Function at 0x46d523
Capabilities:
Create process on windows
Create thread
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c53d7
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x67c3c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x288], edi
mov eax, dword [edi + 0x48]
mov dword [ebp - 0x2ac], eax
test eax, eax
je 0x46e259
lea ecx, [eax + 0x5c]
mov dword [ebp - 0x228], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x2a4], eax
or eax, 0xffffffff
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x2a0], eax
imul eax, dword [0x66b030], 0xe2c
push 0
mov dword [ebp - 0x2b8], ecx
mov dword [ebp - 0x224], 0x41200000
mov dword [ebp - 0x220], 0x41700000
push dword [eax + 0x66ba30]
call fcn.0043c8d0
call fcn.0040ea60
fmul dword [0x5d6c5c]
lea eax, [ebp - 0x29c]
push 0
push 1
push eax
push str.__game_version
fstp dword [ebp - 0x290]
movss xmm0, dword [ebp - 0x290]
mov dword [ebp - 0x29c], 0
movss dword [ebp - 0x298], xmm0
call fcn.00409580
add esp, 0x18
cmp byte [edi + 0x4c], 0
je 0x46d485
push ecx
mov byte [edi + 0x4c], 0
mov dword [esp], 0
call fcn.004192d0
mov dword [esp], 0
call fcn.00419300
add esp, 4
push 0
push 0
push 1
push 0
push 3
call fcn.00426cb0
add esp, 0x14
xor esi, esi
nop dword [eax]
call fcn.0040dfe0
fmul dword [ebp + esi*4 - 0x228]
push ecx
fstp dword [esp]
push esi
call fcn.00427580
inc esi
add esp, 8
cmp esi, 3
jl 0x46d4a0
call fcn.00439230
mov eax, dword [edi + 0x48]
mov dword [ebp - 0x294], 0
mov esi, dword [eax + 0x5c]
mov eax, dword [eax + 0x60]
mov dword [ebp - 0x290], esi
mov dword [ebp - 0x298], eax
cmp esi, eax
je 0x46d70c
add esi, 0x2c
nop
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x23c], 0
push str.__version_
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x238], 0
movups xmmword [ebp - 0x24c], xmm0
call fcn.004427c0
cmp dword [esi], 0xf
lea eax, [esi - 0x14]
mov dword [ebp - 4], 0
jbe 0x46d531
mov eax, dword [eax]
push dword [esi - 4]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0045d0c0
mov ecx, dword [ebp - 0x2ac]
lea edx, [ebp - 0x224]
mov eax, dword [ebp - 0x294]
push 1
push 0
cmp dword [ecx + 0x68], eax
lea ecx, [ebp - 0x24c]
push edx
sete al
mov dword [ebp - 0x224], 0
cmp dword [ebp - 0x238], 0xf
push 2
cmova ecx, dword [ebp - 0x24c]
push eax
push ecx
mov dword [ebp - 0x220], 0
call fcn.00438bc0
add esp, 0x18
test al, al
je 0x46d5a4
mov ecx, dword [ebp - 0x2ac]
mov eax, dword [ebp - 0x294]
mov dword [ecx + 0x68], eax
push 0
call fcn.0040a400
add esp, 4
test al, al
je 0x46d5d8
mov eax, dword [ebp - 0x294]
push 0
push 4
push 0x66aa80
push str.___dnd_gameinst
mov dword [0x66aa80], eax
call fcn.00418ba0
add esp, 0x10
call fcn.0040cae0
call fcn.0040a650
test al, al
je 0x46d60f
push 0
push str.___dnd_gameinst
call fcn.00406eb0
add esp, 8
test eax, eax
je 0x46d60a
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x2a0], eax
call fcn.0040cb10
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.004181d0
mov eax, dword [ebp - 0x290]
add esp, 8
cmp dword [esi - 0x18], 0xf
mov ecx, eax
jbe 0x46d639
mov ecx, dword [eax]
push ecx
call fcn.00480d10
call fcn.004271d0
mov eax, dword [esi + 4]
imul ecx, dword [0x66b030], 0x38b
mov eax, dword [eax*4 + 0x5dfc10]
add eax, ecx
push dword [eax*4 + 0x66b118]
call fcn.00480d10
add esp, 8
call fcn.004271d0
cmp dword [esi], 0xf
lea eax, [esi - 0x14]
jbe 0x46d679
mov eax, dword [esi - 0x14]
push eax
call fcn.00480d10
add esp, 4
call fcn.004271d0
call fcn.00439230
inc dword [ebp - 0x294]
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x46d6d3
mov edx, dword [ebp - 0x24c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46d6c9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e274
push ecx
push edx
call fcn.0059a744
add esp, 8
mov eax, dword [ebp - 0x290]
add esi, 0x38
add eax, 0x38
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0xf
mov byte [ebp - 0x24c], 0
mov dword [ebp - 0x290], eax
cmp eax, dword [ebp - 0x298]
jne 0x46d4f0
push 0
push 0
push 1
push 0
push 1
call fcn.00426cb0
call fcn.0040c8b0
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov eax, dword [ecx + 0x68]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [ebp - 0x2b8]
mov eax, dword [eax]
lea esi, [eax + ecx*8]
imul eax, dword [0x66b030], 0xe2c
mov dword [ebp - 0x294], esi
mov ecx, dword [eax + 0x66ba20]
mov dword [ebp - 0x298], ecx
lea ecx, [ebp - 0x224]
push ecx
push dword [eax + 0x66ba1c]
call fcn.00431560
add esp, 0x1c
test al, al
je 0x46d7b2
push 0
push dword [ebp - 0x298]
call fcn.00414fa0
add esp, 8
mov eax, esi
cmp dword [esi + 0x14], 0xf
jbe 0x46d7a0
mov eax, dword [esi]
push eax
lea eax, [edi + 0x4d]
push 0x100
push eax
call fcn.005ade98
add esp, 0xc
imul eax, dword [0x66b030], 0xe2c
mov dword [ebp - 0x298], 0
push dword [ebp - 0x298]
mov dword [ebp - 0x29c], 0
push dword [ebp - 0x29c]
push dword [eax + 0x66ba20]
call fcn.004634d0
add esp, 0xc
test al, al
je 0x46d863
push 0
push 0
push 0
lea eax, [edi + 0x4d]
push 0x100
push eax
push str.___rename_input
call fcn.004349a0
imul eax, dword [0x66b030], 0xe2c
add esp, 0x14
mov dword [esp], 0xbf800000
push dword [eax + 0x66b958]
push dword [eax + 0x66bae4]
call fcn.00480c40
add esp, 0xc
test al, al
je 0x46d85e
lea edx, [edi + 0x4d]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x298], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d841
sub ecx, dword [ebp - 0x298]
push ecx
push edx
mov ecx, esi
call fcn.00469160
mov ecx, edi
call fcn.00476440
call fcn.0040d000
sub esp, 8
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.004181d0
imul eax, dword [0x66b030], 0xe2c
add esp, 8
push dword [eax + 0x66bae0]
push dword [eax + 0x66bc90]
push ecx
mov dword [esp], 0x40c00000
push dword [eax + 0x66b9e0]
push dword [eax + 0x66b9e4]
push dword [eax + 0x66b9dc]
call fcn.00480a30
add esp, 0x18
test al, al
je 0x46d928
mov esi, dword [ebp - 0x2ac]
mov eax, dword [esi + 0x68]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x5c]
lea eax, [eax + ecx*8]
push eax
lea eax, [ebp - 0x298]
push eax
lea ecx, [esi + 0x5c]
call fcn.00477ec0
mov esi, dword [esi + 0x68]
test esi, esi
jle 0x46d91b
mov edi, dword [ebp - 0x2ac]
nop
mov ecx, dword [edi + 0x60]
mov eax, 0x92492493
sub ecx, dword [edi + 0x5c]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jl 0x46d915
dec esi
mov dword [edi + 0x68], esi
test esi, esi
jg 0x46d8f0
mov edi, dword [ebp - 0x288]
mov ecx, edi
call fcn.00476440
mov esi, dword [ebp - 0x294]
sub esp, 8
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.004181d0
imul eax, dword [0x66b030], 0xe2c
lea ecx, [ebp - 0x224]
push ecx
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
push dword [eax + 0x66ba18]
call fcn.00431560
add esp, 0x10
test al, al
je 0x46daaf
add esi, 0x18
lea eax, [ebp - 0x234]
push esi
push eax
mov dword [ebp - 0x290], esi
call fcn.00543910
add esp, 8
cmp dword [esi + 0x14], 0xf
mov ecx, dword [esi + 0x10]
mov dword [ebp - 4], 1
jbe 0x46d9ab
mov esi, dword [esi]
mov dword [ebp - 0x290], esi
cmp dword [ebp - 0x220], 0xf
lea eax, [ebp - 0x234]
mov esi, dword [ebp - 0x234]
push ecx
push dword [ebp - 0x290]
cmova eax, esi
push dword [ebp - 0x224]
push eax
call fcn.0046ad10
add esp, 0x10
test al, al
jne 0x46da72
cmp dword [ebp - 0x220], 0xf
lea eax, [ebp - 0x234]
push 0xfde9
cmova eax, esi
push eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.00544480
add esp, 0xc
lea eax, [ebp - 0x2d0]
cmp dword [ebp - 0x2bc], 7
cmova eax, dword [ebp - 0x2d0]
push 5
push 0
push 0
push eax
push str.explore
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x2bc]
cmp ecx, 7
jbe 0x46da6c
mov edx, dword [ebp - 0x2d0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x46da62
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e274
push ecx
push edx
call fcn.0059a744
add esp, 8
mov esi, dword [ebp - 0x234]
mov eax, dword [ebp - 0x220]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xf
jbe 0x46daaf
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x46daa5
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e279
push ecx
push esi
call fcn.0059a744
add esp, 8
sub esp, 8
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.004181d0
mov eax, dword [edi + 0x48]
add esp, 8
cmp dword [eax + 0x14], 0
je 0x46dd01
imul eax, dword [0x66b030], 0xe2c
lea ecx, [ebp - 0x224]
push ecx
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
push dword [eax + 0x66ba14]
call fcn.00431560
add esp, 8
test al, al
je 0x46dd01
xorps xmm0, xmm0
mov dword [ebp - 0x224], 0
xor eax, eax
mov dword [ebp - 0x220], 7
movups xmmword [ebp - 0x234], xmm0
mov word [ebp - 0x234], ax
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 2
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46db60
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.00469260
push str.ShanghaiAlice_
lea ecx, [ebp - 0x234]
call fcn.004690f0
mov eax, dword [edi + 0x48]
push 0xfde9
push dword [eax]
lea eax, [ebp - 0x2d0]
push eax
call fcn.00544480
add esp, 0xc
cmp dword [ebp - 0x2bc], 7
lea ecx, [ebp - 0x2d0]
mov esi, dword [ebp - 0x224]
cmova ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x220]
mov edx, dword [ebp - 0x2c0]
sub eax, esi
mov byte [ebp - 4], 3
mov dword [ebp - 0x298], edx
mov dword [ebp - 0x288], ecx
mov dword [ebp - 0x290], esi
cmp edx, eax
ja 0x46dc3a
cmp dword [ebp - 0x220], 7
lea eax, [esi + edx]
mov dword [ebp - 0x224], eax
lea esi, [ebp - 0x234]
cmova esi, dword [ebp - 0x234]
mov eax, dword [ebp - 0x290]
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x288]
push ecx
call fcn.0059ce90
mov eax, dword [ebp - 0x298]
add esp, 0xc
add eax, dword [ebp - 0x290]
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x46dc4e
push edx
push ecx
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0x234]
push edx
call fcn.00442b50
mov ecx, dword [ebp - 0x2bc]
mov byte [ebp - 4], 2
cmp ecx, 7
jbe 0x46dc92
mov edx, dword [ebp - 0x2d0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x46dc88
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e27e
push ecx
push edx
call fcn.0059a744
add esp, 8
cmp dword [ebp - 0x220], 7
lea eax, [ebp - 0x234]
push 5
cmova eax, dword [ebp - 0x234]
push 0
push 0
push eax
push str.explore
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 7
jbe 0x46dd01
mov edx, dword [ebp - 0x234]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x46dcf7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e283
push ecx
push edx
call fcn.0059a744
add esp, 8
sub esp, 8
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.004181d0
mov eax, dword [edi + 0x48]
add esp, 8
mov eax, dword [eax + 0xc]
test eax, eax
je 0x46dd2e
cmp eax, 1
jne 0x46dde3
imul eax, dword [0x66b030], 0xe2c
lea ecx, [ebp - 0x224]
push ecx
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
push dword [eax + 0x66b9fc]
call fcn.00431560
mov esi, dword [ebp - 0x294]
add esp, 8
test al, al
je 0x46dd86
mov eax, dword [edi + 0x48]
mov ecx, edi
push dword [eax]
push esi
call fcn.00470e00
test al, al
jne 0x46dd86
mov dword [edi + 0x150], 0x40000000
movss xmm0, dword [edi + 0x150]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x46dde9
call fcn.0040e260
movss xmm0, dword [edi + 0x150]
sub esp, 8
subss xmm0, dword [eax + 0x10]
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
movss dword [edi + 0x150], xmm0
call fcn.004181d0
imul eax, dword [0x66b030], 0xe2c
push 0
push dword [eax + 0x66ba00]
call fcn.0043c8d0
add esp, 0x10
jmp 0x46dde9
mov esi, dword [ebp - 0x294]
call fcn.00437ac0
mov eax, dword [ebp - 0x2a4]
test eax, eax
je 0x46de01
cmp eax, 1
jne case.0x46de15.4
mov eax, dword [esi + 0x30]
dec eax
cmp eax, 9
ja case.0x46de15.4
movzx eax, byte [eax + 0x46e298]
jmp dword [eax*4 + 0x46e288]
mov eax, dword [edi + 0x48]
cmp dword [eax + 0x10], 0
je case.0x46de15.3
lea eax, [esi + 0x34]
push eax
imul eax, dword [0x66b030], 0xe2c
push dword [eax + 0x66ba3c]
call fcn.00431e50
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.004181d0
add esp, 8
imul eax, dword [0x66b030], 0xe2c
mov ecx, dword [eax + 0x66b9d0]
lea eax, [esi + 0x35]
push eax
push ecx
call fcn.00431e50
add esp, 8
test al, al
je case.0x46de15.4
mov ecx, edi
call fcn.00476440
jmp case.0x46de15.4
mov eax, dword [edi + 0x48]
cmp dword [eax + 0x10], 0
je 0x46debf
lea eax, [esi + 0x34]
push eax
imul eax, dword [0x66b030], 0xe2c
push dword [eax + 0x66ba3c]
call fcn.00431e50
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.004181d0
add esp, 8
imul eax, dword [0x66b030], 0xe2c
add esi, 0x35
push esi
push dword [eax + 0x66b9ec]
call fcn.00431e50
add esp, 8
test al, al
je 0x46df0a
cmp byte [esi], 0
je 0x46df03
mov byte [esi], 0
imul eax, dword [0x66b030], 0xe2c
push 0
push dword [eax + 0x66b9f4]
call fcn.00414fa0
add esp, 8
jmp 0x46df0a
mov ecx, edi
call fcn.00476440
imul eax, dword [0x66b030], 0xe2c
mov dword [ebp - 0x2a4], 0
push dword [ebp - 0x2a4]
mov dword [ebp - 0x2a8], 0
push dword [ebp - 0x2a8]
push dword [eax + 0x66b9f4]
call fcn.004634d0
add esp, 0xc
test al, al
je case.0x46de15.4
call fcn.0040e260
push ecx
movss xmm0, dword [eax + 8]
mulss xmm0, dword [0x5cfc7c]
movss dword [esp], xmm0
call fcn.004159d0
imul eax, dword [0x66b030], 0xe2c
push dword [eax + 0x66b9f0]
push 0x5cbf50
call fcn.0043c950
call fcn.004153c0
imul eax, dword [0x66b030], 0xe2c
add esp, 8
mov dword [esp], 0xbf800000
push dword [eax + 0x66bae0]
push dword [eax + 0x66bc90]
call fcn.00480c40
add esp, 0xc
test al, al
je 0x46dfb8
mov ecx, edi
mov byte [esi], 1
call fcn.00476440
call fcn.0040d000
mov eax, dword [edi + 0x48]
lea ecx, [ebp - 0x219]
mov esi, dword [ebp - 0x2ac]
push ecx
mov eax, dword [eax + 0x6c]
cmp eax, dword [esi + 0x68]
sete byte [ebp - 0x219]
imul eax, dword [0x66b030], 0xe2c
push dword [eax + 0x66b9d4]
call fcn.00431e50
add esp, 8
test al, al
je 0x46e014
cmp byte [ebp - 0x219], 0
mov eax, dword [edi + 0x48]
je 0x46e007
mov ecx, dword [esi + 0x68]
jmp 0x46e00a
or ecx, 0xffffffff
mov dword [eax + 0x6c], ecx
mov ecx, edi
call fcn.00476440
sub esp, 8
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.004181d0
imul eax, dword [0x66b030], 0xe2c
push dword [eax + 0x66b9d8]
call fcn.0044a790
mov ecx, dword [ebp - 0x2b4]
add esp, 0xc
cmp ecx, 0xffffffff
je 0x46e17d
cmp dword [ebp - 0x2a0], 0xffffffff
je 0x46e17d
mov esi, dword [esi + 0x5c]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [ebp - 0x284]
shl eax, 3
add esi, eax
mov dword [ebp - 0x290], eax
push esi
call fcn.00460620
lea eax, [esi + 0x18]
mov dword [ebp - 4], 4
push eax
lea ecx, [ebp - 0x26c]
call fcn.00460620
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x254], eax
mov al, byte [esi + 0x34]
mov byte [ebp - 0x250], al
mov al, byte [esi + 0x35]
mov byte [ebp - 0x24f], al
mov esi, dword [ebp - 0x2a0]
mov dword [ebp - 4], 5
cmp esi, dword [ebp - 0x2b4]
jle 0x46e0ff
lea eax, [ebp - 0x284]
push eax
lea eax, [esi + 1]
mov esi, dword [ebp - 0x2b8]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi]
lea eax, [eax + ecx*8]
mov ecx, esi
push eax
lea eax, [ebp - 0x2a4]
push eax
call fcn.00477fb0
mov eax, dword [esi]
add eax, dword [ebp - 0x290]
jmp 0x46e138
jge 0x46e14d
lea ecx, [esi*8]
sub ecx, esi
lea eax, [ebp - 0x284]
mov esi, dword [ebp - 0x2b8]
push eax
mov eax, dword [esi]
lea eax, [eax + ecx*8]
mov ecx, esi
push eax
lea eax, [ebp - 0x2a4]
push eax
call fcn.00477fb0
mov ecx, dword [ebp - 0x290]
mov eax, dword [esi]
add ecx, 0x38
add eax, ecx
push eax
lea eax, [ebp - 0x2a4]
mov ecx, esi
push eax
call fcn.00477ec0
mov esi, dword [ebp - 0x2a0]
mov edx, dword [edi + 0x48]
mov ecx, dword [ebp - 0x2ac]
mov eax, dword [edx + 0x6c]
cmp eax, dword [ecx + 0x68]
jne 0x46e161
mov dword [edx + 0x6c], esi
mov dword [ecx + 0x68], esi
mov ecx, edi
call fcn.00476440
lea ecx, [ebp - 0x284]
mov dword [ebp - 4], 0xffffffff
call fcn.0046bd40
imul eax, dword [0x66b030], 0xe2c
mov esi, dword [eax + 0x66ba08]
lea eax, [ebp - 0x28c]
push eax
call fcn.0040ea90
movss xmm0, dword [ebp - 0x28c]
subss xmm0, xmm0
mulss xmm0, dword [0x5cbfc4]
movss dword [esp], xmm0
call fcn.00418b00
movss xmm0, dword [ebp - 0x288]
mulss xmm0, dword [0x5d6c60]
movss dword [esp], xmm0
call fcn.00418b50
movss xmm0, dword [ebp - 0x28c]
lea eax, [ebp - 0x2b0]
movss dword [ebp - 0x2b0], xmm0
movss xmm0, dword [ebp - 0x288]
mulss xmm0, dword [0x5cbfac]
push eax
push esi
movss dword [ebp - 0x2ac], xmm0
call fcn.00431560
add esp, 0xc
test al, al
je 0x46e252
push 0
push str.Launch___launch_t
call fcn.00414fa0
add esp, 8
mov byte [edi + 0x160], 0
cmp dword [edi + 0x154], 0xffffffff
jne 0x46e248
push 0
push 0
push 0
push dword [edi + 0x158]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x154], eax
mov dword [edi + 0x15c], 0x3f000000
mov ecx, edi
call fcn.0046cab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059a5ad
mov esp, ebp
pop ebp
ret
call fcn.005ad975
call fcn.005ad975
call fcn.005ad975
call fcn.005ad975
sbb al, 0xde
inc esi
add byte [esi + 0x550046de], al
fiadd word [esi]
mov ebp, 0x46df
add dword [edx], eax
add eax, dword [ecx]
add dword [edx], eax
add al, byte [ebx]
add esp, ecx
int3