Function at 0x46d2d4
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x65
push 0
push 0
dec ecx
jne 0x46d2dc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46e298
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov dl, 1
mov eax, dword [0x40eddc]
call fcn.004030fc
mov dword [0x9a9168], eax
mov eax, dword [0x9a750b]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
shl edx, 5
lea edx, [edx*8 + 0x9a7e37]
call fcn.00403f70
mov edx, dword [ebp - 0x30]
mov eax, 0x46e2b0
call fcn.004042b4
mov dword [ebp - 0x34], eax
call fcn.00454fd4
test al, al
jne 0x46e25a
mov edx, dword [ebp - 0x30]
mov eax, 0x46e2c0
call fcn.004042b4
mov dword [0x9a9148], eax
xor eax, eax
push ebp
push 0x46d39d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x30]
call fcn.00404190
push eax
push 0x46e2c8
call sub.kernel32.dll_SetEnvironmentVariableA
push 0x46e2d0
push 0x46e2d8
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46d3a7
lea eax, [ebp - 0x40]
mov edx, 0x9a6bce
call fcn.00403f70
xor eax, eax
push ebp
push 0x46d3e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x9a913c]
call fcn.00404190
push eax
push 0x46e2e4
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46d3eb
lea eax, [ebp - 0x38]
mov edx, 0x9a8d6c
call fcn.00403f70
xor eax, eax
push ebp
push 0x46d46c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x38], 0
je 0x46d41f
mov eax, dword [ebp - 0x38]
call fcn.00404190
push eax
push 0x46e2ec
call sub.kernel32.dll_SetEnvironmentVariableA
cmp dword [ebp - 0x38], 0
je 0x46d438
mov eax, dword [ebp - 0x38]
call fcn.00404190
push eax
push 0x46e2f8
call sub.kernel32.dll_SetEnvironmentVariableA
cmp dword [ebp - 0x38], 0
jne 0x46d44d
push 0x46e304
push 0x46e2ec
call sub.kernel32.dll_SetEnvironmentVariableA
cmp dword [ebp - 0x38], 0
jne 0x46d462
push 0x46e304
push 0x46e2f8
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46d476
cmp dword [ebp - 0x38], 0
je 0x46d49c
lea edx, [ebp - 0x210]
mov eax, 0x46e31c
call fcn.00455090
mov edx, dword [ebp - 0x210]
mov eax, dword [0x47ccb4]
call fcn.00403da4
cmp dword [ebp - 0x38], 0
jne 0x46d4b1
mov eax, dword [0x47ccb4]
mov edx, 0x46e330
call fcn.00403da4
mov eax, dword [ebp - 8]
mov eax, dword [eax*4 + 0x9a6ab0]
test eax, eax
je 0x46d4c5
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax*4 + 0x9a6ad8]
test eax, eax
je 0x46d4d9
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
imul edx, dword [ebp - 8], 0xd
add edx, 0x9a6d54
call fcn.00403f70
cmp byte [0x9a8e6c], 1
jne 0x46d4fb
mov byte [0x9a90df], 1
xor eax, eax
push ebp
push 0x46d53f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00409ae4
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0046d244
mov ebx, eax
mov eax, dword [ebp - 0x18]
call fcn.0040ae8c
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0046d244
sub ebx, eax
mov dword [ebp - 0x14], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46d549
mov eax, dword [ebp - 0x18]
mov edx, 0x46e348
call fcn.004040dc
jne 0x46d55d
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov edx, 0x46e348
call fcn.004040dc
jne 0x46d969
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x220]
mov eax, dword [0x47cec0]
mov eax, dword [eax]
call fcn.00453b9c
lea ecx, [ebp - 0x220]
mov edx, 0x46e35c
mov eax, 0x46e36c
call fcn.0046bbb0
mov edx, dword [ebp - 0x1c]
mov eax, 0x46e380
call fcn.004042b4
lea edx, [ebp - 0x1c]
mov ecx, eax
mov eax, 1
xchg edx, eax
call fcn.00404210
xor eax, eax
push ebp
push 0x46d690
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x47cef4]
cmp dword [eax], 2
jne 0x46d619
mov eax, dword [0x47ce9c]
push dword [eax]
push 0x46e38c
lea edx, [ebp - 0x224]
mov eax, 0x46e398
call fcn.00455090
push dword [ebp - 0x224]
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.0040408c
mov ecx, dword [ebp - 0x210]
mov dl, 1
mov eax, dword [0x453db4]
call fcn.00453e5c
mov dword [0x9a90d0], eax
mov eax, dword [0x47cef4]
cmp dword [eax], 2
je 0x46d64a
lea edx, [ebp - 0x210]
mov eax, 0x46e398
call fcn.00455090
mov ecx, dword [ebp - 0x210]
mov dl, 1
mov eax, dword [0x453db4]
call fcn.00453e5c
mov dword [0x9a90d0], eax
call fcn.00409ab8
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x210]
call fcn.0040a6a0
mov eax, dword [ebp - 0x210]
push eax
mov ecx, 0x46e3ac
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x9a90d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov dl, 1
mov eax, dword [0x9a90d0]
mov ecx, dword [eax]
call dword [ecx - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46d69a
mov eax, dword [0x47ce9c]
push dword [eax]
push 0x46e38c
push dword [ebp - 0x1c]
push 0x46e3c0
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.0040408c
mov eax, dword [ebp - 0x24]
call fcn.004087dc
test al, al
je 0x46d6d3
mov byte [0x9a90f4], 1
jmp 0x46e25a
xor eax, eax
push ebp
push 0x46d792
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x47cef4]
cmp dword [eax], 2
jne 0x46d734
mov eax, dword [0x47ce9c]
push dword [eax]
push 0x46e38c
lea edx, [ebp - 0x224]
mov eax, 0x46e398
call fcn.00455090
push dword [ebp - 0x224]
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.0040408c
mov ecx, dword [ebp - 0x210]
mov dl, 1
mov eax, dword [0x453db4]
call fcn.00453e5c
mov dword [0x9a90d0], eax
mov eax, dword [0x47cef4]
cmp dword [eax], 2
je 0x46d765
lea edx, [ebp - 0x210]
mov eax, 0x46e398
call fcn.00455090
mov ecx, dword [ebp - 0x210]
mov dl, 1
mov eax, dword [0x453db4]
call fcn.00453e5c
mov dword [0x9a90d0], eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x46e3d0
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x9a90d0]
mov ebx, dword [eax]
call dword [ebx]
mov dl, 1
mov eax, dword [0x9a90d0]
mov ecx, dword [eax]
call dword [ecx - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46d79c
lea edx, [ebp - 0x210]
mov eax, 0x46e3e8
call fcn.00455090
mov edx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x20]
call fcn.004040dc
jne 0x46d7c8
mov byte [0x9a90f4], 1
jmp 0x46e25a
mov eax, dword [0x47ce9c]
push dword [eax]
push 0x46e38c
push dword [ebp - 0x1c]
push 0x46e3c0
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.0040408c
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20c]
call fcn.00405a56
lea eax, [ebp - 0x20c]
call fcn.00405c3e
mov edx, 0x46e3f8
lea eax, [ebp - 0x20c]
call fcn.00404360
call fcn.00405e4f
lea eax, [ebp - 0x20c]
call fcn.00405bc0
xor eax, eax
push ebp
push 0x46d8e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x47cef4]
cmp dword [eax], 2
jne 0x46d883
mov eax, dword [0x47ce9c]
push dword [eax]
push 0x46e38c
lea edx, [ebp - 0x224]
mov eax, 0x46e398
call fcn.00455090
push dword [ebp - 0x224]
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.0040408c
mov ecx, dword [ebp - 0x210]
mov dl, 1
mov eax, dword [0x453db4]
call fcn.00453e5c
mov dword [0x9a90d0], eax
mov eax, dword [0x47cef4]
cmp dword [eax], 2
je 0x46d8b4
lea edx, [ebp - 0x210]
mov eax, 0x46e398
call fcn.00455090
mov ecx, dword [ebp - 0x210]
mov dl, 1
mov eax, dword [0x453db4]
call fcn.00453e5c
mov dword [0x9a90d0], eax
push 0x46e430
mov ecx, 0x46e3d0
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x9a90d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov dl, 1
mov eax, dword [0x9a90d0]
mov ecx, dword [eax]
call dword [ecx - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46d8eb
call fcn.00409ab8
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x210]
call fcn.0040a6a0
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x324]
mov ecx, 0xff
call fcn.00403fa8
lea edx, [ebp - 0x324]
imul eax, dword [ebp - 8], 0xd
add eax, 0x9a6d54
mov cl, 0xc
call fcn.00402c30
lea eax, [ebp - 0x224]
call fcn.004553bc
push dword [ebp - 0x224]
push 0x46e38c
mov eax, dword [0x47cec0]
push dword [eax]
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.0040408c
mov edx, dword [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0046ea38
call fcn.0046cd44
mov eax, dword [0x47cd24]
mov edx, 0x9a6ff5
call fcn.00403f70
cmp byte [0x9a8e75], 1
jne 0x46d9b2
push dword [0x9a8e71]
push dword [0x9a8e6d]
call fcn.0046d244
mov ebx, eax
call fcn.00409ae4
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0046d244
sub ebx, eax
mov dword [0x9a9100], ebx
cmp dword [ebp - 0xc], 0
je 0x46da71
lea edx, [ebp - 0x210]
mov ebx, dword [ebp - 0xc]
sub ebx, dword [ebp - 0x14]
mov eax, ebx
call fcn.004085e8
mov edx, dword [ebp - 0x210]
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f0]
call fcn.0042af14
mov dword [0x9a90e4], ebx
mov eax, dword [0x9a90e4]
mov dword [0x9a90e8], eax
cmp byte [0x9a8e75], 1
jne 0x46da71
push dword [0x9a8e71]
push dword [0x9a8e6d]
call fcn.0046d244
mov ebx, eax
call fcn.00409ae4
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0046d244
sub ebx, eax
mov dword [0x9a9100], ebx
cmp dword [0x9a9100], 0
jge 0x46da3c
xor eax, eax
mov dword [0x9a9100], eax
mov eax, dword [0x9a90e4]
cmp eax, dword [0x9a9100]
jle 0x46da71
lea edx, [ebp - 0x210]
mov eax, dword [0x9a9100]
call fcn.004085e8
mov edx, dword [ebp - 0x210]
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f0]
call fcn.0042af14
cmp dword [ebp - 0x10], 0
je 0x46daa3
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 0x10]
sub eax, dword [0x9a6ef1]
call fcn.004085e8
mov edx, dword [ebp - 0x210]
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f0]
call fcn.0042af14
cmp dword [ebp - 0xc], 0
je 0x46db6a
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
xor edx, edx
call fcn.0045d798
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
mov edx, dword [ebp - 0xc]
call fcn.0045d7a4
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
call fcn.0045d7b4
cmp byte [0x9a8e75], 1
jne 0x46db1c
mov eax, dword [0x9a90e4]
cmp eax, dword [0x9a9100]
jle 0x46db1c
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
mov edx, dword [0x9a9100]
call fcn.0045d7b4
xor eax, eax
push ebp
push 0x46db60
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
call fcn.004085e8
mov eax, dword [ebp - 0x210]
call fcn.00404190
push eax
push 0x46e438
call sub.kernel32.dll_SetEnvironmentVariableA
call fcn.0040cbf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46db6a
cmp dword [ebp - 0x10], 0
je 0x46dc41
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
xor edx, edx
call fcn.0045d798
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
mov edx, dword [ebp - 0x10]
call fcn.0045d7a4
mov edx, dword [ebp - 0x10]
sub edx, dword [0x9a6ef1]
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
call fcn.0045d7b4
inc dword [0x9a6ef1]
lea eax, [ebp - 0x224]
call fcn.004553bc
push dword [ebp - 0x224]
push 0x46e38c
mov eax, dword [0x47cec0]
push dword [eax]
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.0040408c
mov edx, dword [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0046ea38
xor eax, eax
push ebp
push 0x46dc37
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x210]
mov eax, dword [0x9a6ef1]
call fcn.004085e8
mov eax, dword [ebp - 0x210]
call fcn.00404190
push eax
push 0x46e444
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46dc41
mov eax, dword [0x9a70fb]
and eax, 0x40
cmp eax, 0x40
jne 0x46dc5d
lea ecx, [ebp - 0x2c]
xor edx, edx
mov eax, dword [0x9a9170]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [0x9a70fb]
and eax, 0x10
cmp eax, 0x10
jne 0x46dca5
mov eax, dword [0x47cd1c]
cmp dword [eax], 0x1770
jge 0x46dc7f
lea eax, [ebp - 0x2c]
call fcn.0046bad4
cmp dword [ebp - 0x2c], 0
jne 0x46dca5
call fcn.0045538c
mov dword [ebp - 0x328], eax
fild dword [ebp - 0x328]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x2c]
call fcn.004095c4
mov eax, dword [0x9a70fb]
and eax, 1
dec eax
jne 0x46dcc9
lea eax, [ebp - 0x210]
call fcn.00455120
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x2c]
call fcn.00403fd4
mov eax, dword [0x9a70fb]
and eax, 2
cmp eax, 2
jne 0x46dd07
call fcn.0045538c
mov dword [ebp - 0x328], eax
fild dword [ebp - 0x328]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x210]
call fcn.004095c4
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x2c]
call fcn.00403fd4
mov eax, dword [0x9a70fb]
and eax, 4
cmp eax, 4
jne 0x46dd2d
lea eax, [ebp - 0x210]
call fcn.00455350
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x2c]
call fcn.00403fd4
mov eax, dword [0x9a70fb]
and eax, 8
cmp eax, 8
jne 0x46dd4d
lea eax, [ebp - 0x3c]
call fcn.00461d28
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x3c]
call fcn.00403fd4
mov eax, dword [0x9a70fb]
and eax, 0x20
cmp eax, 0x20
jne 0x46dd8b
call fcn.0046b9b0
mov dword [ebp - 0x328], eax
fild dword [ebp - 0x328]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x210]
call fcn.004095c4
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x2c]
call fcn.00403fd4
mov eax, dword [ebp - 8]
mov ebx, dword [eax*4 + 0x9a8933]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2c]
lea edx, [ebp - 0x224]
mov eax, ebx
call fcn.004085e8
push dword [ebp - 0x224]
mov eax, dword [0x47cec0]
push dword [eax]
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.0040408c
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x220]
call fcn.00453b9c
lea ecx, [ebp - 0x220]
mov edx, 0x46e454
mov eax, 0x46e36c
call fcn.0046bbb0
mov edx, dword [ebp - 0x1c]
mov eax, 0x46e380
call fcn.004042b4
mov ebx, eax
lea eax, [ebp - 0x1c]
mov ecx, ebx
mov edx, 1
call fcn.00404210
mov eax, dword [ebp - 0x1c]
call fcn.00403fcc
mov ecx, eax
sub ecx, 8
lea eax, [ebp - 0x1c]
mov edx, 8
call fcn.00404210
lea edx, [ebp - 0x1c]
mov ecx, 5
mov eax, 0x46e468
call fcn.00404258
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 0x2c]
call fcn.004084cc
cmp dword [ebp - 0x210], 0
jne 0x46de5a
lea eax, [ebp - 0x1c]
mov edx, 0x46e474
call fcn.00403de8
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 0x1c]
call fcn.004082e8
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x1c]
call fcn.00403de8
xor eax, eax
push ebp
push 0x46ded0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40eddc]
call fcn.004030fc
mov ebx, eax
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x210]
mov ecx, 0x46e488
mov edx, dword [0x9a90c4]
call fcn.00404018
mov edx, dword [ebp - 0x210]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, ebx
call fcn.0040312c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46deda
xor eax, eax
push ebp
push 0x46df5b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x9a6c33], 0
jne 0x46df04
mov eax, dword [ebp - 0x1c]
call fcn.00404190
push eax
push 0x46e494
call sub.kernel32.dll_SetEnvironmentVariableA
cmp byte [0x9a6c33], 0
je 0x46df51
push dword [ebp - 0x1c]
push 0x46e468
lea eax, [ebp - 0x224]
mov edx, 0x9a6c33
call fcn.00403f70
push dword [ebp - 0x224]
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.0040408c
mov eax, dword [ebp - 0x210]
call fcn.00404190
push eax
push 0x46e494
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46df65
cmp byte [0x9a6c33], 0
je 0x46dfb4
push dword [ebp - 0x1c]
push 0x46e468
lea eax, [ebp - 0x224]
mov edx, 0x9a6c33
call fcn.00403f70
push dword [ebp - 0x224]
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.0040408c
mov edx, dword [ebp - 0x210]
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x334]
call fcn.0042af14
cmp byte [0x9a6c33], 0
jne 0x46dfd2
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x334]
mov edx, dword [ebp - 0x1c]
call fcn.0042af14
mov eax, dword [ebp - 0x1c]
mov edx, 0x46e474
call fcn.004040dc
mov eax, 0x2710
call fcn.00402d74
mov ebx, eax
lea eax, [ebp - 0x28]
push eax
call fcn.0045538c
mov dword [ebp - 0x328], eax
fild dword [ebp - 0x328]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x210]
call fcn.004095c4
mov eax, dword [ebp - 0x210]
mov ecx, 5
mov edx, 1
call fcn.004041d0
lea edx, [ebp - 0x224]
mov eax, ebx
call fcn.004085e8
mov ecx, dword [ebp - 0x224]
lea eax, [ebp - 0x210]
mov edx, dword [ebp - 0x28]
call fcn.00404018
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x324]
mov ecx, 0xff
call fcn.00403fa8
lea edx, [ebp - 0x324]
mov eax, 0x9a8d61
mov cl, 0xa
call fcn.00402c30
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x220]
mov eax, dword [0x47cec0]
mov eax, dword [eax]
call fcn.00453b9c
lea ecx, [ebp - 0x220]
mov edx, 0x46e35c
mov eax, 0x46e36c
call fcn.0046bbb0
mov edx, dword [ebp - 0x1c]
mov eax, 0x46e380
call fcn.004042b4
lea edx, [ebp - 0x1c]
mov ecx, eax
mov eax, 1
xchg edx, eax
call fcn.00404210
mov eax, dword [0x47cef4]
cmp dword [eax], 2
jne 0x46e10b
mov eax, dword [0x47ce9c]
push dword [eax]
push 0x46e38c
lea edx, [ebp - 0x224]
mov eax, 0x46e398
call fcn.00455090
push dword [ebp - 0x224]
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.0040408c
mov ecx, dword [ebp - 0x210]
mov dl, 1
mov eax, dword [0x453db4]
call fcn.00453e5c
mov dword [0x9a90d0], eax
mov eax, dword [0x47cef4]
cmp dword [eax], 2
je 0x46e13c
lea edx, [ebp - 0x210]
mov eax, 0x46e398
call fcn.00455090
mov ecx, dword [ebp - 0x210]
mov dl, 1
mov eax, dword [0x453db4]
call fcn.00453e5c
mov dword [0x9a90d0], eax
lea edx, [ebp - 0x210]
mov eax, ebx
call fcn.004085e8
mov eax, dword [ebp - 0x210]
push eax
mov ecx, 0x46e4a8
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x9a90d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov dl, 1
mov eax, dword [0x9a90d0]
mov ecx, dword [eax]
call dword [ecx - 4]
lea eax, [ebp - 0x224]
call fcn.004553bc
push dword [ebp - 0x224]
push 0x46e38c
mov eax, dword [0x47cec0]
push dword [eax]
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.0040408c
mov edx, dword [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0046ea38
cmp dword [ebp - 0x34], 0
jle 0x46e1cc
cmp byte [0x9a90dd], 1
jne 0x46e1cc
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xcc]
jmp 0x46e25a
cmp dword [ebp - 0x34], 0
jg 0x46e25a
cmp dword [0x9a9148], 0
jg 0x46e25a
cmp byte [0x9a70f6], 1
jne 0x46e1fd
cmp dword [ebp - 0x34], 0
jne 0x46e1fd
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xcc]
cmp byte [0x9a90dd], 1
jne 0x46e215
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [0x9a8f7a]
test eax, eax
jle 0x46e25a
cmp dword [ebp - 0xc], 0
je 0x46e25a
xor edx, edx
push ebp
push 0x46e250
push dword fs:[edx]
mov dword fs:[edx], esp
cmp eax, dword [ebp - 0x14]
jne 0x46e246
mov eax, dword [0x47cbc4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xcc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46e25a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e29f
lea eax, [ebp - 0x224]
call fcn.00403d50
lea eax, [ebp - 0x210]
call fcn.00403d50
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.00403d74
lea eax, [ebp - 0x30]
mov edx, 7
call fcn.00403d74
ret