Function at 0x405d70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bd3d0
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x4ec6a0]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push esi
push edi
mov eax, dword [0x4ec6a0]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x18], edi
call fcn.00477504
mov eax, 0x300
mov ecx, 0x400
mov dword [edi + 0x470], eax
mov dword [edi + 0x90], eax
mov eax, 1
xor esi, esi
mov dword [edi + 0x46c], ecx
mov dword [edi + 0x84], esi
mov dword [edi + 0x88], esi
mov dword [edi + 0x8c], ecx
mov dword [edi + 0x98], eax
mov dword [edi + 0x94], eax
mov dword [edi + 0x9c], 0x2fc
mov dword [edi + 0xa0], 0x243
call fcn.00474091
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x405e2a
push 0x80004005
call fcn.00404150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
push 0x64
lea ecx, [esp + 0x40]
push esi
push ecx
mov dword [esp + 0xc4], esi
call fcn.00499500
add esp, 0xc
call fcn.00478342
mov eax, dword [eax + 8]
push 0x64
lea edx, [esp + 0x40]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00474091
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x405e81
push 0x80004005
call fcn.00404150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0xbc], 1
call fcn.0040d650
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xbc], 2
call fcn.00404a60
mov byte [esp + 0xb8], 1
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405ee1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x20]
push 0x5c
push ebx
call fcn.00492473
add esp, 8
cmp eax, esi
jne 0x405ef9
or esi, 0xffffffff
jmp 0x405efd
sub eax, ebx
mov esi, eax
push esi
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x28]
call fcn.00404900
push str.logo.bmp
push eax
lea edx, [esp + 0x24]
mov bl, 3
push edx
mov byte [esp + 0xc4], bl
call fcn.0040d840
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xbc], 4
call fcn.00404a60
mov byte [esp + 0xb8], bl
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405f61
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb8], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405f89
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x28]
call fcn.00404900
push str.dvr.dat
push eax
lea edx, [esp + 0x24]
mov bl, 5
push edx
mov byte [esp + 0xc4], bl
call fcn.0040d840
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xbc], 6
call fcn.00404a60
mov byte [esp + 0xb8], bl
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405fed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb8], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406015
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
push ecx
push 1
push str.UseDefaultLogo
push str.Logo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
je 0x406071
mov edx, dword [esp + 0x20]
push 0x2050
push 0
push 0
push 0
push edx
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
test eax, eax
je 0x406064
push eax
mov eax, dword [edi + 0x494]
push 0
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x406071
push 0
lea ecx, [edi + 0x474]
call fcn.00480ab6
mov ecx, dword [edi + 0x88]
mov edx, dword [edi + 0x9c]
push 1
push 0x53
push 0x8a
add ecx, 0xa
push ecx
add edx, 0x32
push edx
lea ecx, [edi + 0x474]
call fcn.00480a78
call fcn.00474091
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4060b3
push 0x80004005
call fcn.00404150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov esi, edi
mov byte [esp + 0xb8], 7
call fcn.00407550
mov ecx, edi
call fcn.00407750
mov esi, dword [edi + 0x714]
lea ebx, [edi + 0x714]
push 0
push 0x59f
mov ecx, edi
add esi, 0x134
call fcn.004808f5
mov edx, dword [esi]
push eax
mov ecx, ebx
call edx
mov eax, dword [edi + 0x734]
push 0
push 1
push 0x401
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [edi + 0xda0], 0
jne 0x40616c
lea ebx, [edi + 0xda4]
mov dword [esp + 0x1c], 0x3c
lea ecx, [ecx]
push 0x15c
call fcn.004732ab
add esp, 4
mov dword [esp + 0x38], eax
test eax, eax
mov byte [esp + 0xb8], 8
je 0x406156
mov esi, eax
call fcn.00420100
jmp 0x406158
xor eax, eax
mov byte [esp + 0xb8], 7
mov dword [ebx], eax
add ebx, 4
sub dword [esp + 0x1c], 1
jne 0x406130
call fcn.00427700
mov ecx, dword [edi + 0x470]
mov ebx, eax
push edi
lea eax, [edi + 0x94]
push eax
mov eax, dword [edi + 0x46c]
mov dword [edi + 0x5fc], ebx
call fcn.004281d0
mov eax, dword [edi + 0x5fc]
mov ecx, dword [eax + 0x33a8]
cmp ecx, 2
jg 0x4061d2
imul ecx, ecx, 0xa0c
mov edx, 1
mov dword [ecx + eax + 0x33b8], edx
mov ecx, dword [eax + 0x33a8]
imul ecx, ecx, 0xa0c
mov dword [ecx + eax + 0x33c0], 0xffffffff
add dword [eax + 0x33a8], edx
mov eax, dword [edi + 0x5fc]
mov ecx, dword [eax + 0x33a8]
cmp ecx, 2
jg 0x406212
imul ecx, ecx, 0xa0c
mov edx, 1
mov dword [ecx + eax + 0x33b8], edx
mov ecx, dword [eax + 0x33a8]
imul ecx, ecx, 0xa0c
mov dword [ecx + eax + 0x33c0], 0xffffffff
add dword [eax + 0x33a8], edx
mov ebx, dword [esp + 0x18]
add edi, 0x7f8
push ebx
call fcn.0040a8f0
mov esi, ebx
call fcn.0040cb40
push 0x4ad
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x40623c
mov eax, dword [eax + 0x20]
push str.ButtonStart
push eax
call sub.intf.dll_Ordinal_46
push 0x4ae
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x40625a
mov eax, dword [eax + 0x20]
push str.ButtonStartRecord
push eax
call sub.intf.dll_Ordinal_46
push 0x3ea
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x406278
mov eax, dword [eax + 0x20]
push str.ButtonStopRecord
push eax
call sub.intf.dll_Ordinal_46
push 0x4b8
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x406296
mov eax, dword [eax + 0x20]
push str.ButtonSnapShot
push eax
call sub.intf.dll_Ordinal_46
push 0x4af
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x4062b4
mov eax, dword [eax + 0x20]
push str.ButtonStop
push eax
call sub.intf.dll_Ordinal_46
push 0x40b
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x4062d2
mov eax, dword [eax + 0x20]
push str.ButtonAdd
push eax
call sub.intf.dll_Ordinal_46
push 0x4b0
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x4062f0
mov eax, dword [eax + 0x20]
push str.ButtonDelete
push eax
call sub.intf.dll_Ordinal_46
push 0x4b1
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x40630e
mov eax, dword [eax + 0x20]
push str.ButtonSetting
push eax
call sub.intf.dll_Ordinal_46
push 0x4b2
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x40632c
mov eax, dword [eax + 0x20]
push str.ButtonStart
push eax
call sub.intf.dll_Ordinal_46
push 0x4b3
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x40634a
mov eax, dword [eax + 0x20]
push str.ButtonFastPlay
push eax
call sub.intf.dll_Ordinal_46
push 0x4b5
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x406368
mov eax, dword [eax + 0x20]
push str.ButtonSlowPlay
push eax
call sub.intf.dll_Ordinal_46
push 0x4b4
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x406386
mov eax, dword [eax + 0x20]
push str.ButtonStop
push eax
call sub.intf.dll_Ordinal_46
push 0x4b6
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x4063a4
mov eax, dword [eax + 0x20]
push str.ButtonBakup
push eax
call sub.intf.dll_Ordinal_46
push 0x5e6
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x4063c2
mov eax, dword [eax + 0x20]
push str.ButtonPlayBackSnapshot
push eax
call sub.intf.dll_Ordinal_46
push 0x5f2
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x4063e0
mov eax, dword [eax + 0x20]
push str.ButtonPause
push eax
call sub.intf.dll_Ordinal_46
lea eax, [ebx + 0x3b0]
test eax, eax
je 0x4063f8
mov eax, dword [eax + 0x20]
push str.ButtonBackward
push eax
call sub.intf.dll_Ordinal_46
lea eax, [ebx + 0x404]
test eax, eax
je 0x406410
mov eax, dword [eax + 0x20]
push str.ButtonForward
push eax
call sub.intf.dll_Ordinal_46
lea eax, [ebx + 0xd4c]
test eax, eax
je 0x406428
mov eax, dword [eax + 0x20]
push str.ButtonFramePlay
push eax
call sub.intf.dll_Ordinal_46
lea eax, [ebx + 0xe9c]
test eax, eax
je 0x406440
mov eax, dword [eax + 0x20]
push str.ButtonAudio
push eax
call sub.intf.dll_Ordinal_46
push 0x56e
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 9
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406494
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push ecx
push 0x405
mov ecx, ebx
call fcn.0048093d
push 0x49a
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x4064b8
mov eax, dword [eax + 0x20]
push str.ButtonExit
push eax
call sub.intf.dll_Ordinal_46
push 0x4ce
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x4064d6
mov eax, dword [eax + 0x20]
push str.ButtonHelp
push eax
call sub.intf.dll_Ordinal_46
push 0x4d2
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x4064f4
mov eax, dword [eax + 0x20]
push str.CheckBoxLock
push eax
call sub.intf.dll_Ordinal_46
push 0x4d0
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x406512
mov eax, dword [eax + 0x20]
push str.CheckBoxConfig
push eax
call sub.intf.dll_Ordinal_46
push 0x4cc
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x406530
mov eax, dword [eax + 0x20]
push str.ButtonMinimize
push eax
call sub.intf.dll_Ordinal_46
push 0x4cf
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x40654e
mov eax, dword [eax + 0x20]
push str.CheckBoxPlayback
push eax
call sub.intf.dll_Ordinal_46
push 0x457
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x40656c
mov eax, dword [eax + 0x20]
push str.CheckBoxRealtime
push eax
call sub.intf.dll_Ordinal_46
push 0x5e8
mov ecx, ebx
call fcn.004808f5
test eax, eax
je 0x40658a
mov eax, dword [eax + 0x20]
push str.ButtonReturn
push eax
call sub.intf.dll_Ordinal_46
push 5
push 0x49a
mov ecx, ebx
call fcn.004808f5
mov ecx, eax
call fcn.00480ab6
push 5
push 0x62f
mov ecx, ebx
call fcn.004808f5
mov ecx, eax
call fcn.00480ab6
mov ecx, dword [ebx + 0x5fc]
push 5
call fcn.00480ab6
mov eax, dword [ebx + 0x5fc]
mov dword [eax + 0x48fc], 0xffffffff
cmp dword [eax + 0x3dc4], 0
je 0x406602
mov ecx, 1
cmp dword [eax + 0x33a4], ecx
je 0x406602
mov dword [eax + 0x33a4], ecx
mov dword [eax + 0x339c], 0
mov esi, dword [ebx + 0x5fc]
lea edi, [esi + 0x48e4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x48c8]
test eax, eax
jbe 0x406634
add eax, 0xffffffff
mov dword [esi + 0x48c8], eax
jne 0x406634
mov dword [esi + 0x33a0], 1
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 1
mov ecx, ebx
call fcn.00479374
mov edx, dword [ebx + 0x788]
mov eax, dword [edx + 0x134]
lea esi, [ebx + 0x788]
push 0
push ebx
mov ecx, esi
call eax
mov ecx, dword [ebx + 0x7a8]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 1
push 0x401
push ecx
call edi
push 0x16a
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 0xa
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4066be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push 0x4b2
mov ecx, ebx
call fcn.004808f5
push eax
mov ecx, esi
call fcn.00478e58
push 0x16b
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 0xb
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406724
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push 0x4b3
mov ecx, ebx
call fcn.004808f5
push eax
mov ecx, esi
call fcn.00478e58
push 0x16c
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 0xc
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40678a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push 0x4b5
mov ecx, ebx
call fcn.004808f5
push eax
mov ecx, esi
call fcn.00478e58
push 0x166
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 0xd
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4067f0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push 0x5f2
mov ecx, ebx
call fcn.004808f5
push eax
mov ecx, esi
call fcn.00478e58
push 0x16d
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 0xe
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406856
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push 0x4b4
mov ecx, ebx
call fcn.004808f5
push eax
mov ecx, esi
call fcn.00478e58
push 0x16f
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 0xf
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4068bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push 0x4b6
mov ecx, ebx
call fcn.004808f5
push eax
mov ecx, esi
call fcn.00478e58
push 0x210
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 0x10
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406922
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push 0x5e6
mov ecx, ebx
call fcn.004808f5
push eax
mov ecx, esi
call fcn.00478e58
push 0x170
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 0x11
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406988
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push 0x49a
mov ecx, ebx
call fcn.004808f5
push eax
mov ecx, esi
call fcn.00478e58
push 0x660
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 0x12
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4069ee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push 0x605
mov ecx, ebx
call fcn.004808f5
push eax
mov ecx, esi
call fcn.00478e58
push 0x661
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 0x13
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406a54
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push 0x604
mov ecx, ebx
call fcn.004808f5
push eax
mov ecx, esi
call fcn.00478e58
push 0x5497
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 0x14
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406aba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push 0x62e
mov ecx, ebx
call fcn.004808f5
push eax
mov ecx, esi
call fcn.00478e58
mov edx, dword [ebx + 0x7a8]
push 0x96
push 0
push 0x418
push edx
call edi
push 0x548a
lea eax, [esp + 0x1c]
push eax
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 0x15
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406b35
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push ecx
push 0x620
mov ecx, ebx
call fcn.0048093d
push 0x548f
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 0x16
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406b8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push ecx
push 0x621
mov ecx, ebx
call fcn.0048093d
push 0x5498
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 0x17
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406be9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push ecx
push 0x61d
mov ecx, ebx
call fcn.0048093d
push 0x17b
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xbc], 0x18
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406c43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push ecx
push 0x5de
mov ecx, ebx
call fcn.0048093d
push 0x548c
lea edx, [esp + 0x1c]
push edx
call fcn.0040ed80
lea ecx, [ebx + 0x520]
push eax
mov byte [esp + 0xbc], 0x19
call fcn.00404a60
mov byte [esp + 0xb8], 7
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406c9f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esi, [ebx + 0x528]
mov edi, ebx
mov ecx, esi
call fcn.0042a070
call fcn.0042a1f0
mov edi, esi
call fcn.0042a140
mov ecx, dword [esi + 0x20]
push 0x105
push 0
mov eax, 0xffffff
push 0
push ecx
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
call dword [sym.imp.USER32.dll_RedrawWindow]
mov eax, dword [ebx + 0x5bc]
mov ecx, dword [ebx + 0x5b8]
mov edx, 1
sub eax, 0xe
mov esi, edx
mov dword [esp + 0x28], edx
lea edx, [esp + 0x28]
mov dword [esp + 0x34], eax
push edx
lea eax, [ebx + 0x5a8]
sub ecx, 0xe
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], ecx
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x3e8
push 0x3d
push ecx
call esi
mov edx, dword [ebx + 0x20]
push 0
push 0x493e0
push 0x3e
push edx
call esi
mov eax, dword [ebx + 0x470]
mov ecx, dword [ebx + 0x46c]
push 0x40
push eax
push ecx
push 0
push 0
push 0
mov ecx, ebx
call fcn.00480cc5
mov byte [esp + 0xb8], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406d7c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb8], 0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406da4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xb8], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406dcf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00491285
mov esp, ebp
pop ebp
ret