Function at 0x470f4c
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x64
push 0
push 0
dec ecx
jne 0x470f54
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x471e2d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [0x9aa537]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 8]
shl edx, 5
lea edx, [edx*8 + 0x9aae63]
call fcn.00403f3c
mov edx, dword [ebp - 0x2c]
mov eax, 0x471e44
call fcn.00404280
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x2c]
mov eax, 0x471e54
call fcn.00404280
mov dword [0x9ac170], eax
xor eax, eax
push ebp
push 0x470ff8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
call fcn.0040415c
push eax
push 0x471e5c
call sub.kernel32.dll_SetEnvironmentVariableA
push 0x471e64
push 0x471e6c
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471002
lea eax, [ebp - 0x3c]
mov edx, 0x9a9bfa
call fcn.00403f3c
xor eax, eax
push ebp
push 0x47103a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x3c]
call fcn.0040415c
push eax
push 0x471e78
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471044
lea eax, [ebp - 0x34]
mov edx, 0x9abd98
call fcn.00403f3c
xor eax, eax
push ebp
push 0x4710c5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x34], 0
je 0x471078
mov eax, dword [ebp - 0x34]
call fcn.0040415c
push eax
push 0x471e80
call sub.kernel32.dll_SetEnvironmentVariableA
cmp dword [ebp - 0x34], 0
je 0x471091
mov eax, dword [ebp - 0x34]
call fcn.0040415c
push eax
push 0x471e8c
call sub.kernel32.dll_SetEnvironmentVariableA
cmp dword [ebp - 0x34], 0
jne 0x4710a6
push 0x471e98
push 0x471e80
call sub.kernel32.dll_SetEnvironmentVariableA
cmp dword [ebp - 0x34], 0
jne 0x4710bb
push 0x471e98
push 0x471e8c
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4710cf
cmp dword [ebp - 0x34], 0
je 0x4710e4
mov eax, dword [0x47fd3c]
mov edx, 0x471eb0
call fcn.00403d70
cmp dword [ebp - 0x34], 0
jne 0x4710f9
mov eax, dword [0x47fd3c]
mov edx, 0x471ec4
call fcn.00403d70
mov eax, dword [ebp - 8]
mov eax, dword [eax*4 + 0x9a9adc]
test eax, eax
je 0x47110d
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax*4 + 0x9a9b04]
test eax, eax
je 0x471121
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
imul edx, dword [ebp - 8], 0xd
add edx, 0x9a9d80
call fcn.00403f3c
cmp byte [0x9abe98], 1
jne 0x471143
mov byte [0x9ac10b], 1
xor eax, eax
push ebp
push 0x471187
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00409ebc
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00470ebc
mov ebx, eax
mov eax, dword [ebp - 0x18]
call fcn.0040b264
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00470ebc
sub ebx, eax
mov dword [ebp - 0x14], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471191
mov eax, dword [ebp - 0x18]
mov edx, 0x471edc
call fcn.004040a8
jne 0x4711a5
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov edx, 0x471edc
call fcn.004040a8
jne 0x47151f
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x218]
mov eax, dword [0x47ff48]
mov eax, dword [eax]
call fcn.00453f84
lea ecx, [ebp - 0x218]
mov edx, 0x471ef0
mov eax, 0x471f00
call fcn.0046f888
mov edx, dword [ebp - 0x1c]
mov eax, 0x471f14
call fcn.00404280
lea edx, [ebp - 0x1c]
mov ecx, eax
mov eax, 1
xchg edx, eax
call fcn.004041dc
xor eax, eax
push ebp
push 0x4712ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x47ff7c]
cmp dword [eax], 2
jne 0x471247
mov edx, dword [0x47ff24]
mov edx, dword [edx]
lea eax, [ebp - 0x21c]
mov ecx, 0x471f20
call fcn.00403fe4
mov ecx, dword [ebp - 0x21c]
mov dl, 1
mov eax, dword [0x45419c]
call fcn.00454244
mov dword [0x9ac0fc], eax
mov eax, dword [0x47ff7c]
cmp dword [eax], 2
je 0x471267
mov ecx, 0x471f38
mov dl, 1
mov eax, dword [0x45419c]
call fcn.00454244
mov dword [0x9ac0fc], eax
call fcn.00409e90
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x21c]
call fcn.0040aa78
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, 0x471f4c
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x9ac0fc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov dl, 1
mov eax, dword [0x9ac0fc]
mov ecx, dword [eax]
call dword [ecx - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4712b7
mov eax, dword [0x47ff24]
push dword [eax]
push 0x471f60
push dword [ebp - 0x1c]
push 0x471f6c
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404058
mov eax, dword [ebp - 0x24]
call fcn.00408bb4
test al, al
je 0x4712f0
mov byte [0x9ac120], 1
jmp 0x471def
xor eax, eax
push ebp
push 0x471384
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x47ff7c]
cmp dword [eax], 2
jne 0x471337
mov edx, dword [0x47ff24]
mov edx, dword [edx]
lea eax, [ebp - 0x21c]
mov ecx, 0x471f20
call fcn.00403fe4
mov ecx, dword [ebp - 0x21c]
mov dl, 1
mov eax, dword [0x45419c]
call fcn.00454244
mov dword [0x9ac0fc], eax
mov eax, dword [0x47ff7c]
cmp dword [eax], 2
je 0x471357
mov ecx, 0x471f38
mov dl, 1
mov eax, dword [0x45419c]
call fcn.00454244
mov dword [0x9ac0fc], eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x471f7c
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x9ac0fc]
mov ebx, dword [eax]
call dword [ebx]
mov dl, 1
mov eax, dword [0x9ac0fc]
mov ecx, dword [eax]
call dword [ecx - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47138e
mov eax, dword [ebp - 0x20]
mov edx, 0x471f94
call fcn.004040a8
jne 0x4713a9
mov byte [0x9ac120], 1
jmp 0x471def
mov eax, dword [0x47ff24]
push dword [eax]
push 0x471f60
push dword [ebp - 0x1c]
push 0x471f6c
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404058
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x208]
call fcn.00405e0e
lea eax, [ebp - 0x208]
call fcn.00405ff6
mov edx, 0x471fa4
lea eax, [ebp - 0x208]
call fcn.00404358
call fcn.00406207
lea eax, [ebp - 0x208]
call fcn.00405f78
xor eax, eax
push ebp
push 0x471497
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x47ff7c]
cmp dword [eax], 2
jne 0x47144a
mov edx, dword [0x47ff24]
mov edx, dword [edx]
lea eax, [ebp - 0x21c]
mov ecx, 0x471f20
call fcn.00403fe4
mov ecx, dword [ebp - 0x21c]
mov dl, 1
mov eax, dword [0x45419c]
call fcn.00454244
mov dword [0x9ac0fc], eax
mov eax, dword [0x47ff7c]
cmp dword [eax], 2
je 0x47146a
mov ecx, 0x471f38
mov dl, 1
mov eax, dword [0x45419c]
call fcn.00454244
mov dword [0x9ac0fc], eax
push 0x471f94
mov ecx, 0x471f7c
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x9ac0fc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov dl, 1
mov eax, dword [0x9ac0fc]
mov ecx, dword [eax]
call dword [ecx - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4714a1
call fcn.00409e90
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x21c]
call fcn.0040aa78
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x31c]
mov ecx, 0xff
call fcn.00403f74
lea edx, [ebp - 0x31c]
imul eax, dword [ebp - 8], 0xd
add eax, 0x9a9d80
mov cl, 0xc
call fcn.00402bfc
lea eax, [ebp - 0x320]
call fcn.004555e0
push dword [ebp - 0x320]
push 0x471f60
mov eax, dword [0x47ff48]
push dword [eax]
lea eax, [ebp - 0x21c]
mov edx, 3
call fcn.00404058
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004725dc
call fcn.004709f4
mov eax, dword [0x47fdac]
mov edx, 0x9aa021
call fcn.00403f3c
cmp byte [0x9abea1], 1
jne 0x471568
push dword [0x9abe9d]
push dword [0x9abe99]
call fcn.00470ebc
mov ebx, eax
call fcn.00409ebc
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00470ebc
sub ebx, eax
mov dword [0x9ac12c], ebx
cmp dword [ebp - 0xc], 0
je 0x471627
lea edx, [ebp - 0x21c]
mov ebx, dword [ebp - 0xc]
sub ebx, dword [ebp - 0x14]
mov eax, ebx
call fcn.004089c0
mov edx, dword [ebp - 0x21c]
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f0]
call fcn.0042b2fc
mov dword [0x9ac110], ebx
mov eax, dword [0x9ac110]
mov dword [0x9ac114], eax
cmp byte [0x9abea1], 1
jne 0x471627
push dword [0x9abe9d]
push dword [0x9abe99]
call fcn.00470ebc
mov ebx, eax
call fcn.00409ebc
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00470ebc
sub ebx, eax
mov dword [0x9ac12c], ebx
cmp dword [0x9ac12c], 0
jge 0x4715f2
xor eax, eax
mov dword [0x9ac12c], eax
mov eax, dword [0x9ac110]
cmp eax, dword [0x9ac12c]
jle 0x471627
lea edx, [ebp - 0x21c]
mov eax, dword [0x9ac12c]
call fcn.004089c0
mov edx, dword [ebp - 0x21c]
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f0]
call fcn.0042b2fc
cmp dword [ebp - 0x10], 0
je 0x471659
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 0x10]
sub eax, dword [0x9a9f1d]
call fcn.004089c0
mov edx, dword [ebp - 0x21c]
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f0]
call fcn.0042b2fc
cmp dword [ebp - 0xc], 0
je 0x471720
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
xor edx, edx
call fcn.0045f704
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
mov edx, dword [ebp - 0xc]
call fcn.0045f710
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
call fcn.0045f720
cmp byte [0x9abea1], 1
jne 0x4716d2
mov eax, dword [0x9ac110]
cmp eax, dword [0x9ac12c]
jle 0x4716d2
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
mov edx, dword [0x9ac12c]
call fcn.0045f720
xor eax, eax
push ebp
push 0x471716
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
call fcn.004089c0
mov eax, dword [ebp - 0x21c]
call fcn.0040415c
push eax
push 0x471fd4
call sub.kernel32.dll_SetEnvironmentVariableA
call fcn.0040cfc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471720
cmp dword [ebp - 0x10], 0
je 0x4717f7
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
xor edx, edx
call fcn.0045f704
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
mov edx, dword [ebp - 0x10]
call fcn.0045f710
mov edx, dword [ebp - 0x10]
sub edx, dword [0x9a9f1d]
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f4]
call fcn.0045f720
inc dword [0x9a9f1d]
lea eax, [ebp - 0x320]
call fcn.004555e0
push dword [ebp - 0x320]
push 0x471f60
mov eax, dword [0x47ff48]
push dword [eax]
lea eax, [ebp - 0x21c]
mov edx, 3
call fcn.00404058
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004725dc
xor eax, eax
push ebp
push 0x4717ed
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x21c]
mov eax, dword [0x9a9f1d]
call fcn.004089c0
mov eax, dword [ebp - 0x21c]
call fcn.0040415c
push eax
push 0x471fe0
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4717f7
mov eax, dword [0x9aa127]
and eax, 0x40
cmp eax, 0x40
jne 0x47186d
xor eax, eax
push ebp
push 0x471863
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40f1c4]
call fcn.004030c8
mov ebx, eax
lea ecx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e4]
mov eax, dword [eax + 0x58]
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x21c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea ecx, [ebp - 0x28]
xor edx, edx
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.004030f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47186d
mov eax, dword [0x9aa127]
and eax, 0x10
cmp eax, 0x10
jne 0x4718b5
mov eax, dword [0x47fda4]
cmp dword [eax], 0x1770
jge 0x47188f
lea eax, [ebp - 0x28]
call fcn.0046f7ac
cmp dword [ebp - 0x28], 0
jne 0x4718b5
call fcn.004555b0
mov dword [ebp - 0x324], eax
fild dword [ebp - 0x324]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x28]
call fcn.0040999c
mov eax, dword [0x9aa127]
and eax, 1
dec eax
jne 0x4718d9
lea eax, [ebp - 0x21c]
call fcn.00455344
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x28]
call fcn.00403fa0
mov eax, dword [0x9aa127]
and eax, 2
cmp eax, 2
jne 0x471917
call fcn.004555b0
mov dword [ebp - 0x324], eax
fild dword [ebp - 0x324]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x21c]
call fcn.0040999c
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x28]
call fcn.00403fa0
mov eax, dword [0x9aa127]
and eax, 4
cmp eax, 4
jne 0x47193d
lea eax, [ebp - 0x21c]
call fcn.00455574
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x28]
call fcn.00403fa0
mov eax, dword [0x9aa127]
and eax, 8
cmp eax, 8
jne 0x47195d
lea eax, [ebp - 0x38]
call fcn.00465e08
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x38]
call fcn.00403fa0
mov eax, dword [0x9aa127]
and eax, 0x20
cmp eax, 0x20
jne 0x47199b
call fcn.0046f688
mov dword [ebp - 0x324], eax
fild dword [ebp - 0x324]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x21c]
call fcn.0040999c
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x28]
call fcn.00403fa0
mov eax, dword [ebp - 8]
mov ebx, dword [eax*4 + 0x9ab95f]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x28]
lea edx, [ebp - 0x320]
mov eax, ebx
call fcn.004089c0
push dword [ebp - 0x320]
mov eax, dword [0x47ff48]
push dword [eax]
lea eax, [ebp - 0x21c]
mov edx, 3
call fcn.00404058
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x218]
call fcn.00453f84
lea ecx, [ebp - 0x218]
mov edx, 0x471ff0
mov eax, 0x471f00
call fcn.0046f888
mov edx, dword [ebp - 0x1c]
mov eax, 0x471f14
call fcn.00404280
mov ebx, eax
lea eax, [ebp - 0x1c]
mov ecx, ebx
mov edx, 1
call fcn.004041dc
mov eax, dword [ebp - 0x1c]
call fcn.00403f98
mov ecx, eax
sub ecx, 8
lea eax, [ebp - 0x1c]
mov edx, 8
call fcn.004041dc
lea edx, [ebp - 0x1c]
mov ecx, 5
mov eax, 0x472004
call fcn.00404224
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 0x28]
call fcn.004088a4
cmp dword [ebp - 0x21c], 0
jne 0x471a6a
lea eax, [ebp - 0x1c]
mov edx, 0x472010
call fcn.00403db4
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 0x1c]
call fcn.004086c0
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x1c]
call fcn.00403db4
xor eax, eax
push ebp
push 0x471ae0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40f1c4]
call fcn.004030c8
mov ebx, eax
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x21c]
mov ecx, 0x472024
mov edx, dword [0x9ac0f0]
call fcn.00403fe4
mov edx, dword [ebp - 0x21c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, ebx
call fcn.004030f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471aea
xor eax, eax
push ebp
push 0x471b6b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x9a9c5f], 0
jne 0x471b14
mov eax, dword [ebp - 0x1c]
call fcn.0040415c
push eax
push 0x472030
call sub.kernel32.dll_SetEnvironmentVariableA
cmp byte [0x9a9c5f], 0
je 0x471b61
push dword [ebp - 0x1c]
push 0x472004
lea eax, [ebp - 0x320]
mov edx, 0x9a9c5f
call fcn.00403f3c
push dword [ebp - 0x320]
lea eax, [ebp - 0x21c]
mov edx, 3
call fcn.00404058
mov eax, dword [ebp - 0x21c]
call fcn.0040415c
push eax
push 0x472030
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471b75
cmp byte [0x9a9c5f], 0
je 0x471bc4
push dword [ebp - 0x1c]
push 0x472004
lea eax, [ebp - 0x320]
mov edx, 0x9a9c5f
call fcn.00403f3c
push dword [ebp - 0x320]
lea eax, [ebp - 0x21c]
mov edx, 3
call fcn.00404058
mov edx, dword [ebp - 0x21c]
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x334]
call fcn.0042b2fc
cmp byte [0x9a9c5f], 0
jne 0x471be2
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x334]
mov edx, dword [ebp - 0x1c]
call fcn.0042b2fc
mov eax, dword [ebp - 0x1c]
mov edx, 0x472010
call fcn.004040a8
mov eax, 0x186a0
call fcn.00402d40
mov ebx, eax
lea edx, [ebp - 0x21c]
mov eax, ebx
call fcn.004089c0
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x31c]
mov ecx, 0xff
call fcn.00403f74
lea edx, [ebp - 0x31c]
mov eax, 0x9abd8d
mov cl, 0xa
call fcn.00402bfc
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x218]
mov eax, dword [0x47ff48]
mov eax, dword [eax]
call fcn.00453f84
lea ecx, [ebp - 0x218]
mov edx, 0x471ef0
mov eax, 0x471f00
call fcn.0046f888
mov edx, dword [ebp - 0x1c]
mov eax, 0x471f14
call fcn.00404280
lea edx, [ebp - 0x1c]
mov ecx, eax
mov eax, 1
xchg edx, eax
call fcn.004041dc
mov eax, dword [0x47ff7c]
cmp dword [eax], 2
jne 0x471cb1
mov edx, dword [0x47ff24]
mov edx, dword [edx]
lea eax, [ebp - 0x21c]
mov ecx, 0x471f20
call fcn.00403fe4
mov ecx, dword [ebp - 0x21c]
mov dl, 1
mov eax, dword [0x45419c]
call fcn.00454244
mov dword [0x9ac0fc], eax
mov eax, dword [0x47ff7c]
cmp dword [eax], 2
je 0x471cd1
mov ecx, 0x471f38
mov dl, 1
mov eax, dword [0x45419c]
call fcn.00454244
mov dword [0x9ac0fc], eax
lea edx, [ebp - 0x21c]
mov eax, ebx
call fcn.004089c0
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, 0x472044
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x9ac0fc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov dl, 1
mov eax, dword [0x9ac0fc]
mov ecx, dword [eax]
call dword [ecx - 4]
lea eax, [ebp - 0x320]
call fcn.004555e0
push dword [ebp - 0x320]
push 0x471f60
mov eax, dword [0x47ff48]
push dword [eax]
lea eax, [ebp - 0x21c]
mov edx, 3
call fcn.00404058
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004725dc
cmp dword [ebp - 0x30], 0
jle 0x471d61
cmp byte [0x9ac109], 1
jne 0x471d61
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xcc]
jmp 0x471def
cmp dword [ebp - 0x30], 0
jg 0x471def
cmp dword [0x9ac170], 0
jg 0x471def
cmp byte [0x9aa122], 1
jne 0x471d92
cmp dword [ebp - 0x30], 0
jne 0x471d92
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xcc]
cmp byte [0x9ac109], 1
jne 0x471daa
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [0x9abfa6]
test eax, eax
jle 0x471def
cmp dword [ebp - 0xc], 0
je 0x471def
xor edx, edx
push ebp
push 0x471de5
push dword fs:[edx]
mov dword fs:[edx], esp
cmp eax, dword [ebp - 0x14]
jne 0x471ddb
mov eax, dword [0x47fc4c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xcc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471def
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471e34
lea eax, [ebp - 0x320]
call fcn.00403d1c
lea eax, [ebp - 0x21c]
call fcn.00403d1c
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00403d40
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.00403d40
ret