Function at 0x46cff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x635bf7
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x71de04]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xd8], ebx
cmp dword [ebx + 0xf15c], 0
jne 0x46e004
xor eax, eax
mov dword [ebp - 0x74], 7
mov dword [ebp - 0x78], 0
mov word [ebp - 0x88], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x8c], 7
mov dword [ebp - 0x90], eax
mov word [ebp - 0xa0], ax
lea edx, [ebx + 0x1fc4]
mov byte [ebp - 4], 1
cmp word [edx], ax
jne 0x46d077
xor ecx, ecx
jmp 0x46d08f
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d080
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x88]
call fcn.00415720
push 0xc
push str.gsave00.dat
lea ecx, [ebp - 0x88]
call fcn.0041a260
push 0x2c
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea ecx, [ebp - 0xa0]
call fcn.00415720
cmp dword [ebp - 0x74], 8
lea eax, [ebp - 0x88]
push 0x662604
cmovae eax, dword [ebp - 0x88]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.005ef4e8
movaps xmm0, xmmword [0x649470]
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0xb8], 0
movaps xmm0, xmmword [0x649480]
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xac], 0
push 0x100
push 0
mov byte [ebp - 4], 2
mov dword [ebp - 0xcc], 0
mov byte [ebp - 0xa5], 0
call fcn.005ee0be
push 4
lea ecx, [ebx + 0x11a0]
mov esi, eax
push ecx
push esi
call fcn.004a02f4
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea eax, [ebx + 0x11a4]
push 4
push eax
lea ecx, [esi + 4]
push ecx
call fcn.004a02f4
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea ecx, [ebx + 0xd764]
push 4
push ecx
lea ecx, [esi + 8]
push ecx
call fcn.004a02f4
add esp, 0x48
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea ecx, [ebx + 0xd768]
push 4
push ecx
lea ecx, [esi + 0xc]
push ecx
call fcn.004a02f4
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea ecx, [ebx + 0xd76c]
push 4
push ecx
lea ecx, [esi + 0x10]
push ecx
call fcn.004a02f4
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea ecx, [ebx + 0xd774]
push 4
push ecx
lea ecx, [esi + 0x14]
push ecx
call fcn.004a02f4
push 0x100
push esi
call fcn.005ee0be
add esp, 0x44
lea ecx, [ebx + 0xd778]
mov esi, eax
push 4
push ecx
lea ecx, [esi + 0x18]
push ecx
call fcn.004a02f4
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea ecx, [ebx + 0xd77c]
push 4
push ecx
lea ecx, [esi + 0x1c]
push ecx
call fcn.004a02f4
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea ecx, [ebx + 0xd780]
push 4
push ecx
lea ecx, [esi + 0x20]
push ecx
call fcn.004a02f4
mov eax, dword [ebx + 0xcb30]
lea edi, [ebx + 0xd758]
mov ecx, dword [ebx + 0xcb2c]
mov dword [ebx + 0xd75c], eax
mov eax, dword [ebx + 0xcb34]
push 0x100
push esi
mov dword [edi], ecx
mov dword [ebx + 0xd760], eax
call fcn.005ee0be
mov esi, eax
push 4
push edi
lea ecx, [esi + 0x24]
push ecx
call fcn.004a02f4
add esp, 0x48
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea eax, [ebx + 0xd75c]
push 4
push eax
lea ecx, [esi + 0x28]
push ecx
call fcn.004a02f4
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea ecx, [ebx + 0xd760]
push 4
push ecx
lea ecx, [esi + 0x2c]
push ecx
call fcn.004a02f4
push 0x40
push 0
lea eax, [ebp - 0x50]
push eax
call fcn.004a0318
mov eax, dword [ebx + 0xcb48]
lea ecx, [ebx + 0xcb38]
add esp, 0x34
cmp dword [ecx + 0x14], 8
jb 0x46d2f5
mov ecx, dword [ecx]
add eax, eax
push eax
push ecx
lea eax, [ebp - 0x50]
push eax
call fcn.004a030c
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea eax, [ebp - 0x50]
push 0x40
push eax
lea ecx, [esi + 0x30]
push ecx
call fcn.004a02f4
push 0x40
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.004a0318
mov eax, dword [ebx + 0xcb60]
lea ecx, [ebx + 0xcb50]
add esp, 0x2c
cmp dword [ecx + 0x14], 8
jb 0x46d342
mov ecx, dword [ecx]
add eax, eax
push eax
push ecx
lea eax, [ebp - 0x50]
push eax
call fcn.004a030c
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea eax, [ebp - 0x50]
push 0x40
push eax
lea ecx, [esi + 0x70]
push ecx
call fcn.004a02f4
push 0x40
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.004a0318
mov eax, dword [ebx + 0xcb78]
lea ecx, [ebx + 0xcb68]
add esp, 0x2c
cmp dword [ecx + 0x14], 8
jb 0x46d38f
mov ecx, dword [ecx]
add eax, eax
push eax
push ecx
lea eax, [ebp - 0x50]
push eax
call fcn.004a030c
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea eax, [ebp - 0x50]
push 0x40
push eax
lea ecx, [esi + 0xb0]
push ecx
call fcn.004a02f4
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea ecx, [ebx + 0xd4a0]
push 4
push ecx
lea ecx, [esi + 0xf0]
push ecx
call fcn.004a02f4
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea ecx, [ebx + 0xf25c]
push 4
push ecx
lea ecx, [esi + 0xf4]
push ecx
call fcn.004a02f4
add esp, 0x48
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea ecx, [ebx + 0xf260]
push 4
push ecx
lea ecx, [esi + 0xf8]
push ecx
call fcn.004a02f4
push 0x100
push esi
call fcn.005ee0be
mov esi, eax
lea ecx, [ebx + 0xf264]
push 4
push ecx
lea ecx, [esi + 0xfc]
push ecx
call fcn.004a02f4
mov edi, 0x200
push edi
push esi
mov dword [ebp - 0xc0], edi
call fcn.005ee0be
mov esi, eax
lea ecx, [ebx + 0xc5b8]
push 4
push ecx
lea ecx, [esi + 0x100]
push ecx
call fcn.004a02f4
mov eax, dword [ebx + 0xd494]
sub eax, dword [ebx + 0xd490]
sar eax, 2
push edi
push esi
mov dword [ebp - 0xd4], eax
call fcn.005ee0be
add esp, 0x44
mov dword [ebp - 0xc4], eax
lea ecx, [ebp - 0xd4]
push 4
push ecx
lea ecx, [eax + 0x104]
push ecx
call fcn.004a02f4
xor ecx, ecx
add esp, 0xc
mov esi, 0x108
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xbc], esi
cmp dword [ebp - 0xd4], ecx
jle 0x46d63a
nop dword [eax + eax]
mov eax, dword [ebx + 0xd490]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0xd0], eax
cmp dword [eax + 4], 0
je 0x46d509
mov eax, dword [eax]
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xb0], eax
call fcn.004a2800
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xc8], eax
jmp 0x46d513
mov dword [ebp - 0xc8], 0
lea eax, [esi + 4]
mov dword [ebp - 0xb0], eax
cmp edi, eax
jge 0x46d536
sub eax, edi
add edi, 0x100
dec eax
and eax, 0xffffff00
add edi, eax
mov dword [ebp - 0xc0], edi
push edi
push dword [ebp - 0xc4]
call fcn.005ee0be
push 4
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xc4], eax
push ecx
add eax, esi
push eax
call fcn.004a02f4
mov esi, dword [ebp - 0xb0]
xor eax, eax
add esp, 0x14
mov dword [ebp - 0xbc], esi
cmp dword [ebp - 0xc8], eax
jle 0x46d621
mov ebx, dword [ebp - 0xc4]
nop dword [eax]
mov ecx, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.0045b170
mov eax, dword [ebp - 0xe0]
movsx eax, byte [eax + 0x14]
mov dword [ebp - 0xcc], eax
lea eax, [esi + 1]
mov dword [ebp - 0xb0], eax
cmp edi, eax
jge 0x46d5d9
sub eax, edi
add edi, 0x100
dec eax
and eax, 0xffffff00
add edi, eax
mov dword [ebp - 0xc0], edi
push edi
push ebx
call fcn.005ee0be
mov ebx, eax
lea eax, [ebp - 0xcc]
push 1
push eax
mov dword [ebp - 0xc4], ebx
lea eax, [esi + ebx]
push eax
call fcn.004a02f4
mov eax, dword [ebp - 0xb4]
add esp, 0x14
mov esi, dword [ebp - 0xb0]
mov dword [ebp - 0xbc], esi
cmp eax, dword [ebp - 0xc8]
jl 0x46d580
mov ebx, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xac]
inc ecx
mov dword [ebp - 0xac], ecx
cmp ecx, dword [ebp - 0xd4]
jl 0x46d4d0
mov eax, dword [ebx + 0x116c]
inc eax
mov dword [ebp - 0xac], 0
test eax, eax
jle 0x46d6fb
lea eax, [ebx + 0x1158]
nop dword [eax]
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xe0]
push ecx
mov ecx, eax
call fcn.0041cd00
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xcc], eax
lea eax, [esi + 4]
mov dword [ebp - 0xb4], eax
cmp edi, eax
jge 0x46d6a7
sub eax, edi
add edi, 0x100
dec eax
and eax, 0xffffff00
add edi, eax
mov dword [ebp - 0xc0], edi
push edi
push dword [ebp - 0xc4]
call fcn.005ee0be
push 4
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xc4], eax
push ecx
add eax, esi
push eax
call fcn.004a02f4
mov ecx, dword [ebp - 0xac]
add esp, 0x14
mov eax, dword [ebx + 0x116c]
inc ecx
mov esi, dword [ebp - 0xb4]
inc eax
cmp ecx, eax
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xac], ecx
lea eax, [ebx + 0x1158]
jl 0x46d660
lea eax, [esi + 4]
mov dword [ebp - 0xb4], eax
cmp edi, eax
jge 0x46d71e
sub eax, edi
add edi, 0x100
dec eax
and eax, 0xffffff00
add edi, eax
mov dword [ebp - 0xc0], edi
push edi
push dword [ebp - 0xc4]
call fcn.005ee0be
lea ecx, [ebx + 0x9d8c]
mov dword [ebp - 0xc4], eax
push 4
push ecx
mov dword [ebp - 0xd0], ecx
lea ecx, [esi + eax]
push ecx
call fcn.004a02f4
mov esi, dword [ebp - 0xb4]
add esp, 0x14
cmp dword [ebx + 0x9d8c], 0
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xac], 0
jle 0x46d89a
lea eax, [ebx + 0x9d84]
xor ebx, ebx
mov dword [ebp - 0xb4], eax
nop dword [eax]
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xe0]
push ecx
mov ecx, eax
call fcn.0041cd00
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xcc], eax
test eax, eax
je 0x46d7b8
mov al, byte [ebp + ebx*4 - 0x70]
or byte [ebp - 0xa5], al
inc dword [ebp - 0xb8]
cmp ebx, 7
jne 0x46d814
lea ebx, [esi + 1]
cmp edi, ebx
jge 0x46d7dc
mov eax, ebx
sub eax, edi
add edi, 0x100
dec eax
and eax, 0xffffff00
add edi, eax
mov dword [ebp - 0xc0], edi
push edi
push dword [ebp - 0xc4]
call fcn.005ee0be
push 1
lea ecx, [ebp - 0xa5]
mov dword [ebp - 0xc4], eax
push ecx
add eax, esi
push eax
call fcn.004a02f4
mov esi, ebx
add esp, 0x14
xor ebx, ebx
mov dword [ebp - 0xbc], esi
mov byte [ebp - 0xa5], bl
jmp 0x46d815
inc ebx
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xac], eax
cmp eax, dword [ecx]
mov eax, dword [ebp - 0xb4]
jl 0x46d780
test ebx, ebx
mov ebx, dword [ebp - 0xd8]
je 0x46d89a
lea eax, [esi + 1]
mov dword [ebp - 0xb4], eax
cmp edi, eax
jge 0x46d863
sub eax, edi
add edi, 0x100
dec eax
and eax, 0xffffff00
add edi, eax
mov dword [ebp - 0xc0], edi
push edi
push dword [ebp - 0xc4]
call fcn.005ee0be
mov edi, eax
lea eax, [ebp - 0xa5]
push 1
push eax
mov dword [ebp - 0xc4], edi
lea eax, [esi + edi]
push eax
call fcn.004a02f4
mov esi, dword [ebp - 0xb4]
add esp, 0x14
mov dword [ebp - 0xbc], esi
jmp 0x46d8a0
mov edi, dword [ebp - 0xc4]
push dword [ebp - 0xa4]
push esi
push 1
push edi
call fcn.005efbfb
push dword [ebp - 0xa4]
mov eax, 0xffffff
sub eax, dword [ebp - 0xb8]
sub eax, dword [ebx + 0x11a4]
push 1
mov dword [ebp - 0xe4], eax
lea eax, [ebp - 0xe4]
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xd25c]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xd260]
push 1
push 4
push eax
call fcn.005efbfb
add esp, 0x40
lea eax, [ebx + 0xd264]
push dword [ebp - 0xa4]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xd268]
push 1
push 4
push eax
call fcn.005efbfb
add esp, 0x20
lea eax, [ebx + 0xd26c]
cmp dword [ebx + 0xd2a0], 0
push dword [ebp - 0xa4]
push 1
push 4
je 0x46d959
lea eax, [ebx + 0xd270]
push eax
call fcn.005efbfb
add esp, 0x10
lea eax, [ebx + 0xd278]
push dword [ebp - 0xa4]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xd21c]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xd280]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xd238]
push 1
push 4
push eax
call fcn.005efbfb
add esp, 0x40
lea eax, [ebx + 0xd234]
push dword [ebp - 0xa4]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xd338]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xcbfc]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xcc00]
push 1
push 4
push eax
call fcn.005efbfb
add esp, 0x40
lea eax, [ebx + 0xcf8c]
push dword [ebp - 0xa4]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xcf88]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xcff4]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xcff8]
push 1
push 4
push eax
call fcn.005efbfb
add esp, 0x40
push dword [ebp - 0xa4]
push 1
push 4
lea eax, [ebx + 0xcffc]
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xd000]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xd004]
push 1
push 1
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xd0fc]
push 1
push 4
push eax
call fcn.005efbfb
add esp, 0x40
lea eax, [ebx + 0xc6b0]
push dword [ebp - 0xa4]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xc6b4]
push 1
push 4
push eax
call fcn.005efbfb
add esp, 0x20
xor eax, eax
mov dword [ebp - 0xac], eax
nop word [eax + eax]
push dword [ebp - 0xa4]
lea eax, [eax + 0x31b1]
push 1
lea eax, [ebx + eax*4]
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
mov eax, dword [ebp - 0xac]
add eax, 0x31c1
push 1
push 4
lea eax, [ebx + eax*4]
push eax
call fcn.005efbfb
mov eax, dword [ebp - 0xac]
add esp, 0x20
inc eax
mov dword [ebp - 0xac], eax
cmp eax, 0x10
jl 0x46db10
push dword [ebp - 0xa4]
lea eax, [ebx + 0xd4b0]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xf224]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xf228]
push 1
push 4
push eax
call fcn.005efbfb
add esp, 0x30
xor esi, esi
nop dword [eax]
nop word [eax + eax]
push dword [ebp - 0xa4]
lea eax, [esi + 0xf3f0]
push 1
add eax, ebx
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [esi + 0xf3fc]
push 1
add eax, ebx
push 4
push eax
call fcn.005efbfb
add esi, 4
add esp, 0x20
cmp esi, 0x10
jl 0x46dbb0
push dword [ebp - 0xa4]
lea eax, [ebx + 0xc5bc]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xf238]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0x17c0]
push 1
push 4
push eax
call fcn.005efbfb
push dword [ebp - 0xa4]
lea eax, [ebx + 0xfa08]
push 1
push 4
push eax
call fcn.005efbfb
add esp, 0x40
lea eax, [ebx + 0xfb9c]
push dword [ebp - 0xa4]
push 1
push 4
push eax
call fcn.005efbfb
add esp, 0x10
call fcn.004b454f
mov ecx, eax
test ecx, ecx
jne 0x46dc74
push 0x80004005
call fcn.00416410
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xb0], esi
cmp dword [ebx + 0x9dd8], 1
push dword [ebp - 0xa4]
mov byte [ebp - 4], 3
push 1
push 4
jne 0x46df26
mov eax, dword [ebx + 0x9dd0]
sub eax, dword [ebx + 0x9dcc]
sar eax, 2
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb8]
push eax
call fcn.005efbfb
mov edi, dword [ebx + 0x9dcc]
add esp, 0x10
cmp edi, dword [ebx + 0x9dd0]
je 0x46de7f
mov ecx, dword [edi]
lea edx, [ebp - 0xdc]
add ecx, 0x40
push edx
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, dword [eax]
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 4
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0xe8], ecx
lea eax, [edx - 0x10]
mov dword [ebp - 0xb4], eax
cmp eax, ecx
je 0x46ddd2
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0xd8], eax
jl 0x46ddbd
mov esi, dword [ebp - 0xb4]
mov eax, dword [esi]
cmp eax, dword [ecx]
jne 0x46ddbd
mov eax, dword [eax]
mov ecx, dword [esi]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x46dd48
cmp ecx, dword [esi]
jne 0x46dd48
lock inc dword [eax]
jmp 0x46dd92
mov eax, dword [ecx]
lea edx, [esi + 4]
push 2
push dword [edx]
mov dword [ebp - 0xb4], edx
call dword [eax]
mov esi, eax
test esi, esi
je 0x46df17
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov dword [esi + 4], ecx
mov eax, dword [eax]
lea ecx, [eax*2 + 2]
push ecx
push dword [ebp - 0xd0]
lea eax, [eax*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.004549c0
add esp, 0x10
mov ecx, dword [ebp - 0xd8]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x46ddb2
mov edx, dword [ebp - 0xe8]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0x10
mov dword [ebp - 0xb0], esi
jmp 0x46ddd2
push dword [edx - 0xc]
lea ecx, [ebp - 0xb0]
push edx
call fcn.004190c0
mov esi, dword [ebp - 0xb0]
mov edx, dword [ebp - 0xdc]
or eax, 0xffffffff
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46ddf4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0xa4]
mov eax, dword [esi - 0xc]
push 1
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb8]
push 4
push eax
call fcn.005efbfb
mov edx, dword [ebp - 0xb8]
add esp, 0x10
test edx, edx
js 0x46df1c
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x46de4d
push edx
lea ecx, [ebp - 0xb0]
call fcn.004183e0
mov edx, dword [ebp - 0xb8]
mov esi, dword [ebp - 0xb0]
push dword [ebp - 0xa4]
push edx
push 2
push esi
call fcn.005efbfb
push dword [ebp - 0xa4]
push 1
push 4
push dword [edi]
call fcn.005efbfb
add edi, 4
add esp, 0x20
cmp edi, dword [ebx + 0x9dd0]
jne 0x46dcd3
mov edi, dword [ebp - 0xc4]
xor eax, eax
mov dword [ebp - 0xac], eax
nop dword [eax]
push dword [ebp - 0xa4]
lea eax, [eax + 0x3e3f]
push 1
lea eax, [ebx + eax*4]
push 4
push eax
call fcn.005efbfb
mov eax, dword [ebp - 0xac]
add esp, 0x10
inc eax
mov dword [ebp - 0xac], eax
cmp eax, 0xa
jl 0x46de90
push dword [ebp - 0xa4]
call fcn.005ef6c7
add esp, 4
mov byte [ebp - 4], 2
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46dee8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x46def5
push edi
call fcn.005edf22
add esp, 4
mov eax, dword [ebp - 0x8c]
cmp eax, 8
jb 0x46df88
mov ecx, dword [ebp - 0xa0]
inc eax
cmp eax, 0x7fffffff
jbe 0x46df44
call fcn.005e567f
call fcn.00419c10
push 0x80070057
call fcn.00416410
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb8], 0xffffffff
push eax
call fcn.005efbfb
add esp, 0x10
jmp 0x46de85
add eax, eax
cmp eax, 0x1000
jb 0x46df7f
test byte [ebp - 0xa0], 0x1f
je 0x46df5b
call fcn.005e567f
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x46df67
call fcn.005e567f
sub ecx, eax
cmp ecx, 4
jae 0x46df73
call fcn.005e567f
cmp ecx, 0x23
jbe 0x46df7d
call fcn.005e567f
mov ecx, eax
push ecx
call fcn.004a94b8
add esp, 4
xor eax, eax
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x90], 0
cmp eax, 8
jb 0x46e004
mov ecx, dword [ebp - 0x88]
inc eax
cmp eax, 0x7fffffff
jbe 0x46dfc0
call fcn.005e567f
add eax, eax
cmp eax, 0x1000
jb 0x46dffb
test byte [ebp - 0x88], 0x1f
je 0x46dfd7
call fcn.005e567f
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x46dfe3
call fcn.005e567f
sub ecx, eax
cmp ecx, 4
jae 0x46dfef
call fcn.005e567f
cmp ecx, 0x23
jbe 0x46dff9
call fcn.005e567f
mov ecx, eax
push ecx
call fcn.004a94b8
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e0710
mov esp, ebp
pop ebp
ret