Function at 0x47ec60
Capabilities:
Read .ini file
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x51dccb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b8
mov eax, dword [0x565e78]
push ebx
push ebp
mov ebp, dword [esp + 0x1d0]
push esi
mov esi, dword [esp + 0x1d8]
mov dword [esp + 0x1c0], eax
push edi
lea eax, [esp + 0x124]
push eax
mov ecx, 1
mov edx, 2
call fcn.004082e0
xor eax, eax
mov dword [esp + 0x1d0], eax
mov ecx, 0xf
mov dword [esp + 0x120], ecx
mov dword [esp + 0x11c], eax
mov byte [esp + 0x10c], al
mov dword [esp + 0x104], ecx
mov dword [esp + 0x100], eax
mov byte [esp + 0xf0], al
mov byte [esp + 0x1d0], 2
cmp dword [ebp + 0x144], eax
jne 0x47edcb
lea esp, [esp]
push str..dat
push esi
push str.img_room_show0layoutlayout
lea ecx, [esp + 0x130]
push 0x56b5e8
push ecx
call fcn.00408880
add esp, 8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00450530
push eax
call fcn.00408880
add esp, 8
lea ecx, [esp + 0xd0]
lea eax, [esp + 0x124]
call fcn.00408420
mov ecx, dword [eax + 0x18]
mov edi, 0x10
cmp ecx, edi
jb 0x47ed5c
mov eax, dword [eax + 4]
jmp 0x47ed5f
add eax, 4
push 0
push eax
call fcn.004b56c8
add esp, 8
cmp eax, 0xffffffff
mov eax, dword [esp + 0xe8]
sete bl
cmp eax, edi
jb 0x47ed8b
mov edx, dword [esp + 0xd4]
push edx
call fcn.004fa776
add esp, 4
test bl, bl
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
je 0x47eeda
mov dword [ebp + 0x144], 1
mov eax, dword [ebp + 0x144]
test eax, eax
je 0x47ed00
jmp 0x47edd0
mov edi, 0x10
push str..dat
push esi
push str.img_room_show1layoutlayout
lea eax, [esp + 0x130]
push 0x56b5e8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00450530
push eax
call fcn.00408880
add esp, 8
lea ecx, [esp + 0x20]
lea eax, [esp + 0x124]
call fcn.00408420
cmp dword [eax + 0x18], edi
jb 0x47ee22
mov eax, dword [eax + 4]
jmp 0x47ee25
add eax, 4
push 0
push eax
call fcn.004b56c8
add esp, 8
cmp eax, 0xffffffff
mov eax, dword [esp + 0x38]
sete bl
cmp eax, edi
jb 0x47ee4b
mov ecx, dword [esp + 0x24]
push ecx
call fcn.004fa776
add esp, 4
test bl, bl
je 0x47eeda
call fcn.004fa853
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov bl, 3
lea ecx, [esp + 0x20]
lea eax, [esp + 0x124]
mov byte [esp + 0x1d0], bl
call fcn.00408420
mov byte [esp + 0x1d0], 4
cmp dword [eax + 0x18], edi
jb 0x47ee91
mov eax, dword [eax + 4]
jmp 0x47ee94
add eax, 4
push eax
lea eax, [esp + 0x18]
push 0x545de0
push eax
call fcn.00405820
mov byte [esp + 0x1dc], bl
mov eax, dword [esp + 0x44]
add esp, 0xc
cmp eax, edi
jb 0x47eec3
mov ecx, dword [esp + 0x24]
push ecx
call fcn.004fa776
add esp, 4
mov edx, dword [esp + 0x14]
push 0
push 0
push edx
mov ecx, ebp
call fcn.004f7862
push 0
call fcn.004b626e
lea ecx, [esp + 0x20]
lea eax, [esp + 0x124]
call fcn.00408420
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x114]
mov byte [esp + 0x1dc], 5
call fcn.004018b0
mov byte [esp + 0x1d0], 2
cmp dword [esp + 0x38], edi
jb 0x47ef1e
mov eax, dword [esp + 0x24]
push eax
call fcn.004fa776
add esp, 4
push 6
push str.layout
lea ecx, [esp + 0xf4]
call fcn.00401b10
cmp dword [esp + 0x120], edi
mov ecx, dword [esp + 0x10c]
jae 0x47ef48
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], edi
mov eax, dword [esp + 0xf0]
jae 0x47ef5f
lea eax, [esp + 0xf0]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push ecx
push 4
push str.table_image
push eax
call esi
mov ecx, dword [esp + 0x10c]
mov ebx, eax
cmp dword [esp + 0x120], edi
mov dword [esp + 0x18], ebx
jae 0x47ef8d
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], edi
mov eax, dword [esp + 0xf0]
jae 0x47efa4
lea eax, [esp + 0xf0]
push ecx
push 4
push str.table_play_image
push eax
call esi
mov ecx, dword [esp + 0x10c]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x120], edi
jae 0x47efca
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], edi
mov eax, dword [esp + 0xf0]
jae 0x47efe1
lea eax, [esp + 0xf0]
push ecx
push 4
push str.table_rect_image
push eax
call esi
mov dword [esp + 0x1c], eax
cmp ebx, dword [ebp + 0x110]
jne 0x47f01d
lea ecx, [ebp + 0x308]
call fcn.004c7b00
cmp eax, 0xffffffff
je 0x47f01d
mov al, byte [esp + 0x1e0]
test al, al
je 0x47fd04
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea edi, [ebp + 0x308]
mov ecx, edi
call fcn.004c7b00
cmp eax, 0xffffffff
je 0x47f048
lea ecx, [ebp + 0x54]
call fcn.004c7a50
mov ecx, edi
mov ebx, eax
call fcn.004c7b00
push eax
mov ecx, ebx
call fcn.004cab50
lea edi, [ebp + 0x340]
mov ecx, edi
call fcn.004c7b00
cmp eax, 0xffffffff
je 0x47f073
lea ecx, [ebp + 0x54]
call fcn.004c7a50
mov ecx, edi
mov ebx, eax
call fcn.004c7b00
push eax
mov ecx, ebx
call fcn.004cab50
lea edi, [ebp + 0x298]
mov ecx, edi
call fcn.004c7b00
cmp eax, 0xffffffff
je 0x47f09e
lea ecx, [ebp + 0x54]
call fcn.004c7a50
mov ecx, edi
mov ebx, eax
call fcn.004c7b00
push eax
mov ecx, ebx
call fcn.004cab50
lea edi, [ebp + 0x378]
mov ecx, edi
call fcn.004c7b00
cmp eax, 0xffffffff
je 0x47f0c9
lea ecx, [ebp + 0x54]
call fcn.004c7a50
mov ecx, edi
mov ebx, eax
call fcn.004c7b00
push eax
mov ecx, ebx
call fcn.004cab50
mov eax, dword [ebp + 0x144]
test eax, eax
lea ecx, [esp + 0x14]
push 0x56b5e8
jne 0x47f625
call fcn.00402030
push 0x20
push str.img_room_show0_tables_table.ini
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1d8], 6
call fcn.00401a20
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1dc]
push ecx
push 0
push 0xa
lea edx, [esp + 0x1b0]
push edx
push eax
call fcn.004b4957
add esp, 0xc
push eax
push 0x545d7c
call esi
mov edi, eax
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
lea esi, [esp + 0x128]
mov byte [esp + 0x1d0], 7
call fcn.0040b140
mov eax, dword [esp + 0x168]
push 0
lea ecx, [esp + 0xd8]
push ecx
mov ebx, esi
call fcn.0040b2e0
mov byte [esp + 0x1d0], 6
mov eax, dword [esp + 0xe8]
mov ebx, 0x10
cmp eax, ebx
jb 0x47f19a
mov edx, dword [esp + 0xd4]
push edx
call fcn.004fa776
add esp, 4
push str..png
push edi
push str.img_room_bg_bg
lea eax, [esp + 0x130]
push 0x56b5e8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00450530
push eax
call fcn.00408880
add esp, 8
lea ecx, [esp + 0x20]
lea eax, [esp + 0x124]
call fcn.00408420
mov esi, eax
lea edi, [ebp + 0x54]
mov ecx, edi
mov byte [esp + 0x1d0], 8
call fcn.004c7a50
mov edx, dword [eax]
push 0
push 1
push 0
push esi
mov ecx, eax
call dword [edx + 0x10]
push eax
lea ecx, [ebp + 0x298]
call fcn.004c8300
mov byte [esp + 0x1d0], 6
cmp dword [esp + 0x38], ebx
jb 0x47f22b
mov eax, dword [esp + 0x24]
push eax
call fcn.004fa776
add esp, 4
push 1
lea ecx, [ebp + 0x298]
call fcn.004c7e00
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
lea esi, [esp + 0x128]
mov byte [esp + 0x1d0], 9
call fcn.0040b140
mov eax, dword [esp + 0x168]
push 0
lea ecx, [esp + 0xd8]
push ecx
mov ebx, esi
call fcn.0040b2e0
mov byte [esp + 0x1d0], 6
mov eax, dword [esp + 0xe8]
mov ebx, 0x10
cmp eax, ebx
jb 0x47f2aa
mov edx, dword [esp + 0xd4]
push edx
call fcn.004fa776
add esp, 4
mov eax, dword [esp + 0x18]
push str..png
push eax
push str.img_room_show0_tables_table
lea ecx, [esp + 0x130]
push 0x56b5e8
push ecx
call fcn.00408880
add esp, 8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00450530
push eax
call fcn.00408880
add esp, 8
lea ecx, [esp + 0x20]
lea eax, [esp + 0x124]
call fcn.00408420
mov esi, eax
mov ecx, edi
mov byte [esp + 0x1d0], 0xa
call fcn.004c7a50
mov edx, dword [eax]
push 1
push 1
push 0
push esi
mov ecx, eax
call dword [edx + 0x10]
push eax
lea ecx, [ebp + 0x308]
call fcn.004c8300
cmp dword [esp + 0x38], ebx
jb 0x47f334
mov eax, dword [esp + 0x24]
push eax
call fcn.004fa776
add esp, 4
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
lea esi, [esp + 0x128]
mov byte [esp + 0x1d0], 0xb
call fcn.0040b140
mov eax, dword [esp + 0x168]
push 0
lea ecx, [esp + 0xd8]
push ecx
mov ebx, esi
call fcn.0040b2e0
mov byte [esp + 0x1d0], 6
mov eax, dword [esp + 0xe8]
mov ebx, 0x10
cmp eax, ebx
jb 0x47f3a6
mov edx, dword [esp + 0xd4]
push edx
call fcn.004fa776
add esp, 4
mov eax, dword [esp + 0x10]
push str.play.png
push eax
push str.img_room_show0_tables_table
lea ecx, [esp + 0x130]
push 0x56b5e8
push ecx
call fcn.00408880
add esp, 8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00450530
push eax
call fcn.00408880
add esp, 8
lea ecx, [esp + 0x20]
lea eax, [esp + 0x124]
call fcn.00408420
mov esi, eax
mov ecx, edi
mov byte [esp + 0x1d0], 0xc
call fcn.004c7a50
mov edx, dword [eax]
push 1
push 1
push 0
push esi
mov ecx, eax
call dword [edx + 0x10]
push eax
lea ecx, [ebp + 0x340]
call fcn.004c8300
cmp dword [esp + 0x38], ebx
jb 0x47f430
mov eax, dword [esp + 0x24]
push eax
call fcn.004fa776
add esp, 4
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
lea esi, [esp + 0x128]
mov byte [esp + 0x1d0], 0xd
call fcn.0040b140
mov eax, dword [esp + 0x168]
push 0
lea ecx, [esp + 0xd8]
push ecx
mov ebx, esi
call fcn.0040b2e0
mov byte [esp + 0x1d0], 6
mov eax, dword [esp + 0xe8]
mov ebx, 0x10
cmp eax, ebx
jb 0x47f4a2
mov edx, dword [esp + 0xd4]
push edx
call fcn.004fa776
add esp, 4
mov eax, dword [esp + 0x1c]
push str.goto.bmp
push eax
push str.img_room_show0_tables_table
lea ecx, [esp + 0x130]
push 0x56b5e8
push ecx
call fcn.00408880
add esp, 8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00450530
push eax
call fcn.00408880
add esp, 8
lea ecx, [esp + 0x20]
lea eax, [esp + 0x124]
call fcn.00408420
mov esi, eax
mov ecx, edi
mov byte [esp + 0x1d0], 0xe
call fcn.004c7a50
mov edx, dword [eax]
push 1
push 1
push 0
push esi
mov ecx, eax
call dword [edx + 0x10]
push eax
lea ecx, [ebp + 0x3b0]
call fcn.004c8300
cmp dword [esp + 0x38], ebx
jb 0x47f52c
mov eax, dword [esp + 0x24]
push eax
call fcn.004fa776
add esp, 4
mov eax, 0xf
mov dword [esp + 0xe8], eax
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
lea esi, [esp + 0x128]
mov byte [esp + 0x1d0], al
call fcn.0040b140
mov eax, dword [esp + 0x168]
push 0
lea ecx, [esp + 0xd8]
push ecx
mov ebx, esi
call fcn.0040b2e0
mov byte [esp + 0x1d0], 6
mov eax, dword [esp + 0xe8]
mov ebx, 0x10
cmp eax, ebx
jb 0x47f59e
mov edx, dword [esp + 0xd4]
push edx
call fcn.004fa776
add esp, 4
mov eax, dword [esp + 0x1c]
push str.rect.bmp
push eax
push str.img_room_show0_tables_table
lea ecx, [esp + 0x130]
push 0x56b5e8
push ecx
call fcn.00408880
add esp, 8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00450530
push eax
call fcn.00408880
add esp, 8
lea ecx, [esp + 0x20]
lea eax, [esp + 0x124]
call fcn.00408420
mov esi, eax
mov ecx, edi
mov byte [esp + 0x1d0], bl
call fcn.004c7a50
mov edx, dword [eax]
push 1
push 1
push 0
push esi
mov ecx, eax
call dword [edx + 0x10]
push eax
lea ecx, [ebp + 0x378]
call fcn.004c8300
mov byte [esp + 0x1d0], 6
cmp dword [esp + 0x38], ebx
jmp 0x47fb5c
call fcn.00402030
push 0x20
push str.img_room_show1_tables_table.ini
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1d8], 0x11
call fcn.00401a20
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1dc]
push eax
push 0
push 0xa
lea ecx, [esp + 0x1b0]
push ecx
push edx
call fcn.004b4957
add esp, 0xc
push eax
push 0x545d7c
call esi
mov edi, eax
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
lea esi, [esp + 0x128]
mov byte [esp + 0x1d0], 0x12
call fcn.0040b140
push 0
lea eax, [esp + 0xd8]
push eax
mov eax, dword [esp + 0x170]
mov ebx, esi
call fcn.0040b2e0
mov bl, 0x11
mov byte [esp + 0x1d0], bl
cmp dword [esp + 0xe8], 0x10
jb 0x47f6da
mov ecx, dword [esp + 0xd4]
push ecx
call fcn.004fa776
add esp, 4
push str..png
push edi
push str.img_room_bg_bg
lea edx, [esp + 0x130]
push 0x56b5e8
push edx
call fcn.00408880
add esp, 8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00450530
push eax
call fcn.00408880
add esp, 8
lea ecx, [esp + 0x20]
lea eax, [esp + 0x124]
call fcn.00408420
mov esi, eax
lea edi, [ebp + 0x54]
mov ecx, edi
mov byte [esp + 0x1d0], 0x13
call fcn.004c7a50
mov edx, dword [eax]
push 0
push 1
push 0
push esi
mov ecx, eax
call dword [edx + 0x10]
push eax
lea ecx, [ebp + 0x298]
call fcn.004c8300
mov byte [esp + 0x1d0], bl
cmp dword [esp + 0x38], 0x10
jb 0x47f76b
mov eax, dword [esp + 0x24]
push eax
call fcn.004fa776
add esp, 4
push 1
lea ecx, [ebp + 0x298]
call fcn.004c7e00
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
lea esi, [esp + 0x128]
mov byte [esp + 0x1d0], 0x14
call fcn.0040b140
mov eax, dword [esp + 0x168]
push 0
lea ecx, [esp + 0xd8]
push ecx
mov ebx, esi
call fcn.0040b2e0
mov byte [esp + 0x1d0], 0x11
mov eax, dword [esp + 0xe8]
mov ebx, 0x10
cmp eax, ebx
jb 0x47f7ea
mov edx, dword [esp + 0xd4]
push edx
call fcn.004fa776
add esp, 4
mov eax, dword [esp + 0x18]
push str..png
push eax
push str.img_room_show1_tables_table
lea ecx, [esp + 0x130]
push 0x56b5e8
push ecx
call fcn.00408880
add esp, 8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00450530
push eax
call fcn.00408880
add esp, 8
lea ecx, [esp + 0x20]
lea eax, [esp + 0x124]
call fcn.00408420
mov esi, eax
mov ecx, edi
mov byte [esp + 0x1d0], 0x15
call fcn.004c7a50
mov edx, dword [eax]
push 1
push 1
push 0
push esi
mov ecx, eax
call dword [edx + 0x10]
push eax
lea ecx, [ebp + 0x308]
call fcn.004c8300
cmp dword [esp + 0x38], ebx
jb 0x47f874
mov eax, dword [esp + 0x24]
push eax
call fcn.004fa776
add esp, 4
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
lea esi, [esp + 0x128]
mov byte [esp + 0x1d0], 0x16
call fcn.0040b140
mov eax, dword [esp + 0x168]
push 0
lea ecx, [esp + 0xd8]
push ecx
mov ebx, esi
call fcn.0040b2e0
mov byte [esp + 0x1d0], 0x11
mov eax, dword [esp + 0xe8]
mov ebx, 0x10
cmp eax, ebx
jb 0x47f8e6
mov edx, dword [esp + 0xd4]
push edx
call fcn.004fa776
add esp, 4
mov eax, dword [esp + 0x10]
push str.play.png
push eax
push str.img_room_show1_tables_table
lea ecx, [esp + 0x130]
push 0x56b5e8
push ecx
call fcn.00408880
add esp, 8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00450530
push eax
call fcn.00408880
add esp, 8
lea ecx, [esp + 0x20]
lea eax, [esp + 0x124]
call fcn.00408420
mov esi, eax
mov ecx, edi
mov byte [esp + 0x1d0], 0x17
call fcn.004c7a50
mov edx, dword [eax]
push 1
push 1
push 0
push esi
mov ecx, eax
call dword [edx + 0x10]
push eax
lea ecx, [ebp + 0x340]
call fcn.004c8300
cmp dword [esp + 0x38], ebx
jb 0x47f970
mov eax, dword [esp + 0x24]
push eax
call fcn.004fa776
add esp, 4
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
lea esi, [esp + 0x128]
mov byte [esp + 0x1d0], 0x18
call fcn.0040b140
mov eax, dword [esp + 0x168]
push 0
lea ecx, [esp + 0xd8]
push ecx
mov ebx, esi
call fcn.0040b2e0
mov byte [esp + 0x1d0], 0x11
mov eax, dword [esp + 0xe8]
mov ebx, 0x10
cmp eax, ebx
jb 0x47f9e2
mov edx, dword [esp + 0xd4]
push edx
call fcn.004fa776
add esp, 4
mov eax, dword [esp + 0x1c]
push str.goto.bmp
push eax
push str.img_room_show1_tables_table
lea ecx, [esp + 0x130]
push 0x56b5e8
push ecx
call fcn.00408880
add esp, 8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00450530
push eax
call fcn.00408880
add esp, 8
lea ecx, [esp + 0x20]
lea eax, [esp + 0x124]
call fcn.00408420
mov esi, eax
mov ecx, edi
mov byte [esp + 0x1d0], 0x19
call fcn.004c7a50
mov edx, dword [eax]
push 1
push 1
push 0
push esi
mov ecx, eax
call dword [edx + 0x10]
push eax
lea ecx, [ebp + 0x3b0]
call fcn.004c8300
cmp dword [esp + 0x38], ebx
jb 0x47fa6c
mov eax, dword [esp + 0x24]
push eax
call fcn.004fa776
add esp, 4
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
lea esi, [esp + 0x128]
mov byte [esp + 0x1d0], 0x1a
call fcn.0040b140
mov eax, dword [esp + 0x168]
push 0
lea ecx, [esp + 0xd8]
push ecx
mov ebx, esi
call fcn.0040b2e0
mov bl, 0x11
mov byte [esp + 0x1d0], bl
cmp dword [esp + 0xe8], 0x10
jb 0x47fad9
mov edx, dword [esp + 0xd4]
push edx
call fcn.004fa776
add esp, 4
mov eax, dword [esp + 0x1c]
push str.rect.bmp
push eax
push str.img_room_show1_tables_table
lea ecx, [esp + 0x130]
push 0x56b5e8
push ecx
call fcn.00408880
add esp, 8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00450530
push eax
call fcn.00408880
add esp, 8
lea ecx, [esp + 0x20]
lea eax, [esp + 0x124]
call fcn.00408420
mov esi, eax
mov ecx, edi
mov byte [esp + 0x1d0], 0x1b
call fcn.004c7a50
mov edx, dword [eax]
push 1
push 1
push 0
push esi
mov ecx, eax
call dword [edx + 0x10]
push eax
lea ecx, [ebp + 0x378]
call fcn.004c8300
mov byte [esp + 0x1d0], bl
cmp dword [esp + 0x38], 0x10
jb 0x47fb6b
mov eax, dword [esp + 0x24]
push eax
call fcn.004fa776
add esp, 4
mov ecx, dword [esp + 0x18]
mov dword [ebp + 0x110], ecx
lea ecx, [ebp + 0x308]
call fcn.004c7b10
lea ecx, [ebp + 0x340]
mov dword [eax], 3
call fcn.004c7b10
mov byte [esp + 0x1d0], 2
mov dword [eax], 3
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x47fbbd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov al, byte [ebp + 0x784]
test al, al
je 0x47fd04
lea eax, [esp + 0x50]
push eax
mov ecx, 1
mov edx, 2
call fcn.004082e0
xor ebx, ebx
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], ebx
mov byte [esp + 0xd4], bl
lea esi, [esp + 0x54]
mov byte [esp + 0x1d0], 0x1d
call fcn.0040b140
mov eax, dword [esp + 0x94]
push ebx
lea ecx, [esp + 0xd8]
push ecx
mov ebx, esi
call fcn.0040b2e0
mov bl, 0x1c
mov byte [esp + 0x1d0], bl
cmp dword [esp + 0xe8], 0x10
jb 0x47fc45
mov edx, dword [esp + 0xd4]
push edx
call fcn.004fa776
add esp, 4
push str..png
push 3
push str.img_room_bg_bg
lea eax, [esp + 0x5c]
push 0x56b5e8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00408880
add esp, 8
push eax
call fcn.00450530
push eax
call fcn.00408880
add esp, 8
lea ecx, [esp + 0x20]
lea eax, [esp + 0x50]
call fcn.00408420
mov esi, eax
mov ecx, edi
mov byte [esp + 0x1d0], 0x1e
call fcn.004c7a50
mov edx, dword [eax]
push 0
push 1
push 0
push esi
mov ecx, eax
call dword [edx + 0x10]
lea esi, [ebp + 0x298]
push eax
mov ecx, esi
call fcn.004c8300
mov byte [esp + 0x1d0], bl
cmp dword [esp + 0x38], 0x10
jb 0x47fcd0
mov eax, dword [esp + 0x24]
push eax
call fcn.004fa776
add esp, 4
push 1
mov ecx, esi
call fcn.004c7e00
lea ecx, [esp + 0x9c]
mov byte [esp + 0x1d0], 2
call fcn.004083b0
lea ecx, [esp + 0x9c]
mov dword [esp + 0x9c], 0x53cee8
call fcn.004c6d90
lea ecx, [ebp + 0x308]
call fcn.004c7b00
cmp eax, 0xffffffff
je 0x47fd44
lea ecx, [ebp + 0x340]
call fcn.004c7b00
cmp eax, 0xffffffff
je 0x47fd44
lea ecx, [ebp + 0x298]
call fcn.004c7b00
cmp eax, 0xffffffff
je 0x47fd44
lea ecx, [ebp + 0x378]
call fcn.004c7b00
cmp eax, 0xffffffff
jne 0x47fd5d
mov edi, 0x10
push edi
push 0x545ccc
push 0x545cb4
mov ecx, ebp
call fcn.004f7862
jmp 0x47fd62
mov edi, 0x10
cmp dword [esp + 0x120], edi
mov ecx, dword [esp + 0x10c]
jae 0x47fd79
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], edi
mov eax, dword [esp + 0xf0]
jae 0x47fd90
lea eax, [esp + 0xf0]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push ecx
push 0
push str.x_pitch_min
push eax
call esi
mov ecx, dword [esp + 0x10c]
mov dword [ebp + 0x114], eax
cmp dword [esp + 0x120], edi
jae 0x47fdbe
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], edi
mov eax, dword [esp + 0xf0]
jae 0x47fdd5
lea eax, [esp + 0xf0]
push ecx
push 0
push str.y_pitch
push eax
call esi
mov ecx, dword [esp + 0x10c]
mov dword [ebp + 0x118], eax
cmp dword [esp + 0x120], edi
jae 0x47fdfd
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], edi
mov eax, dword [esp + 0xf0]
jae 0x47fe14
lea eax, [esp + 0xf0]
push ecx
push 0
push str.ready_btn_x
push eax
call esi
mov ecx, dword [esp + 0x10c]
mov dword [ebp + 0x11c], eax
cmp dword [esp + 0x120], edi
jae 0x47fe3c
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], edi
mov eax, dword [esp + 0xf0]
jae 0x47fe53
lea eax, [esp + 0xf0]
push ecx
push 0
push str.ready_btn_y
push eax
call esi
mov ecx, dword [esp + 0x10c]
mov dword [ebp + 0x120], eax
cmp dword [esp + 0x120], edi
jae 0x47fe7b
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], edi
mov eax, dword [esp + 0xf0]
jae 0x47fe92
lea eax, [esp + 0xf0]
push ecx
push 0
push str.lock_x
push eax
call esi
mov ecx, dword [esp + 0x10c]
mov dword [ebp + 0x124], eax
cmp dword [esp + 0x120], edi
jae 0x47feba
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], edi
mov eax, dword [esp + 0xf0]
jae 0x47fed1
lea eax, [esp + 0xf0]
push ecx
push 0
push str.lock_y
push eax
call esi
mov ecx, dword [esp + 0x10c]
mov dword [ebp + 0x128], eax
cmp dword [esp + 0x120], edi
jae 0x47fef9
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], edi
mov eax, dword [esp + 0xf0]
jae 0x47ff10
lea eax, [esp + 0xf0]
push ecx
push 0
push str.seat_count
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x18], ebx
call fcn.004c9520
sub esp, 0x30
mov edi, esp
mov ecx, 0xc
lea esi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp + 0x134]
mov eax, ebx
call fcn.00483b90
test ebx, ebx
mov dword [esp + 0x14], 0
jle 0x480474
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor esi, esi
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
mov byte [esp + 0x1d0], 0x1f
test byte [esp + 0x168], 1
je 0x47ffa5
mov ecx, dword [esp + 0x138]
mov eax, dword [ecx]
push eax
call fcn.004fa776
add esp, 4
mov edx, dword [esp + 0x138]
mov dword [edx], 0
mov eax, dword [esp + 0x148]
mov dword [eax], 0
mov ecx, dword [esp + 0x158]
mov dword [ecx], 0
mov edx, dword [esp + 0x13c]
mov dword [edx], 0
mov eax, dword [esp + 0x14c]
mov dword [eax], 0
mov ecx, dword [esp + 0x15c]
mov dword [ecx], 0
mov eax, dword [esp + 0x168]
push 0
lea edx, [esp + 0xd8]
and eax, 0xfffffffe
push edx
lea ebx, [esp + 0x130]
mov dword [esp + 0x16c], 0
mov dword [esp + 0x170], eax
call fcn.0040b2e0
mov byte [esp + 0x1d0], 2
mov eax, dword [esp + 0xe8]
mov ebx, 0x10
cmp eax, ebx
jb 0x48004d
mov eax, dword [esp + 0xd4]
push eax
call fcn.004fa776
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x128]
push str.seat
push edx
mov dword [esp + 0xf4], 0xf
mov dword [esp + 0xf0], 0
mov byte [esp + 0xe0], 0
call fcn.00408880
add esp, 8
push eax
call fcn.00450530
lea ecx, [esp + 0x20]
lea eax, [esp + 0x124]
call fcn.00408420
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0xf8]
mov byte [esp + 0x1dc], 0x20
call fcn.004018b0
cmp dword [esp + 0x38], ebx
jb 0x4800c7
mov eax, dword [esp + 0x24]
push eax
call fcn.004fa776
add esp, 4
cmp dword [esp + 0x120], ebx
mov ecx, dword [esp + 0x10c]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
jae 0x4800f3
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], ebx
mov eax, dword [esp + 0xf0]
jae 0x48010a
lea eax, [esp + 0xf0]
mov edx, dword [ebp + 0x138]
push ecx
push 0
push str.player_x
push eax
mov dword [esp + 0x20], edx
call edi
mov ecx, dword [esp + 0x10]
mov dword [ecx + esi], eax
cmp dword [esp + 0x120], ebx
mov ecx, dword [esp + 0x10c]
jae 0x48013d
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], ebx
mov eax, dword [esp + 0xf0]
jae 0x480154
lea eax, [esp + 0xf0]
mov edx, dword [ebp + 0x138]
push ecx
push 0
push str.player_y
push eax
mov dword [esp + 0x20], edx
call edi
mov ecx, dword [esp + 0x10]
mov dword [ecx + esi + 4], eax
cmp dword [esp + 0x120], ebx
mov ecx, dword [esp + 0x10c]
jae 0x480188
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], ebx
mov eax, dword [esp + 0xf0]
jae 0x48019f
lea eax, [esp + 0xf0]
mov edx, dword [ebp + 0x138]
push ecx
push 0
push str.name_x
push eax
mov dword [esp + 0x20], edx
call edi
mov ecx, dword [esp + 0x10]
mov dword [ecx + esi + 8], eax
cmp dword [esp + 0x120], ebx
mov ecx, dword [esp + 0x10c]
jae 0x4801d3
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], ebx
mov eax, dword [esp + 0xf0]
jae 0x4801ea
lea eax, [esp + 0xf0]
mov edx, dword [ebp + 0x138]
push ecx
push 0
push str.name_y
push eax
mov dword [esp + 0x20], edx
call edi
mov ecx, dword [esp + 0x10]
mov dword [ecx + esi + 0xc], eax
cmp dword [esp + 0x120], ebx
mov ecx, dword [esp + 0x10c]
jae 0x48021e
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], ebx
mov eax, dword [esp + 0xf0]
jae 0x480235
lea eax, [esp + 0xf0]
mov edx, dword [ebp + 0x138]
push ecx
push 0
push str.ready_x
push eax
mov dword [esp + 0x20], edx
call edi
mov ecx, dword [esp + 0x10]
mov dword [ecx + esi + 0x10], eax
cmp dword [esp + 0x120], ebx
mov ecx, dword [esp + 0x10c]
jae 0x480269
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], ebx
mov eax, dword [esp + 0xf0]
jae 0x480280
lea eax, [esp + 0xf0]
mov edx, dword [ebp + 0x138]
push ecx
push 0
push str.ready_y
push eax
mov dword [esp + 0x20], edx
call edi
mov ecx, dword [esp + 0x10]
mov dword [ecx + esi + 0x14], eax
cmp dword [esp + 0x120], ebx
mov ecx, dword [esp + 0x10c]
jae 0x4802b4
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], ebx
mov eax, dword [esp + 0xf0]
jae 0x4802cb
lea eax, [esp + 0xf0]
mov edx, dword [ebp + 0x138]
push ecx
push 0
push str.dress_sub_image
push eax
mov dword [esp + 0x20], edx
call edi
mov ecx, dword [esp + 0x10]
mov dword [ecx + esi + 0x18], eax
cmp dword [esp + 0x120], ebx
mov ecx, dword [esp + 0x10c]
jae 0x4802ff
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], ebx
mov eax, dword [esp + 0xf0]
jae 0x480316
lea eax, [esp + 0xf0]
mov edx, dword [ebp + 0x138]
push ecx
push 0
push str.front
push eax
mov dword [esp + 0x20], edx
call edi
mov ecx, dword [esp + 0x10]
test eax, eax
setne al
mov byte [ecx + esi + 0x1c], al
cmp dword [esp + 0x120], ebx
mov ecx, dword [esp + 0x10c]
jae 0x48034f
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], ebx
mov eax, dword [esp + 0xf0]
jae 0x480366
lea eax, [esp + 0xf0]
mov edx, dword [ebp + 0x138]
push ecx
push 0
push str.bound_left
push eax
mov dword [esp + 0x20], edx
call edi
mov ecx, dword [esp + 0x10]
mov dword [ecx + esi + 0x20], eax
cmp dword [esp + 0x120], ebx
mov ecx, dword [esp + 0x10c]
jae 0x48039a
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], ebx
mov eax, dword [esp + 0xf0]
jae 0x4803b1
lea eax, [esp + 0xf0]
mov edx, dword [ebp + 0x138]
push ecx
push 0
push str.bound_top
push eax
mov dword [esp + 0x20], edx
call edi
mov ecx, dword [esp + 0x10]
mov dword [ecx + esi + 0x24], eax
cmp dword [esp + 0x120], ebx
mov ecx, dword [esp + 0x10c]
jae 0x4803e5
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], ebx
mov eax, dword [esp + 0xf0]
jae 0x4803fc
lea eax, [esp + 0xf0]
mov edx, dword [ebp + 0x138]
push ecx
push 0
push str.bound_right
push eax
mov dword [esp + 0x20], edx
call edi
mov ecx, dword [esp + 0x10]
mov dword [ecx + esi + 0x28], eax
cmp dword [esp + 0x120], ebx
mov ecx, dword [esp + 0x10c]
jae 0x480430
lea ecx, [esp + 0x10c]
cmp dword [esp + 0x104], ebx
mov eax, dword [esp + 0xf0]
jae 0x480447
lea eax, [esp + 0xf0]
mov ebx, dword [ebp + 0x138]
push ecx
push 0
push str.bound_bottom
push eax
call edi
mov ecx, dword [esp + 0x18]
mov dword [ebx + esi + 0x2c], eax
mov eax, dword [esp + 0x14]
inc eax
add esi, 0x30
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x47ff63
mov eax, dword [esp + 0x104]
mov ebx, 0x10
cmp eax, ebx
jb 0x480494
mov edx, dword [esp + 0xf0]
push edx
call fcn.004fa776
add esp, 4
mov eax, dword [esp + 0x120]
xor edi, edi
cmp eax, ebx
mov esi, 0xf
mov dword [esp + 0x104], esi
mov dword [esp + 0x100], edi
mov byte [esp + 0xf0], 0
jb 0x4804cc
mov eax, dword [esp + 0x10c]
push eax
call fcn.004fa776
add esp, 4
lea ecx, [esp + 0x170]
mov dword [esp + 0x120], esi
mov dword [esp + 0x11c], edi
mov byte [esp + 0x10c], 0
mov dword [esp + 0x1d0], 0xffffffff
call fcn.004083b0
lea ecx, [esp + 0x170]
mov dword [esp + 0x170], 0x53cee8
call fcn.004c6d90
mov ecx, dword [esp + 0x1c8]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x1c4]
call fcn.004b6cac
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c4
ret 0xc