Function at 0x407230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x450c50
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x461cb4]
xor eax, esp
push eax
lea eax, [esp + 0x160]
mov dword fs:[0], eax
mov edi, dword [esp + 0x170]
mov ebp, edi
imul ebp, ebp, 0xf3
mov eax, dword [ebp + 0x4664fe]
push 0x4567b0
push eax
mov dword [ebp + 0x466485], 0x1c03
call fcn.00433544
xor ebx, ebx
add esp, 8
cmp eax, ebx
sete al
test al, al
je 0x4072a0
mov byte [ebp + 0x4664a1], bl
jmp 0x40a565
mov esi, dword [ebp + 0x466491]
mov eax, dword [esi]
mov edx, dword [eax + 0x50]
lea ecx, [esp + 0x38]
push ecx
push 0x52
push esi
mov dword [esp + 0x50], ebx
mov dword [esp + 0x44], ebx
call edx
cmp eax, ebx
jge 0x4072cd
push 0x4582d4
push esi
push eax
call fcn.0044a580
or ebx, 0xffffffff
cmp edi, ebx
jne 0x4072db
push 0xc8
jmp 0x407302
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0xc7
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0xc8
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x4567b8
call fcn.0041ed40
mov dword [esp + 0x16c], 0
mov eax, dword [ebp + 0x466499]
push ecx
lea esi, [ebp + 0x466499]
sub eax, 0x10
mov dword [esp + 0x48], esp
mov edi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov dword [esp + 0x170], ebx
call fcn.0041af00
add esp, 8
cmp dword [ebp + 0x46653a], 1
jne 0x40772e
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x4567c4
call fcn.0041ed40
mov dword [esp + 0x16c], 1
mov eax, dword [esi]
push ecx
sub eax, 0x10
mov dword [esp + 0x48], esp
mov edi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov dword [esp + 0x170], ebx
call fcn.0041af00
mov eax, dword [esp + 0x178]
add esp, 8
mov edi, 0x12c
call fcn.004071e0
mov edi, dword [ebp + 0x466491]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x7c]
lea edx, [esp + 0x38]
push edx
push 0x26
push 0x6a
push edi
mov dword [esp + 0x48], 0
call eax
test eax, eax
jge 0x4073e9
push 0x4582d4
push edi
push eax
call fcn.0044a580
mov eax, dword [esp + 0x170]
mov edi, 0x12c
call fcn.004071e0
mov edi, dword [ebp + 0x466491]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x5c]
lea edx, [esp + 0x38]
push edx
push edi
mov dword [esp + 0x40], 0
call eax
test eax, eax
jge 0x407425
push 0x4582d4
push edi
push eax
call fcn.0044a580
mov eax, dword [esp + 0x170]
mov edi, 0x12c
call fcn.004071e0
cmp dword [ebp + 0x466506], 1
jne 0x40757a
fld qword [0x458458]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x44], esp
push ecx
mov ecx, esp
mov dword [esp + 0x54], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov dword [esp + 0x17c], 2
mov ebx, esp
mov dword [esp + 0x54], esp
push str.xp_boss.bmp
call fcn.00401260
push 0x300
push 0x400
push 0
push 0
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x190], 0xffffffff
mov ecx, dword [ebp + 0x466491]
call fcn.00401940
mov dword [esp + 0x168], 3
mov edx, dword [esp + 0x20]
push ecx
mov eax, esp
mov dword [eax], edx
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0x1c], esp
je 0x4074dc
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [esp + 0x28]
push eax
call fcn.00412cc0
add esp, 8
cmp dword [esp + 0x24], 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jle 0x407534
push 0x4567e8
call fcn.0041ed40
push ecx
mov byte [esp + 0x170], 4
mov ecx, esp
mov dword [esp + 0x3c], esp
push esi
call fcn.0041ed20
mov byte [esp + 0x170], 3
call fcn.0041af00
mov eax, dword [esp + 0x178]
add esp, 8
call fcn.0041b330
jmp 0x407563
push 0x4567f4
call fcn.0041ed40
push ecx
mov byte [esp + 0x170], 5
mov ecx, esp
mov dword [esp + 0x3c], esp
push esi
call fcn.0041ed20
mov byte [esp + 0x170], 3
call fcn.0041af00
add esp, 8
lea edi, [esp + 0x20]
mov dword [esp + 0x168], 0xffffffff
call fcn.00401370
or ebx, 0xffffffff
cmp dword [ebp + 0x466506], 2
jne 0x4076be
fld qword [0x458458]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x44], esp
push ecx
mov ecx, esp
mov dword [esp + 0x54], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov dword [esp + 0x17c], 6
mov ebx, esp
mov dword [esp + 0x54], esp
push str.w7_boss.bmp
call fcn.00401260
push 0x300
push 0x400
push 0
push 0
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x190], 0xffffffff
mov ecx, dword [ebp + 0x466491]
call fcn.00401940
mov dword [esp + 0x168], 7
mov edx, dword [esp + 0x20]
push ecx
mov eax, esp
mov dword [eax], edx
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0x1c], esp
je 0x407620
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [esp + 0x28]
push eax
call fcn.00412cc0
add esp, 8
cmp dword [esp + 0x24], 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jle 0x407678
push 0x4567e8
call fcn.0041ed40
push ecx
mov byte [esp + 0x170], 8
mov ecx, esp
mov dword [esp + 0x3c], esp
push esi
call fcn.0041ed20
mov byte [esp + 0x170], 7
call fcn.0041af00
mov eax, dword [esp + 0x178]
add esp, 8
call fcn.0041b330
jmp 0x4076a7
push 0x4567f4
call fcn.0041ed40
push ecx
mov byte [esp + 0x170], 9
mov ecx, esp
mov dword [esp + 0x3c], esp
push esi
call fcn.0041ed20
mov byte [esp + 0x170], 7
call fcn.0041af00
add esp, 8
lea edi, [esp + 0x20]
mov dword [esp + 0x168], 0xffffffff
call fcn.00401370
or ebx, 0xffffffff
mov edi, dword [ebp + 0x466491]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x7c]
lea edx, [esp + 0x38]
push edx
push 0x26
push 0x44
push edi
mov dword [esp + 0x48], 0
call eax
test eax, eax
jge 0x4076ed
push 0x4582d4
push edi
push eax
call fcn.0044a580
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp + 0x466491]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x5c]
lea edx, [esp + 0x38]
push edx
push edi
mov dword [esp + 0x40], 0
call eax
test eax, eax
jge 0x407723
push 0x4582d4
push edi
push eax
call fcn.0044a580
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x4664de]
push 0x4567b0
push eax
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x4079d1
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x45680c
call fcn.0041ed40
mov dword [esp + 0x16c], 0xa
mov eax, dword [esi]
push ecx
sub eax, 0x10
mov dword [esp + 0x48], esp
mov edi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov dword [esp + 0x170], 0xffffffff
call fcn.0041af00
mov ebx, dword [esp + 0x178]
mov eax, ebx
mov edi, 0x64
call fcn.004071e0
push ebx
push 1
call fcn.00405bd0
mov eax, ebx
mov edi, 0x3e8
call fcn.004071e0
mov dword [esp + 0x30], 0
mov dword [esp + 0x178], 0xb
fld1
add esp, 8
fstp qword [esp]
push 0
push ecx
mov ebx, esp
mov dword [esp + 0x28], esp
push str.000000
call fcn.00401260
push ecx
mov byte [esp + 0x17c], 0xc
mov ebx, esp
mov dword [esp + 0x48], esp
push str.cargoholdspace.bmp
call fcn.00401260
push 0x300
push 0x400
push 0
push 0
lea ecx, [esp + 0x5c]
push ecx
mov byte [esp + 0x190], 0xb
mov ecx, dword [ebp + 0x466491]
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x20]
call fcn.004013c0
lea edi, [esp + 0x38]
call fcn.00401370
mov eax, dword [esp + 0x20]
test eax, eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov dword [ecx], eax
je 0x407858
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0x28]
push edx
call fcn.00412cc0
mov ebx, dword [esp + 0x178]
push ebx
push 0
call fcn.00405bd0
add esp, 0x10
cmp dword [esp + 0x24], 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jg 0x40793b
push 0x45682c
call fcn.0041ed40
mov byte [esp + 0x16c], 0xd
mov eax, dword [esi]
push ecx
sub eax, 0x10
mov dword [esp + 0x3c], esp
mov edi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x170], 0xb
call fcn.0041af00
push 2
push ebx
call fcn.0040b5f0
push 0
push ebx
call fcn.004060a0
mov eax, dword [ebp + 0x466502]
push 0x456848
push eax
call fcn.00433544
add esp, 0x20
test eax, eax
sete al
test al, al
je 0x407977
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x456850
call fcn.0041ed40
push ecx
mov byte [esp + 0x170], 0xe
mov ecx, esp
mov dword [esp + 0x3c], esp
push esi
call fcn.0041ed20
mov byte [esp + 0x170], 0xb
call fcn.0041af00
mov eax, dword [ebp + 0x46649d]
add esp, 8
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x407977
push 0x45686c
call fcn.0041ed40
mov byte [esp + 0x16c], 0xf
mov eax, dword [esi]
push ecx
sub eax, 0x10
mov dword [esp + 0x3c], esp
mov edi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x170], 0xb
call fcn.0041af00
add esp, 8
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x456878
call fcn.0041ed40
mov byte [esp + 0x16c], 0x10
mov esi, dword [esi]
push ecx
sub esi, 0x10
mov dword [esp + 0x3c], esp
mov edi, esp
push esi
call fcn.00420060
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x170], 0xb
call fcn.0041af00
add esp, 8
lea edi, [esp + 0x20]
mov dword [esp + 0x168], 0xffffffff
call fcn.00401370
or ebx, 0xffffffff
mov eax, dword [ebp + 0x4664c2]
push 0x456888
push eax
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x407bb7
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov ebx, esp
mov dword [esp + 0x44], esp
push str.000000
call fcn.00401260
push ecx
mov dword [esp + 0x17c], 0x11
mov ebx, esp
mov dword [esp + 0x54], esp
push str.repair.bmp
call fcn.00401260
push 0x300
push 0x400
push 0
push 0
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x190], 0xffffffff
mov ecx, dword [ebp + 0x466491]
call fcn.00401940
mov dword [esp + 0x168], 0x12
mov edx, dword [esp + 0x20]
push ecx
mov eax, esp
mov dword [eax], edx
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0x1c], esp
je 0x407a80
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [esp + 0x28]
push eax
call fcn.00412cc0
add esp, 8
cmp dword [esp + 0x24], 0
jg 0x407ba0
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov ebx, esp
mov dword [esp + 0x28], esp
push str.000000
call fcn.00401260
push ecx
mov byte [esp + 0x17c], 0x13
mov ebx, esp
mov dword [esp + 0x48], esp
push str.repair.bmp
call fcn.00401260
push 0x300
push 0x400
push 0
push 0
lea ecx, [esp + 0x5c]
push ecx
mov byte [esp + 0x190], 0x12
mov ecx, dword [ebp + 0x466491]
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x20]
call fcn.004013c0
lea edi, [esp + 0x38]
call fcn.00401370
mov edx, dword [esp + 0x20]
push ecx
mov eax, esp
mov dword [eax], edx
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0x1c], esp
je 0x407b29
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [esp + 0x28]
push eax
call fcn.00412cc0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
add esp, 8
test ecx, ecx
mov dword [esp + 0x28], edx
jg 0x407ba0
mov eax, dword [esp + 0x170]
mov edi, 0x1f4
call fcn.004071e0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x45689c
call fcn.0041ed40
push ecx
mov byte [esp + 0x170], 0x14
lea eax, [ebp + 0x466499]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.0041ed20
mov byte [esp + 0x170], 0x12
call fcn.0041af00
mov esi, dword [ebp + 0x466491]
add esp, 8
mov edx, 0x61
call fcn.00401580
lea edi, [esp + 0x20]
mov dword [esp + 0x168], 0xffffffff
call fcn.00401370
or ebx, 0xffffffff
mov eax, dword [ebp + 0x4664d6]
push 0x4568a8
push eax
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x407c1d
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x4568b4
call fcn.0041ed40
mov dword [esp + 0x16c], 0x15
mov eax, dword [ebp + 0x466499]
push ecx
sub eax, 0x10
mov dword [esp + 0x48], esp
mov esi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov dword [esp + 0x170], ebx
call fcn.0041af00
add esp, 8
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x4568c4
call fcn.0041ed40
mov dword [esp + 0x16c], 0x16
mov eax, dword [ebp + 0x466499]
push ecx
sub eax, 0x10
mov dword [esp + 0x48], esp
mov esi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov dword [esp + 0x170], ebx
call fcn.0041af00
add esp, 8
cmp dword [esp + 0x170], ebx
jne 0x407c76
push 0xc8
jmp 0x407c9d
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0xc7
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0xc8
imul eax, edx
push eax
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
mov esi, dword [ebp + 0x466491]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x7c]
lea edx, [esp + 0x38]
push edx
push 0x2c8
push 0x1d5
push esi
mov dword [esp + 0x48], 0
call eax
test eax, eax
jge 0x407cda
push 0x4582d4
push esi
push eax
call fcn.0044a580
cmp dword [esp + 0x170], ebx
jne 0x407cea
push 0xc8
jmp 0x407d11
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0xc7
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0xc8
imul eax, edx
push eax
call edi
mov esi, dword [ebp + 0x466491]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x5c]
lea edx, [esp + 0x38]
push edx
push esi
mov dword [esp + 0x40], 0
call eax
test eax, eax
jge 0x407d3e
push 0x4582d4
push esi
push eax
call fcn.0044a580
cmp dword [esp + 0x170], ebx
jne 0x407d4e
push 0xc8
jmp 0x407d75
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0xc7
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0xc8
imul eax, edx
push eax
call edi
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x4568d0
call fcn.0041ed40
mov dword [esp + 0x16c], 0x17
mov eax, dword [ebp + 0x466499]
push ecx
sub eax, 0x10
mov dword [esp + 0x48], esp
mov esi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov dword [esp + 0x170], ebx
call fcn.0041af00
mov esi, dword [esp + 0x178]
mov eax, esi
call fcn.0040da50
push esi
push 1
call fcn.00405490
add esp, 0x10
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4568dc
call fcn.0041ed40
mov dword [esp + 0x16c], 0x18
mov eax, dword [ebp + 0x466499]
push ecx
sub eax, 0x10
mov dword [esp + 0x44], esp
mov esi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov dword [esp + 0x170], ebx
call fcn.0041af00
mov edi, dword [ebp + 0x466491]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x7c]
add esp, 8
lea edx, [esp + 0x20]
push edx
push 0x3d
push 0x1c2
push edi
mov dword [esp + 0x30], 0
call eax
test eax, eax
jge 0x407e51
push 0x4582d4
push edi
push eax
call fcn.0044a580
cmp dword [esp + 0x170], ebx
jne 0x407e61
push 0xc8
jmp 0x407e88
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0xc7
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0xc8
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp + 0x466491]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x5c]
lea edx, [esp + 0x20]
push edx
push esi
mov dword [esp + 0x28], 0
call eax
test eax, eax
jge 0x407eb9
push 0x4582d4
push esi
push eax
call fcn.0044a580
cmp dword [esp + 0x170], ebx
jne 0x407ec9
push 0x1770
jmp 0x407ef0
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0x176f
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0x1770
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4568e8
call fcn.0041ed40
mov dword [esp + 0x16c], 0x19
mov edi, dword [ebp + 0x466499]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
sub edi, 0x10
mov dword [esp + 0x20], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x407f46
cmp eax, dword [edi]
jne 0x407f46
mov ebx, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x407f7c
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x40a233
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 4]
add eax, 1
push eax
add edi, 0x10
push edi
push eax
lea ecx, [ebx + 0x10]
push ecx
call fcn.0043149e
add esp, 0x10
add ebx, 0x10
mov dword [esi], ebx
mov dword [esp + 0x170], 0xffffffff
call fcn.0041af00
xor esi, esi
mov dword [esp + 0x28], esi
xor ebx, ebx
mov dword [esp + 0x170], 0x1a
mov dword [esp + 0x24], ebx
mov byte [esp + 0x170], 0x1b
fld1
mov edx, dword [0x46cc64]
fstp qword [esp]
push ebx
push ecx
mov eax, esp
mov dword [eax], edx
mov eax, edx
test eax, eax
mov dword [esp + 0x28], esp
je 0x407fd5
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edi, dword [ebp + 0x466491]
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea ecx, [esp + 0x90]
call fcn.00401850
lea ecx, [esp + 0x20]
cmp ecx, eax
je 0x408017
mov esi, dword [eax]
test esi, esi
mov dword [esp + 0x20], esi
je 0x408017
lea edx, [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edi, dword [esp + 0x70]
test edi, edi
je 0x40805f
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x408057
test edi, edi
je 0x408057
mov eax, dword [edi]
test eax, eax
je 0x40803e
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [edi + 4]
test eax, eax
je 0x40804e
push eax
call fcn.00423ef9
add esp, 4
push edi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x70], 0
test esi, esi
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
mov dword [eax], esi
je 0x408076
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0x28]
push edx
call fcn.00412cc0
add esp, 8
cmp dword [esp + 0x24], 0
jle 0x409fff
mov eax, dword [ebp + 0x4664d6]
push 0x4568f8
xor esi, esi
push eax
mov dword [esp + 0x44], esi
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x4080ba
mov esi, 1
mov dword [esp + 0x3c], esi
mov eax, dword [ebp + 0x4664d6]
push 0x456900
push eax
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x4080e0
mov esi, 2
mov dword [esp + 0x3c], esi
mov eax, dword [ebp + 0x4664d6]
push 0x456908
push eax
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x408106
mov esi, 3
mov dword [esp + 0x3c], esi
mov eax, dword [ebp + 0x4664d6]
push 0x456910
push eax
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x40812c
mov esi, 4
mov dword [esp + 0x3c], esi
mov eax, dword [ebp + 0x4664d6]
push 0x45691c
push eax
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x408152
mov esi, 5
mov dword [esp + 0x3c], esi
mov eax, dword [ebp + 0x4664d6]
push 0x456924
push eax
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x408178
mov esi, 6
mov dword [esp + 0x3c], esi
mov eax, dword [ebp + 0x4664d6]
push 0x45692c
push eax
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x40819e
mov esi, 7
mov dword [esp + 0x3c], esi
mov eax, dword [ebp + 0x4664d6]
push 0x45693c
push eax
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x4081c4
mov esi, 8
mov dword [esp + 0x3c], esi
mov eax, dword [ebp + 0x4664d6]
push 0x456948
push eax
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x4081ea
mov esi, 9
mov dword [esp + 0x3c], esi
mov eax, dword [ebp + 0x4664d6]
push 0x456954
push eax
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x408210
mov esi, 0xa
mov dword [esp + 0x3c], esi
mov eax, dword [ebp + 0x4664d6]
push 0x45695c
push eax
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x408236
mov esi, 0xb
mov dword [esp + 0x3c], esi
cmp dword [ebp + 0x466506], 1
jne case.default.0x40828d
cmp dword [esp + 0x170], 0xffffffff
jne 0x408254
push 0x3e8
jmp 0x40827b
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0x3e7
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0x3e8
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esi - 1]
cmp eax, 0xa
ja case.default.0x40828d
jmp dword [eax*4 + 0x40a584]
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x28], esp
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x1c
mov ebx, esp
mov dword [esp + 0x40], esp
push str.xp_laocao.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea ecx, [esp + 0x9c]
push ecx
mov byte [esp + 0x190], 0x1b
mov ecx, dword [ebp + 0x466491]
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x78]
test eax, eax
je 0x40835b
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x408353
test esi, esi
je 0x408353
mov eax, dword [esi]
test eax, eax
je 0x40833a
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x40834a
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x78], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x408376
lea edx, [ebx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [esp + 0xa4]
push eax
call fcn.00412cc0
mov ecx, dword [eax]
mov esi, dword [eax + 4]
add esp, 8
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], esi
jmp 0x408d6c
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x1d
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.xp_shuniu.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea edx, [esp + 0xa4]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push edx
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x80]
test eax, eax
je 0x408465
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x40845a
test esi, esi
je 0x40845a
mov eax, dword [esi]
test eax, eax
je 0x408441
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x408451
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x80], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x408480
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0xb4]
push ecx
call fcn.00412cc0
mov edx, dword [eax]
mov esi, dword [eax + 4]
mov dword [esp + 0x2c], edx
add esp, 8
mov dword [esp + 0x28], esi
jmp 0x408d6c
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x1e
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.xp_binan.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea eax, [esp + 0xac]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push eax
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x88]
test eax, eax
je 0x40856f
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x408564
test esi, esi
je 0x408564
mov eax, dword [esi]
test eax, eax
je 0x40854b
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x40855b
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x88], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x40858a
lea ecx, [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0x134]
push edx
call fcn.00412cc0
mov ecx, dword [eax]
mov esi, dword [eax + 4]
add esp, 8
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], esi
jmp 0x408d6c
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x1f
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.xp_huodongzhongxin.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea edx, [esp + 0xa0]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push edx
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x408673
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x40866b
test esi, esi
je 0x40866b
mov eax, dword [esi]
test eax, eax
je 0x408652
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x408662
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x7c], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x40868e
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0xc4]
jmp 0x408487
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x20
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.xp_shengtan.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea eax, [esp + 0x7c]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push eax
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x58]
test eax, eax
je 0x40875e
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x408756
test esi, esi
je 0x408756
mov eax, dword [esi]
test eax, eax
je 0x40873d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x40874d
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x58], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x408779
lea ecx, [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0x114]
push edx
call fcn.00412cc0
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov dword [esp + 0x2c], ecx
add esp, 8
mov dword [esp + 0x28], esi
jmp 0x408d6c
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x21
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.xp_judian.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea edx, [esp + 0x70]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push edx
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x40885f
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x408857
test esi, esi
je 0x408857
mov eax, dword [esi]
test eax, eax
je 0x40883e
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x40884e
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x4c], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x40887a
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0xd4]
jmp 0x408487
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x22
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.xp_xunluodui.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea eax, [esp + 0x74]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push eax
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x50]
test eax, eax
je 0x40894a
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x408942
test esi, esi
je 0x408942
mov eax, dword [esi]
test eax, eax
je 0x408929
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x408939
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x50], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x408965
lea ecx, [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0x154]
push edx
call fcn.00412cc0
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov dword [esp + 0x2c], ecx
add esp, 8
mov dword [esp + 0x28], esi
jmp 0x408d6c
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x23
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.xp_jiqun.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea edx, [esp + 0x84]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push edx
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x60]
test eax, eax
je 0x408a4e
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x408a46
test esi, esi
je 0x408a46
mov eax, dword [esi]
test eax, eax
je 0x408a2d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x408a3d
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x60], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x408a69
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0xe4]
jmp 0x408487
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x24
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.xp_wurenjixiaodui.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea eax, [esp + 0x8c]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push eax
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x68]
test eax, eax
je 0x408b3c
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x408b34
test esi, esi
je 0x408b34
mov eax, dword [esi]
test eax, eax
je 0x408b1b
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x408b2b
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x68], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x408b57
lea ecx, [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0x124]
push edx
call fcn.00412cc0
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov dword [esp + 0x2c], ecx
add esp, 8
mov dword [esp + 0x28], esi
jmp 0x408d6c
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x25
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.xp_jihuidian.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea edx, [esp + 0x80]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push edx
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x408c40
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x408c38
test esi, esi
je 0x408c38
mov eax, dword [esi]
test eax, eax
je 0x408c1f
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x408c2f
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x5c], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x408c5b
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0xf4]
jmp 0x408487
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x26
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.xp_jituan.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea eax, [esp + 0x98]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push eax
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x74]
test eax, eax
je 0x408d2e
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x408d26
test esi, esi
je 0x408d26
mov eax, dword [esi]
test eax, eax
je 0x408d0d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x408d1d
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x74], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x408d49
lea ecx, [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0x144]
push edx
call fcn.00412cc0
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov dword [esp + 0x2c], ecx
add esp, 8
mov dword [esp + 0x28], esi
jmp 0x408d6c
mov esi, dword [esp + 0x28]
cmp dword [ebp + 0x466506], 2
jne case.default.0x408d89
mov eax, dword [esp + 0x3c]
add eax, 0xffffffff
cmp eax, 0xa
ja case.default.0x408d89
jmp dword [eax*4 + 0x40a5b0]
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x27
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.w7_laocao.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea edx, [esp + 0x88]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push edx
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x64]
test eax, eax
je 0x408e57
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x408e4f
test esi, esi
je 0x408e4f
mov eax, dword [esi]
test eax, eax
je 0x408e36
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x408e46
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x64], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x408e72
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0x104]
jmp 0x409646
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x28
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.w7_shuniu.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea eax, [esp + 0xa8]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push eax
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x84]
test eax, eax
je 0x408f4b
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x408f40
test esi, esi
je 0x408f40
mov eax, dword [esi]
test eax, eax
je 0x408f27
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x408f37
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x84], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x408f66
lea ecx, [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0xac]
push edx
call fcn.00412cc0
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
jmp 0x409652
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x29
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.w7_binan.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea edx, [esp + 0x90]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push edx
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x409045
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x40903d
test esi, esi
je 0x40903d
mov eax, dword [esi]
test eax, eax
je 0x409024
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x409034
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x6c], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x409060
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0xbc]
jmp 0x409646
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x2a
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.w7_huodongzhongxin.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea eax, [esp + 0x78]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push eax
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x54]
test eax, eax
je 0x409130
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x409128
test esi, esi
je 0x409128
mov eax, dword [esi]
test eax, eax
je 0x40910f
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x40911f
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x54], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x40914b
lea ecx, [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0xcc]
push edx
call fcn.00412cc0
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
jmp 0x409652
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x2b
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.w7_shengtan.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea edx, [esp + 0xb0]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push edx
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
lea edi, [esp + 0x8c]
call fcn.00401370
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x409207
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0xdc]
jmp 0x409646
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x2c
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.w7_judian.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea eax, [esp + 0xc0]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push eax
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
lea edi, [esp + 0x9c]
call fcn.00401370
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x4092b7
lea ecx, [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0xec]
push edx
call fcn.00412cc0
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
jmp 0x409652
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x2d
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.w7_xunluodui.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea edx, [esp + 0xbc]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push edx
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
lea edi, [esp + 0x98]
call fcn.00401370
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x409373
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0xfc]
jmp 0x409646
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x2e
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.w7_jiqun.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea eax, [esp + 0xb4]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push eax
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
lea edi, [esp + 0x90]
call fcn.00401370
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x409423
lea ecx, [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0x10c]
push edx
call fcn.00412cc0
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
jmp 0x409652
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x2f
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.w7_wurenjixiaodui.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea edx, [esp + 0xb8]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push edx
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
lea edi, [esp + 0x94]
call fcn.00401370
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x4094df
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0x11c]
jmp 0x409646
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x30
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.w7_jihuidian.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea eax, [esp + 0x64]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push eax
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
lea edi, [esp + 0x40]
call fcn.00401370
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x409589
lea ecx, [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0x12c]
push edx
call fcn.00412cc0
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
jmp 0x409652
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x31
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.w7_jituan.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea edx, [esp + 0x58]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push edx
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
lea edi, [esp + 0x34]
call fcn.00401370
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x40963f
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0x13c]
push ecx
call fcn.00412cc0
mov edx, dword [eax]
mov dword [esp + 0x2c], edx
mov esi, dword [eax + 4]
add esp, 8
mov dword [esp + 0x28], esi
cmp dword [esp + 0x24], 0
jle 0x40a098
mov ecx, dword [esp + 0x24]
mov edi, dword [ebp + 0x466491]
mov edx, dword [edi]
add ecx, 0xffffffc4
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [edx + 0x7c]
lea eax, [esi + 3]
push eax
mov eax, dword [esp + 0x20]
push eax
push edi
mov dword [esp + 0x4c], 0
call ecx
test eax, eax
jge 0x4096a6
push 0x4582d4
push edi
push eax
call fcn.0044a580
cmp dword [esp + 0x170], 0xffffffff
jne 0x4096b7
push 0xc8
jmp 0x4096de
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0xc7
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0xc8
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp + 0x466491]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x5c]
lea edx, [esp + 0x18]
push edx
push edi
mov dword [esp + 0x20], 0
call eax
test eax, eax
jge 0x40970f
push 0x4582d4
push edi
push eax
call fcn.0044a580
cmp dword [esp + 0x170], 0xffffffff
jne 0x409720
push 0xc8
jmp 0x409747
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0xc7
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0xc8
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp + 0x466491]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x60]
lea edx, [esp + 0x18]
push edx
push edi
mov dword [esp + 0x20], 0
call eax
test eax, eax
jge 0x409778
push 0x4582d4
push edi
push eax
call fcn.0044a580
cmp dword [esp + 0x170], 0xffffffff
jne 0x409789
push 0x1f4
jmp 0x4097b0
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0x1f3
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0x1f4
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
cmp dword [ebp + 0x466506], 1
jne 0x4098bc
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push ecx
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x32
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.xp_warpto.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea ecx, [esp + 0x6c]
push ecx
mov byte [esp + 0x190], 0x1b
mov ecx, dword [ebp + 0x466491]
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x48]
test eax, eax
je 0x409888
mov edi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x409880
test edi, edi
je 0x409880
mov eax, dword [edi]
test eax, eax
je 0x409867
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [edi + 4]
test eax, eax
je 0x409877
push eax
call fcn.00423ef9
add esp, 4
push edi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x48], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x4098a3
lea edx, [ebx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [esp + 0x14c]
push eax
call fcn.00412cc0
mov edx, dword [eax + 4]
mov ecx, dword [eax]
add esp, 8
mov dword [esp + 0x30], edx
cmp dword [ebp + 0x466506], 2
jne 0x4099c1
fld qword [0x458468]
sub esp, 8
fstp qword [esp]
push 0
push ecx
mov edi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Color_GameBackground
call fcn.0041ed40
call fcn.004128a0
mov byte [esp + 0x17c], 0x33
mov ebx, esp
mov dword [esp + 0x2c], esp
push str.w7_warpto.bmp
call fcn.00401260
push 0x2f3
push 0x2f8
push 0x119
push 0x1b0
lea eax, [esp + 0x5c]
mov byte [esp + 0x18c], 0x1b
mov ecx, dword [ebp + 0x466491]
push eax
call fcn.00401940
mov ebx, eax
lea edi, [esp + 0x1c]
call fcn.004013c0
mov eax, dword [esp + 0x38]
test eax, eax
je 0x40998d
mov edi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x409985
test edi, edi
je 0x409985
mov eax, dword [edi]
test eax, eax
je 0x40996c
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [edi + 4]
test eax, eax
je 0x40997c
push eax
call fcn.00423ef9
add esp, 4
push edi
call fcn.00423ef9
add esp, 4
mov dword [esp + 0x38], 0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
mov dword [eax], ebx
je 0x4099a8
lea ecx, [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0x15c]
push edx
call fcn.00412cc0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add esp, 8
mov dword [esp + 0x30], eax
test ecx, ecx
jle 0x4099d3
cmp dword [esp + 0x174], 0
je 0x40a238
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x456b18
call fcn.0041ed40
mov byte [esp + 0x16c], 0x34
mov eax, dword [ebp + 0x466499]
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x170], 0x1b
call fcn.0041af00
mov eax, dword [ebp + 0x4664e2]
push 0x4567b0
push eax
call fcn.00433544
add esp, 0x10
test eax, eax
sete al
test al, al
je 0x409d63
cmp dword [esp + 0x174], 0
jne 0x409d63
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x456b28
call fcn.0041ed40
mov byte [esp + 0x16c], 0x35
mov eax, dword [ebp + 0x466499]
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x170], 0x1b
call fcn.0041af00
mov ecx, dword [esp + 0x2c]
mov edi, dword [ebp + 0x466491]
mov edx, dword [edi]
add esp, 8
lea eax, [esi + 0xd]
lea esi, [esp + 0x18]
push esi
push eax
mov eax, dword [edx + 0x7c]
add ecx, 0xffffffd8
push ecx
push edi
mov dword [esp + 0x28], 0
call eax
test eax, eax
jge 0x409ac4
push 0x4582d4
push edi
push eax
call fcn.0044a580
mov esi, dword [esp + 0x170]
mov eax, esi
mov edi, 0x64
call fcn.004071e0
mov edi, dword [ebp + 0x466491]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x5c]
lea edx, [esp + 0x18]
push edx
push edi
mov dword [esp + 0x20], 0
call eax
test eax, eax
jge 0x409b02
push 0x4582d4
push edi
push eax
call fcn.0044a580
mov eax, esi
mov edi, 0xdac
call fcn.004071e0
cmp dword [ebp + 0x46653e], 1
je 0x409be7
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x456b34
call fcn.0041ed40
mov byte [esp + 0x16c], 0x36
mov eax, dword [ebp + 0x466499]
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x170], 0x1b
call fcn.0041af00
add esp, 8
mov esi, 0xb
jmp 0x409b70
mov edi, dword [ebp + 0x466491]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x50]
lea edx, [esp + 0x18]
push edx
push 8
push edi
mov dword [esp + 0x24], 0
call eax
test eax, eax
jge 0x409b9d
push 0x4582d4
push edi
push eax
call fcn.0044a580
cmp dword [esp + 0x170], 0xffffffff
jne 0x409bae
push 0x12c
jmp 0x409bd5
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0x12b
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0x12c
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 1
jne 0x409b70
mov esi, dword [esp + 0x170]
mov edx, dword [ebp + 0x466542]
cmp edx, 1
je 0x409c18
mov eax, dword [ebp + 0x466546]
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jne 0x409cc0
test ecx, ecx
jl 0x40a2e9
cmp byte [eax], cl
jne 0x409cc0
cmp edx, ecx
jne 0x409c5f
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x456b44
call fcn.0041ed40
mov byte [esp + 0x16c], 0x37
mov eax, dword [ebp + 0x466499]
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x170], 0x1b
call fcn.0041af00
add esp, 8
mov eax, dword [ebp + 0x466546]
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jne 0x409cc0
test ecx, ecx
jl 0x40a2e9
cmp byte [eax], cl
jne 0x409cc0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x456b58
call fcn.0041ed40
mov byte [esp + 0x16c], 0x38
mov eax, dword [ebp + 0x466499]
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x170], 0x1b
call fcn.0041af00
add esp, 8
cmp esi, 0xffffffff
jne 0x409ccc
push 0x3e8
jmp 0x409cf3
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0x3e7
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0x3e8
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp + 0x466491]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x50]
lea edx, [esp + 0x18]
push edx
push 0xd
push edi
mov dword [esp + 0x24], 0
call eax
test eax, eax
jge 0x409d26
push 0x4582d4
push edi
push eax
call fcn.0044a580
cmp esi, 0xffffffff
jne 0x409d32
push 0x3e8
jmp 0x409d59
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0x3e7
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0x3e8
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [esp + 0x28]
cmp byte [ebp + 0x4664a1], 0
je 0x40a2f3
mov edi, dword [ebp + 0x466491]
mov ecx, dword [edi]
lea edx, [esp + 0x18]
push edx
lea eax, [esi + 3]
push eax
mov eax, dword [esp + 0x2c]
add eax, 0xffffffc4
push eax
mov eax, dword [ecx + 0x7c]
push edi
mov dword [esp + 0x28], 0
call eax
test eax, eax
jge 0x409da7
push 0x4582d4
push edi
push eax
call fcn.0044a580
cmp dword [esp + 0x170], 0xffffffff
jne 0x409db8
push 0x1f4
jmp 0x409ddf
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0x1f3
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0x1f4
imul eax, edx
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
mov edi, dword [ebp + 0x466491]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x5c]
lea edx, [esp + 0x18]
push edx
push edi
mov dword [esp + 0x20], 0
call eax
test eax, eax
jge 0x409e12
push 0x4582d4
push edi
push eax
call fcn.0044a580
cmp dword [esp + 0x170], 0xffffffff
jne 0x409e23
push 0x1f4
jmp 0x409e4a
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0x1f3
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0x1f4
imul eax, edx
push eax
call ebx
mov edi, dword [ebp + 0x466491]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x60]
lea edx, [esp + 0x18]
push edx
push edi
mov dword [esp + 0x20], 0
call eax
test eax, eax
jge 0x409e77
push 0x4582d4
push edi
push eax
call fcn.0044a580
cmp dword [esp + 0x170], 0xffffffff
jne 0x409e88
push 0x1f4
jmp 0x409eaf
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0x1f3
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0x1f4
imul eax, edx
push eax
call ebx
mov eax, dword [esp + 0x24]
mov edi, dword [ebp + 0x466491]
mov ecx, dword [edi]
lea edx, [esp + 0x18]
add eax, 0xffffffd8
cmp dword [esp + 0x174], 0
mov dword [esp + 0x18], 0
push edx
jne 0x409edc
add esi, 0x17
jmp 0x409edf
add esi, 0x41
push esi
push eax
mov eax, dword [ecx + 0x7c]
push edi
call eax
test eax, eax
jge 0x409ef7
push 0x4582d4
push edi
push eax
call fcn.0044a580
cmp dword [esp + 0x170], 0xffffffff
jne 0x409f08
push 0x1f4
jmp 0x409f2f
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0x1f3
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0x1f4
imul eax, edx
push eax
call ebx
mov esi, dword [ebp + 0x466491]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x5c]
lea edx, [esp + 0x18]
push edx
xor edi, edi
push esi
mov dword [esp + 0x20], edi
call eax
cmp eax, edi
jge 0x409f5a
push 0x4582d4
push esi
push eax
call fcn.0044a580
mov esi, dword [esp + 0x170]
cmp esi, 0xffffffff
jne 0x409f6a
push 0x64
jmp 0x409f8b
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0x63
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0x64
imul eax, edx
push eax
call ebx
cmp esi, 0xffffffff
mov dword [esp + 0x174], edi
jne 0x409fa0
push 0x3e8
jmp 0x409fc7
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0x3e7
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0x3e8
imul eax, edx
push eax
call ebx
mov eax, dword [esp + 0x44]
add eax, 1
cmp eax, 0x14
mov dword [esp + 0x44], eax
jg 0x40a340
lea edi, [esp + 0x1c]
call fcn.00401370
lea edi, [esp + 0x20]
mov dword [esp + 0x168], 0xffffffff
call fcn.00401370
jmp 0x407ef6
cmp byte [ebp + 0x4664a1], 0
je 0x40a52d
or edi, 0xffffffff
cmp dword [esp + 0x170], edi
jne 0x40a01f
push 0x3e8
jmp 0x40a046
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0x3e7
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0x3e8
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
mov dword [esp + 0x168], edi
je 0x407ef6
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x407ef6
mov eax, dword [esi]
test eax, eax
je 0x40a07a
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x40a08a
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
jmp 0x407ef6
mov edi, dword [esp + 0x170]
cmp edi, 0xffffffff
jne 0x40a0ab
push 0x3e8
jmp 0x40a0d2
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0x3e7
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0x3e8
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x456ba8
call fcn.0041ed40
mov byte [esp + 0x16c], 0x3c
mov eax, dword [ebp + 0x466499]
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0x170], 0x1b
call fcn.0041af00
add esp, 8
cmp byte [ebp + 0x4664a1], 0
je 0x40a2f3
mov eax, dword [ebp + 0x4664f6]
push 0x456bb4
push eax
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x40a17e
mov eax, dword [esp + 0x44]
add eax, 1
cmp eax, 0x14
mov dword [esp + 0x44], eax
jg 0x40a466
lea edi, [esp + 0x1c]
call fcn.00401370
or ebx, 0xffffffff
lea edi, [esp + 0x20]
mov dword [esp + 0x168], ebx
call fcn.00401370
jmp 0x407dd6
mov eax, dword [ebp + 0x4664f6]
push 0x456bc0
push eax
call fcn.00433544
add esp, 8
test eax, eax
sete al
test al, al
je 0x40a3af
cmp dword [ebp + 0x4664be], 1
je 0x40a15d
push 1
push edi
call fcn.0040b5f0
mov esi, dword [ebp + 0x466491]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x7c]
add esp, 8
lea edx, [esp + 0x18]
push edx
push 0x2ae
push 0x19a
push esi
mov dword [esp + 0x28], 0
call eax
test eax, eax
jge 0x40a1e8
push 0x4582d4
push esi
push eax
call fcn.0044a580
mov eax, dword [esp + 0x170]
mov edi, 0x1f4
call fcn.004071e0
mov esi, dword [ebp + 0x466491]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x5c]
lea edx, [esp + 0x18]
push edx
push esi
mov dword [esp + 0x20], 0
call eax
test eax, eax
jge 0x40a224
push 0x4582d4
push esi
push eax
call fcn.0044a580
mov dword [ebp + 0x4664be], 1
jmp 0x40a3af
jmp fcn.00420000
mov edi, dword [ebp + 0x466491]
mov eax, dword [esp + 0x24]
mov ecx, dword [edi]
mov ecx, dword [ecx + 0x7c]
lea edx, [esp + 0x18]
push edx
add esi, 7
push esi
add eax, 0xffffffce
push eax
xor ebx, ebx
push edi
mov dword [esp + 0x28], ebx
call ecx
cmp eax, ebx
jge 0x40a26d
push 0x4582d4
push edi
push eax
call fcn.0044a580
mov edi, dword [esp + 0x170]
cmp edi, 0xffffffff
jne 0x40a280
push 0xc8
jmp 0x40a2a7
call fcn.00432b22
mov ecx, dword [ebp + 0x4664ba]
cdq
sub ecx, 0xc7
idiv ecx
mov eax, dword [ebp + 0x466481]
add eax, 1
add edx, 0xc8
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp + 0x466491]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x5c]
lea edx, [esp + 0x18]
push edx
push esi
mov dword [esp + 0x20], ebx
call eax
cmp eax, ebx
jge 0x40a2d4
push 0x4582d4
push esi
push eax
call fcn.0044a580
push edi
push ebx
mov dword [ebp + 0x4664be], ebx
call fcn.00405490
add esp, 8
jmp 0x40a3af
push 0x80070057
call fcn.004010d0
test ebx, ebx
je 0x40a32b
lea ecx, [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x40a32b
mov eax, dword [ebx]
test eax, eax
je 0x40a312
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebx + 4]
test eax, eax
je 0x40a322
push eax
call fcn.00423ef9
add esp, 4
push ebx
call fcn.00423ef9
add esp, 4
mov esi, dword [esp + 0x20]
test esi, esi
je 0x40a565
lea edx, [esi + 8]
push edx
jmp 0x40a535
cmp byte [0x4662ad], 1
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
jne 0x40a3c6
push 0x456b6c
call fcn.0041ed40
mov byte [esp + 0x16c], 0x39
mov eax, dword [ebp + 0x466499]
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0x170], 0x1b
call fcn.0041af00
mov eax, dword [ebp + 0x46649d]
add esp, 8
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x170]
call fcn.0041b330
lea edi, [esp + 0x1c]
call fcn.00401370
lea edi, [esp + 0x20]
call fcn.00401370
jmp 0x40a565
push 0x456b80
call fcn.0041ed40
mov byte [esp + 0x16c], 0x3a
mov eax, dword [ebp + 0x466499]
push ecx
lea esi, [ebp + 0x466499]
sub eax, 0x10
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x170], 0x1b
call fcn.0041af00
mov eax, dword [esp + 0x178]
mov byte [ebp + 0x4664a1], 0
call fcn.0041b330
add esp, 4
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x456b98
call fcn.0041ed40
mov byte [esp + 0x16c], 0x3b
mov eax, dword [esi]
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x170], 0x1b
call fcn.0041af00
add esp, 8
jmp 0x40a3af
cmp byte [0x4662ad], 1
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
jne 0x40a48d
push 0x456b6c
call fcn.0041ed40
mov byte [esp + 0x16c], 0x3d
jmp 0x40a362
push 0x456b80
call fcn.0041ed40
mov byte [esp + 0x16c], 0x3e
mov eax, dword [ebp + 0x466499]
push ecx
lea esi, [ebp + 0x466499]
sub eax, 0x10
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x170], 0x1b
call fcn.0041af00
mov eax, dword [esp + 0x178]
mov byte [ebp + 0x4664a1], 0
call fcn.0041b330
add esp, 4
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x456b98
call fcn.0041ed40
mov byte [esp + 0x16c], 0x3f
mov eax, dword [esi]
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00420060
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x170], 0x1b
call fcn.0041af00
add esp, 8
jmp 0x40a3af
test esi, esi
je 0x40a565
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x40a565
mov eax, dword [esi]
test eax, eax
je 0x40a54c
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x40a55c
push eax
call fcn.00423ef9
add esp, 4
push esi
call fcn.00423ef9
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x160]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x158
ret