Function at 0x46da08
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x53
push 0
push 0
dec ecx
jne 0x46da10
push ebx
push esi
push edi
mov dword [ebp - 0x17c], edx
mov esi, eax
lea eax, [ebp - 0x178]
mov edx, dword [0x407dc0]
call fcn.004059ec
xor eax, eax
push ebp
push 0x46e885
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x47e860]
mov eax, dword [eax]
call fcn.00457c24
cmp byte [0x482647], 1
je 0x46e849
mov byte [0x482647], 1
xor eax, eax
mov dword [ebp - 0x180], eax
mov byte [0x48263c], 0
lea eax, [ebp - 0xc]
imul edi, esi, 0xd4
mov edx, dword [0x47e5d8]
mov edx, dword [edx]
mov edx, dword [edx + edi*8 + 0x1564]
call fcn.00404fc0
mov eax, dword [ebp - 0xc]
mov edx, 0x46e89c
call fcn.00405338
jne 0x46db04
mov edx, dword [0x47e6dc]
mov edx, dword [edx]
lea eax, [ebp - 0x1c8]
mov ecx, 0x46e8a8
call fcn.00405238
mov eax, dword [ebp - 0x1c8]
lea ecx, [ebp - 0x178]
xor edx, edx
call fcn.0040952c
test eax, eax
jne 0x46daf8
push 0
push 0
mov edx, dword [0x47e6dc]
mov edx, dword [edx]
lea eax, [ebp - 0x1cc]
mov ecx, 0x46e8a8
call fcn.00405238
mov eax, dword [ebp - 0x1cc]
call fcn.004053ec
push eax
call sub.winmm.dll_PlaySoundA
mov byte [0x482647], 0
jmp 0x46e849
lea eax, [ebp - 0x1d0]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x1d0]
mov edx, 0x46e8c0
call fcn.00405338
jne 0x46dbaa
lea edx, [ebp - 0x1d4]
mov eax, dword [ebp - 0xc]
call fcn.0046ee00
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0xc]
call fcn.00404fc0
mov eax, dword [0x47e5d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x2b2f4]
mov ecx, dword [ebp - 0x180]
mov edx, esi
call fcn.0046ea58
mov eax, dword [0x47e76c]
mov eax, dword [eax]
push eax
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x1d8]
push eax
mov ecx, 0x7fffffff
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x1d8]
movzx ecx, word [0x46e8c4]
mov dl, 2
call fcn.00475fec
mov byte [0x482647], 0
jmp 0x46e6fd
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x46dbb6
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x1e0]
push eax
mov edx, ebx
sub edx, 3
mov ecx, 0x7fffffff
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x1e0]
lea edx, [ebp - 0x1dc]
call fcn.00408b28
mov eax, dword [ebp - 0x1dc]
mov edx, 0x46e8d0
call fcn.00405338
jne 0x46dc05
mov edx, dword [ebp - 0xc]
mov eax, 0x46e8e0
call fcn.00405530
dec eax
setl al
jmp 0x46dc07
xor eax, eax
test al, al
je 0x46dc62
mov edx, dword [ebp - 0xc]
mov eax, 0x46e8ec
call fcn.00405530
dec eax
jge 0x46dc62
mov eax, dword [0x47e5d8]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + edi*8 + 0x1574], edx
mov eax, dword [0x47e5d8]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + edi*8 + 0x1578], edx
xor eax, eax
mov dword [ebp - 0x180], eax
mov eax, dword [0x47e5d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x2b2f4]
mov ecx, dword [ebp - 0x180]
mov edx, esi
call fcn.0046ea58
jmp 0x46e7ce
mov eax, dword [0x47e5d8]
mov eax, dword [eax]
cmp dword [eax + edi*8 + 0x1588], 1
jne 0x46dc7b
xor eax, eax
mov dword [ebp - 0x180], eax
lea eax, [ebp - 0x1e8]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x1e8]
lea edx, [ebp - 0x1e4]
call fcn.00408b28
mov eax, dword [ebp - 0x1e4]
mov edx, 0x46e8f8
call fcn.00405338
je 0x46dd2f
lea eax, [ebp - 0x1f0]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x1f0]
lea edx, [ebp - 0x1ec]
call fcn.00408b28
mov eax, dword [ebp - 0x1ec]
mov edx, 0x46e908
call fcn.00405338
je 0x46dd2f
lea eax, [ebp - 0x1f8]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x1f8]
lea edx, [ebp - 0x1f4]
call fcn.00408b28
mov eax, dword [ebp - 0x1f4]
mov edx, 0x46e914
call fcn.00405338
jne 0x46dd37
xor eax, eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0xc], 0
jne 0x46dd66
mov dword [ebp - 0x180], 1
mov eax, dword [0x47e5d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x2b2f4]
mov ecx, dword [ebp - 0x180]
mov edx, esi
call fcn.0046ea58
jmp 0x46e6fd
lea eax, [ebp - 4]
push eax
mov eax, dword [0x47e6dc]
mov eax, dword [eax]
mov ecx, 2
mov edx, 1
call fcn.0040544c
lea eax, [ebp - 8]
imul edx, esi, 0xd4
mov ecx, dword [0x47e5d8]
mov ecx, dword [ecx]
mov edx, dword [ecx + edx*8 + 0x1560]
call fcn.00404fc0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
je 0x46ddc0
mov eax, dword [ebp - 0x188]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x188], eax
mov edi, dword [ebp - 0x188]
sub edi, 4
test edi, edi
jle 0x46de75
mov ebx, 1
lea eax, [ebp - 0x1fc]
push eax
mov ecx, 4
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0040544c
mov eax, dword [ebp - 0x1fc]
mov edx, 0x46e920
call fcn.00405338
jne 0x46de6d
lea eax, [ebp - 0x200]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040544c
push dword [ebp - 0x200]
lea eax, [ebp - 0x204]
push eax
mov eax, dword [0x47e6dc]
mov eax, dword [eax]
mov ecx, 1
mov edx, 1
call fcn.0040544c
push dword [ebp - 0x204]
lea eax, [ebp - 0x208]
push eax
lea edx, [ebx + 4]
mov ecx, 0x7fffffff
mov eax, dword [ebp - 8]
call fcn.0040544c
push dword [ebp - 0x208]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004052ac
jmp 0x46dd9d
inc ebx
dec edi
jne 0x46ddd6
lea eax, [ebp - 0x20c]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x20c]
mov edx, 0x46e930
call fcn.00405338
jne 0x46ded9
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x46deac
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x210]
push eax
mov ecx, ebx
dec ecx
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov ecx, dword [ebp - 0x210]
mov edx, dword [0x47e6dc]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
call fcn.00405238
xor ebx, ebx
lea eax, [ebp - 0x218]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.00408b28
mov eax, dword [ebp - 0x214]
mov edx, 0x46e8f8
call fcn.00405338
je 0x46dff1
lea eax, [ebp - 0x220]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.00408b28
mov eax, dword [ebp - 0x21c]
mov edx, 0x46e908
call fcn.00405338
je 0x46dff1
lea eax, [ebp - 0x228]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x224]
call fcn.00408b28
mov eax, dword [ebp - 0x224]
mov edx, 0x46e93c
call fcn.00405338
je 0x46dff1
lea eax, [ebp - 0x230]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x230]
lea edx, [ebp - 0x22c]
call fcn.00408b28
mov eax, dword [ebp - 0x22c]
mov edx, 0x46e914
call fcn.00405338
je 0x46dff1
lea edx, [ebp - 0x234]
lea eax, [ebp - 0xc]
call fcn.0046f3d0
mov edx, dword [ebp - 0x234]
lea eax, [ebp - 0xc]
call fcn.00404fc0
mov bl, 1
lea eax, [ebp - 0x238]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x238]
mov edx, 0x46e8ec
call fcn.00405338
jne 0x46e02a
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405238
cmp bl, 1
jne 0x46e0bf
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x46e03f
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x23c]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x23c]
mov edx, 0x46e8ec
call fcn.00405338
je 0x46e0b4
lea ecx, [ebp - 0x178]
mov edx, 0x4f
mov eax, dword [ebp - 0xc]
call fcn.0040952c
test eax, eax
je 0x46e0b4
mov eax, dword [0x47e5d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x2b2f4]
mov ecx, dword [ebp - 0x180]
mov edx, esi
call fcn.0046ea58
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 0xc]
call fcn.0046f4dc
mov edx, dword [ebp - 0x240]
lea eax, [ebp - 0xc]
call fcn.00404fc0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00409644
lea eax, [ebp - 0x248]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.00408b28
mov eax, dword [ebp - 0x244]
mov edx, 0x46e8f8
call fcn.00405338
je 0x46e173
lea eax, [ebp - 0x250]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x250]
lea edx, [ebp - 0x24c]
call fcn.00408b28
mov eax, dword [ebp - 0x24c]
mov edx, 0x46e908
call fcn.00405338
je 0x46e173
lea eax, [ebp - 0x258]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x258]
lea edx, [ebp - 0x254]
call fcn.00408b28
mov eax, dword [ebp - 0x254]
mov edx, 0x46e914
call fcn.00405338
jne 0x46e1ac
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00404fc0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0046eecc
cmp dword [ebp - 0xc], 0
je 0x46e199
lea eax, [ebp - 0x10]
call fcn.00404f28
jmp 0x46e1ac
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404fc0
lea eax, [ebp - 8]
call fcn.00404f28
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x46e1b8
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x260]
push eax
mov edx, ebx
sub edx, 2
mov ecx, 3
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x260]
lea edx, [ebp - 0x25c]
call fcn.00408b28
mov eax, dword [ebp - 0x25c]
mov edx, 0x46e94c
call fcn.00405338
jne 0x46e230
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00404fc0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0046f310
cmp dword [ebp - 0xc], 0
je 0x46e21d
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00409644
jmp 0x46e230
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404fc0
lea eax, [ebp - 8]
call fcn.00404f28
lea eax, [ebp - 0x268]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x268]
lea edx, [ebp - 0x264]
call fcn.00408b28
mov eax, dword [ebp - 0x264]
mov edx, 0x46e93c
call fcn.00405338
jne 0x46e270
mov al, 1
jmp 0x46e2b7
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x46e27c
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x270]
push eax
mov edx, ebx
dec edx
mov ecx, 0x7fffffff
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x270]
lea edx, [ebp - 0x26c]
call fcn.00408b28
mov eax, dword [ebp - 0x26c]
mov edx, 0x46e8ec
call fcn.00405338
sete al
test al, al
je 0x46e2d2
imul eax, esi, 0xd4
mov edx, dword [0x47e5d8]
mov edx, dword [edx]
xor ecx, ecx
mov dword [edx + eax*8 + 0x1578], ecx
cmp dword [ebp - 8], 0
je 0x46e3a6
lea eax, [ebp - 0x274]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x274]
mov edx, 0x46e958
call fcn.00405338
je 0x46e3a6
lea eax, [ebp - 0x278]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040544c
mov eax, dword [ebp - 0x278]
mov edx, 0x46e8ec
call fcn.00405338
je 0x46e3a6
lea eax, [ebp - 0x27c]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040544c
mov eax, dword [ebp - 0x27c]
mov edx, 0x46e8e0
call fcn.00405338
je 0x46e3a6
lea eax, [ebp - 0x280]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040544c
mov eax, dword [ebp - 0x280]
mov edx, 0x46e964
call fcn.00405338
je 0x46e3a6
push 0x46e958
push dword [ebp - 8]
push 0x46e958
lea eax, [ebp - 8]
mov edx, 3
call fcn.004052ac
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x46e3b2
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x284]
push eax
mov edx, ebx
dec edx
mov ecx, 0x7fffffff
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x284]
mov edx, 0x46e8ec
call fcn.00405338
jne 0x46e3ea
lea eax, [ebp - 0x18]
mov edx, 0x46e970
call fcn.00404fc0
jmp 0x46e3f7
lea eax, [ebp - 0x18]
mov edx, 0x46e980
call fcn.00404fc0
imul eax, esi, 0xd4
mov edx, dword [0x47e5d8]
mov edx, dword [edx]
mov ecx, dword [edx + eax*8 + 0x1584]
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
dec eax
jne 0x46e420
mov dword [ebp - 0x184], 3
mov eax, dword [0x47e5d8]
test ecx, ecx
jne 0x46e433
mov dword [ebp - 0x184], 1
lea eax, [ebp - 0x1c4]
xor ecx, ecx
mov edx, 0x3c
call fcn.004036d8
mov dword [ebp - 0x1c4], 0x3c
mov dword [ebp - 0x1c0], 0x440
mov eax, dword [ebp - 0x17c]
call fcn.00442f9c
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x18]
call fcn.004053ec
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0xc]
call fcn.004053ec
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 8]
call fcn.004053ec
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x10]
call fcn.004053ec
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x1a8], eax
lea eax, [ebp - 0x1c4]
push eax
call sub.shell32.dll_ShellExecuteExA
mov edi, eax
cmp edi, 1
sbb ebx, ebx
inc ebx
cmp bl, 1
mov eax, dword [0x47e860]
mov eax, dword [eax]
call fcn.00457c24
mov eax, dword [0x47e5d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x2b2f4]
mov ecx, dword [ebp - 0x180]
mov edx, esi
call fcn.0046ea58
test bl, bl
jne 0x46e6c3
mov eax, dword [ebp - 0x1a4]
sub eax, 2
je 0x46e50c
sub eax, 0x1d
je 0x46e589
jmp 0x46e6c3
cmp byte [0x482645], 1
jne 0x46e570
mov eax, dword [0x47e76c]
mov eax, dword [eax]
push eax
push 0xffffffffffffffff
push 0
mov eax, dword [0x47e76c]
push dword [eax]
push 0x46e990
push 0x46e9bc
push 0x46e9bc
imul eax, esi, 0xd4
mov edx, dword [0x47e5d8]
mov edx, dword [edx]
push dword [edx + eax*8 + 0x1564]
lea eax, [ebp - 0x288]
mov edx, 5
call fcn.004052ac
mov eax, dword [ebp - 0x288]
movzx ecx, word [0x46e8c4]
mov dl, 2
call fcn.00475fec
mov dl, 1
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov byte [0x482647], 0
jmp 0x46e849
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46e595
sub eax, 4
mov eax, dword [eax]
lea ebx, [eax + 1]
cmp ebx, 1
jle 0x46e5cb
dec ebx
lea eax, [ebp - 0x28c]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 0x28c]
mov edx, 0x46e9c8
call fcn.00405338
je 0x46e5cb
cmp ebx, 1
jg 0x46e59d
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x46e5d7
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x290]
push eax
lea edx, [ebx + 1]
mov ecx, edi
mov eax, dword [ebp - 0xc]
call fcn.0040544c
push dword [ebp - 0x290]
push 0x46e9c8
push 0x46e9d4
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004052ac
lea eax, [ebp - 0x14]
call fcn.00474ea4
cmp al, 1
jne 0x46e669
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.00404fc0
xor edx, edx
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [0x47e5d8]
mov eax, dword [eax]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [0x47e5d8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
call fcn.00478e8c
mov eax, dword [0x47e860]
mov eax, dword [eax]
call fcn.00457c24
mov eax, dword [ebp - 0x14]
call fcn.0046ec8c
mov byte [0x482647], 0
jmp 0x46e849
cmp byte [0x482646], 1
jne 0x46e6b7
mov eax, dword [0x47e76c]
mov eax, dword [eax]
push eax
push 0xffffffffffffffff
push 0
imul eax, esi, 0xd4
mov edx, dword [0x47e5d8]
mov edx, dword [edx]
mov ecx, dword [edx + eax*8 + 0x1564]
lea eax, [ebp - 0x294]
mov edx, 0x46e9e0
call fcn.00405238
mov eax, dword [ebp - 0x294]
movzx ecx, word [0x46e8c4]
xor edx, edx
call fcn.00475fec
mov byte [0x482647], 0
jmp 0x46e849
imul eax, esi, 0xd4
mov edx, dword [0x47e5d8]
mov edx, dword [edx]
cmp dword [edx + eax*8 + 0x1578], 0xffffffff
jne 0x46e6fd
mov eax, dword [ebp - 0x18c]
mov dword [0x482634], eax
mov eax, dword [0x47e5d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x360]
mov edx, 0x12c
call fcn.0042c9e4
mov eax, dword [0x47e860]
mov eax, dword [eax]
call fcn.00457c24
imul eax, esi, 0xd4
mov edx, dword [0x47e5d8]
mov edx, dword [edx]
cmp dword [edx + eax*8 + 0x1588], 0
je 0x46e79b
cmp dword [ebp - 0xc], 0
jne 0x46e741
mov eax, dword [0x47e5d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x2b2f4]
mov ecx, dword [ebp - 0x180]
mov edx, esi
call fcn.0046ea58
xor edx, edx
mov eax, dword [ebp - 0x17c]
call fcn.0044ff5c
mov eax, dword [0x47e5d8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x17c]
call fcn.004776ec
mov eax, dword [0x47e860]
mov eax, dword [eax]
call fcn.00457c24
mov byte [0x482647], 0
mov eax, dword [0x47e5d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x37c]
mov edx, 0xc8
call fcn.0042c9e4
mov eax, dword [0x47e860]
mov eax, dword [eax]
call fcn.00457ebc
jmp 0x46e849
mov edx, dword [0x47e5d8]
mov edx, dword [edx]
cmp dword [edx + eax*8 + 0x1574], 0
je 0x46e7b9
mov eax, dword [0x47e860]
mov eax, dword [eax]
call fcn.00457560
mov eax, dword [0x47e860]
mov eax, dword [eax]
call fcn.00457c24
mov byte [0x482647], 0
jmp 0x46e849
lea eax, [ebp - 0xc]
call fcn.00474ea4
test al, al
jne 0x46e816
mov eax, dword [0x47e76c]
mov eax, dword [eax]
push eax
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x298]
mov ecx, dword [ebp - 0xc]
mov edx, 0x46ea3c
call fcn.00405238
mov eax, dword [ebp - 0x298]
movzx ecx, word [0x46e8c4]
xor edx, edx
call fcn.00475fec
mov byte [0x482647], 0
jmp 0x46e849
mov eax, dword [0x47e5d8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
call fcn.00478e8c
mov byte [0x482647], 0
mov eax, dword [0x47e860]
mov eax, dword [eax]
call fcn.00457c24
mov eax, dword [ebp - 0xc]
call fcn.0046ec8c
jmp 0x46e849
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e88c
lea eax, [ebp - 0x298]
mov edx, 0x35
call fcn.00404f4c
lea eax, [ebp - 0x178]
mov edx, dword [0x407dc0]
call fcn.00405abc
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404f4c
ret