebp - 0x3c]
push eax
call fcn.0046ec23
mov eax, dword [esi + 0x1c]
mov edx, dword [ebp - 0x3c]
mov ecx, dword [esi + 0x18]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
sub eax, edx
mov dword [ebp - 0x2c], ecx
sar eax, 4
sub eax, 1
mov dword [ebp - 0x30], eax
js 0x46fa82
shl eax, 4
lea edi, [edx + 0xc]
add edi, eax
nop dword [eax]
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push dword [edi]
call fcn.0046f6b3
mov eax, dword [ebp - 0x54]
mov ecx, esi
mov dword [ebp - 0x40], eax
sub eax, dword [edi - 4]
cmp dword [ebp - 0x28], 1
mov dword [ebp - 0x48], eax
jne 0x46fd0d
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
jmp 0x46fd2d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
sub eax, dword [edi - 8]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
mov eax, dword [esi + 0x3c]
add eax, dword [edi - 8]
sub dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
sub edi, 0x10
dec eax
mov dword [ebp - 0x30], eax
test eax, eax
jns 0x46fcd3
jmp 0x46fa7f
cmp eax, 4
jne 0x46fea8
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], eax
mov ecx, esi
lea eax, [ebp - 0x3c]
push eax
call fcn.0046ec23
mov eax, dword [esi + 0x18]
xorps xmm0, xmm0
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x1c]
sub eax, dword [esi + 0x14]
cdq
sub eax, edx
mov edx, dword [ebp - 0x3c]
sar eax, 1
add eax, dword [esi + 0x14]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
sub eax, edx
sar eax, 4
sub eax, 1
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x30], eax
js 0x46fa82
shl eax, 4
lea edi, [edx + 0xc]
add edi, eax
mov dword [ebp - 0x50], edi
nop dword [eax]
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push dword [edi]
call fcn.0046f6b3
test eax, eax
je 0x46fe24
mov edi, dword [edi - 4]
mov eax, edi
mov ecx, dword [ebp - 0x54]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
cmp dword [ebp - 0x28], 1
mov dword [ebp - 0x48], ecx
lea eax, [edi + ecx]
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x40], eax
jne 0x46fe00
mov eax, dword [esi + 0x10]
mov ecx, esi
mov dword [ebp - 0x4c], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
jmp 0x46fe24
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
sub eax, dword [edi - 8]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
mov dword [ebp - 0x44], ecx
mov ecx, esi
call fcn.0046f563
mov eax, dword [esi + 0x3c]
add eax, dword [edi - 8]
sub dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
sub edi, 0x10
dec eax
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x30], eax
test eax, eax
jns 0x46fdb3
jmp 0x46fa7f
cmp eax, 4
jne 0x46fe73
mov eax, dword [esi + 0x28]
cmp eax, 1
jne 0x46fe55
call fcn.00470533
jmp 0x4703d4
cmp eax, 3
jne 0x46fe64
call fcn.004707d3
jmp 0x4703d4
cmp eax, 4
jne 0x46fea8
call fcn.00470a73
jmp 0x4703d4
cmp eax, 5
jne 0x46fea8
mov eax, dword [esi + 0x28]
cmp eax, 1
jne 0x46fe8a
call fcn.00470d33
jmp 0x4703d4
cmp eax, 3
jne 0x46fe99
call fcn.00470fd3
jmp 0x4703d4
cmp eax, 4
jne 0x46fea8
call fcn.00471273
jmp 0x4703d4
call fcn.00470403
jmp 0x4703d4
test eax, eax
jne 0x46ffa5
mov eax, dword [esi + 0x28]
cmp eax, 1
je 0x4703cf
cmp eax, 3
jne 0x46ff92
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 5
push eax
mov ecx, esi
call fcn.0046ec23
mov eax, dword [esi + 0x10]
mov edx, dword [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
sub eax, edx
mov dword [ebp - 0x2c], ecx
sar eax, 4
sub eax, 1
mov dword [ebp - 0x30], eax
js 0x46fa82
shl eax, 4
lea edi, [edx + 0xc]
add edi, eax
nop
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push dword [edi]
call fcn.0046f6b3
mov ecx, dword [ebp - 0x54]
mov eax, dword [edi - 8]
add eax, ecx
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x24], 1
mov ecx, esi
mov dword [ebp - 0x44], eax
jne 0x46ff5f
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
jmp 0x46ff7f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
sub eax, dword [edi - 4]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
mov eax, dword [esi + 0x3c]
add eax, dword [edi - 4]
sub dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
sub edi, 0x10
dec eax
mov dword [ebp - 0x30], eax
test eax, eax
jns 0x46ff23
jmp 0x46fa7f
cmp eax, 4
jne 0x47039e
call fcn.00471663
jmp 0x4703d4
cmp eax, 2
jne 0x470153
mov eax, dword [esi + 0x28]
cmp eax, 1
jne 0x470072
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 6
push eax
mov ecx, esi
call fcn.0046ec23
mov eax, dword [esi + 0x18]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
sub eax, edx
sar eax, 4
mov dword [ebp - 0x30], eax
test eax, eax
jle 0x46fa82
lea edi, [edx + 0xc]
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push dword [edi]
call fcn.0046f6b3
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x44], eax
sub eax, dword [edi - 8]
cmp dword [ebp - 0x24], 1
mov dword [ebp - 0x4c], eax
jne 0x470040
mov eax, dword [esi + 0x14]
mov ecx, esi
mov dword [ebp - 0x48], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
jmp 0x470064
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi - 4]
add eax, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x40], eax
mov ecx, esi
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
mov eax, dword [esi + 0x3c]
add eax, dword [edi - 4]
add dword [ebp - 0x2c], eax
add edi, 0x10
sub dword [ebp - 0x30], 1
jne 0x470006
jmp 0x46fa7f
cmp eax, 3
jne 0x470140
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 7
push eax
mov ecx, esi
call fcn.0046ec23
mov eax, dword [esi + 0x18]
mov edx, dword [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
sub eax, edx
mov dword [ebp - 0x2c], ecx
sar eax, 4
sub eax, 1
mov dword [ebp - 0x30], eax
js 0x46fa82
shl eax, 4
lea edi, [edx + 0xc]
add edi, eax
nop word [eax + eax]
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push dword [edi]
call fcn.0046f6b3
mov eax, dword [ebp - 0x54]
mov ecx, esi
mov dword [ebp - 0x44], eax
sub eax, dword [edi - 8]
cmp dword [ebp - 0x24], 1
mov dword [ebp - 0x4c], eax
jne 0x47010d
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
jmp 0x47012d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
sub eax, dword [edi - 4]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
mov eax, dword [esi + 0x3c]
add eax, dword [edi - 4]
sub dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
sub edi, 0x10
dec eax
mov dword [ebp - 0x30], eax
test eax, eax
jns 0x4700d3
jmp 0x46fa7f
cmp eax, 4
jne 0x4703b0
call fcn.00471903
jmp 0x4703d4
cmp eax, 4
jne 0x47039a
mov eax, dword [esi + 0x28]
cmp eax, 1
jne 0x47028c
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 8
push eax
mov ecx, esi
call fcn.0046ec23
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov edi, dword [ebp - 0x3c]
sub eax, edi
sar eax, 4
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x18]
sub eax, dword [esi + 0x10]
cdq
sub eax, edx
mov dword [ebp - 0x4c], 0
sar eax, 1
add eax, dword [esi + 0x10]
cmovns ecx, eax
cmp dword [ebp - 0x30], 0
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x2c], eax
jle 0x47024f
add edi, 0xc
mov dword [ebp - 0x50], edi
nop dword [eax]
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push dword [edi]
call fcn.0046f6b3
mov edi, dword [edi - 8]
mov eax, edi
mov ecx, dword [ebp - 0x54]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
cmp dword [ebp - 0x24], 1
mov dword [ebp - 0x4c], ecx
lea eax, [ecx + edi]
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x44], eax
jne 0x47021c
mov eax, dword [esi + 0x14]
mov ecx, esi
mov dword [ebp - 0x48], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
jmp 0x470240
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi - 4]
add eax, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x40], eax
mov ecx, esi
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
mov eax, dword [esi + 0x3c]
add eax, dword [edi - 4]
add dword [ebp - 0x2c], eax
add edi, 0x10
sub dword [ebp - 0x30], 1
mov dword [ebp - 0x50], edi
jne 0x4701d3
mov edi, dword [ebp - 0x3c]
test edi, edi
je 0x4703d4
mov ecx, dword [ebp - 0x34]
mov eax, edi
sub ecx, edi
and ecx, 0xfffffff0
cmp ecx, 0x1000
jb 0x47027d
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4703f2
push ecx
push edi
call fcn.0050d7d8
add esp, 8
jmp 0x4703d4
cmp eax, 3
jne 0x47038e
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 9
push eax
mov ecx, esi
call fcn.0046ec23
mov eax, dword [esi + 0x18]
xor ecx, ecx
sub eax, dword [esi + 0x10]
cdq
sub eax, edx
mov dword [ebp - 0x4c], 0
mov edx, dword [ebp - 0x3c]
sar eax, 1
add eax, dword [esi + 0x10]
cmovns ecx, eax
mov eax, dword [ebp - 0x38]
sub eax, edx
mov dword [ebp - 0x54], ecx
mov ecx, dword [esi + 0x1c]
sar eax, 4
sub eax, 1
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x50], eax
js 0x46fa82
shl eax, 4
lea edi, [edx + 0xc]
add edi, eax
mov dword [ebp - 0x2c], edi
nop
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push dword [edi]
call fcn.0046f6b3
mov edi, dword [edi - 8]
mov eax, edi
mov ecx, dword [ebp - 0x54]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
cmp dword [ebp - 0x24], 1
mov dword [ebp - 0x4c], ecx
lea eax, [ecx + edi]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov ecx, esi
jne 0x47034c
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
jmp 0x47036c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
sub eax, dword [edi - 4]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x4c]
push eax
push dword [edi]
call fcn.0046f563
mov eax, dword [esi + 0x3c]
add eax, dword [edi - 4]
sub dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x50]
sub edi, 0x10
dec eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x50], eax
test eax, eax
jns 0x470303
jmp 0x46fa7f
push ecx
push edx
call fcn.0050d7d8
add esp, 8
jmp 0x4703d4
cmp eax, 4
jne 0x4703c2
call fcn.00471ba3
jmp 0x4703d4
test eax, eax
jne 0x4703ab
cmp dword [esi + 0x28], 5
jne 0x4703cf
call fcn.00471e73
jmp 0x4703d4
cmp eax, 2
jne 0x4703bd
cmp dword [esi + 0x28], 5
jne 0x4703cf
call fcn.00472113
jmp 0x4703d4
cmp eax, 4
jne 0x4703cf
cmp dword [esi + 0x28], 5
jne 0x4703cf
call fcn.004723b3
jmp 0x4703d4
call fcn.00471533
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0050d7a4
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00511ebc
int3