Function at 0x40af50
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x447ba0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov eax, dword [0x48b448]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0xc], eax
mov ebx, 1
mov ecx, 0x4a7b40
mov byte [esp + 0x44], bl
call fcn.0041ff00
push str.Cant_Connect_server_
push 0
push str.NoConnect
lea eax, [esp + 0x20]
push str.TipsText
push eax
mov ecx, 0x48f560
call fcn.00401980
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 2
call fcn.0043bcdc
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], bl
call fcn.0043bba3
push str.Error
push ebx
push str.NoConnect
lea ecx, [esp + 0x20]
push str.TipsText
push ecx
mov ecx, 0x48f560
call fcn.00401980
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 3
call fcn.0043bcdc
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], bl
call fcn.0043bba3
xor edi, edi
mov ecx, esi
call fcn.0040ee80
test eax, eax
jne 0x40b062
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push 3
push edx
push eax
mov ecx, esi
call fcn.0043f27a
cmp eax, 7
je 0x40b042
cmp edi, 2
jg 0x40b042
cmp eax, 2
je case.default.0x40b075
inc edi
jmp 0x40b00e
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
mov ecx, 0x4a78e4
call fcn.0041c2b0
jmp 0x40b541
mov ecx, esi
call fcn.0040eb30
add eax, 4
cmp eax, 4
ja case.default.0x40b075
jmp dword [eax*4 + 0x40b574]
push str.Login_fail__try_again_pls_
push 0
push str.LoginFail
lea edx, [esp + 0x20]
push str.TipsText
push edx
mov ecx, 0x48f560
call fcn.00401980
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 4
call fcn.0043bcdc
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], bl
call fcn.0043bba3
push str.Error
push ebx
push str.LoginFail
lea eax, [esp + 0x24]
push str.TipsText
push eax
mov ecx, 0x48f560
call fcn.00401980
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 5
call fcn.0043bcdc
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], bl
call fcn.0043bba3
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push 0
push ecx
push edx
mov ecx, esi
call fcn.0043f27a
jmp case.default.0x40b075
push str.Cant_Use_Please_call_the_manage_
push 0
push str.FullRoom
lea eax, [esp + 0x28]
push str.TipsText
push eax
mov ecx, 0x48f560
call fcn.00401980
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 6
call fcn.0043bcdc
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], bl
call fcn.0043bba3
push str.Error
push ebx
push str.FullRoom
lea ecx, [esp + 0x2c]
push str.TipsText
push ecx
mov ecx, 0x48f560
call fcn.00401980
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 7
call fcn.0043bcdc
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], bl
call fcn.0043bba3
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push 0
push edx
push eax
mov ecx, esi
call fcn.0043f27a
jmp case.default.0x40b075
push str.No_this_room__select_it_please_
push 0
push str.NoThisRoom
lea ecx, [esp + 0x30]
push str.TipsText
push ecx
mov ecx, 0x48f560
call fcn.00401980
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 8
call fcn.0043bcdc
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], bl
call fcn.0043bba3
push str.Error
push ebx
push str.NoThisRoom
lea edx, [esp + 0x34]
push str.TipsText
push edx
mov ecx, 0x48f560
call fcn.00401980
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 9
call fcn.0043bcdc
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], bl
call fcn.0043bba3
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push 0
push eax
push ecx
mov ecx, esi
call fcn.0043f27a
push 0x48f458
call fcn.0042c42e
add esp, 4
push ebx
push 0
push 0x48f458
push str.SetRoom.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [esi + 0x1c]
push 0
push 0
push 0x10
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x40b075
push str.Room_name_rep__select_it_please_
push 0
push str.RepRoom
lea eax, [esp + 0x38]
push str.TipsText
push eax
mov ecx, 0x48f560
call fcn.00401980
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 0xa
call fcn.0043bcdc
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44], bl
call fcn.0043bba3
push str.Error
push ebx
push str.RepRoom
lea ecx, [esp + 0x3c]
push str.TipsText
push ecx
mov ecx, 0x48f560
call fcn.00401980
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 0xb
call fcn.0043bcdc
lea ecx, [esp + 0x30]
mov byte [esp + 0x44], bl
call fcn.0043bba3
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push 0
push edx
push eax
mov ecx, esi
call fcn.0043f27a
push 0x48f458
call fcn.0042c42e
add esp, 4
push ebx
push 0
push 0x48f458
push str.SetRoom.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x40b075
push str.Cant_Use_Please_call_the_manage_
push 0
push str.NotCanUseRoom
lea edx, [esp + 0x40]
push str.TipsText
push edx
mov ecx, 0x48f560
call fcn.00401980
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 0xc
call fcn.0043bcdc
lea ecx, [esp + 0x34]
mov byte [esp + 0x44], bl
call fcn.0043bba3
push str.Error
push ebx
push str.NotCanUseRoom
lea eax, [esp + 0x44]
push str.TipsText
push eax
mov ecx, 0x48f560
call fcn.00401980
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 0xd
call fcn.0043bcdc
lea ecx, [esp + 0x38]
mov byte [esp + 0x44], bl
call fcn.0043bba3
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push 0
push ecx
push edx
mov ecx, esi
call fcn.0043f27a
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
mov ecx, 0x4a78e4
call fcn.0041c2b0
lea ecx, [esi + 0x2f8]
call fcn.00405190
test eax, eax
mov dword [0x4a8080], eax
jne 0x40b46c
push str.Mpg_Card_not_install_
push eax
push str.NoMpgCard
lea ecx, [esp + 0x44]
push str.TipsText
push ecx
mov ecx, 0x48f560
call fcn.00401980
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 0xe
call fcn.0043bcdc
lea ecx, [esp + 0x38]
mov byte [esp + 0x44], bl
call fcn.0043bba3
push str.Error
push ebx
push str.NoMpgCard
lea edx, [esp + 0x44]
push str.TipsText
push edx
mov ecx, 0x48f560
call fcn.00401980
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 0xf
call fcn.0043bcdc
lea ecx, [esp + 0x38]
mov byte [esp + 0x44], bl
call fcn.0043bba3
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push 0
push eax
push ecx
mov ecx, esi
call fcn.0043f27a
mov ecx, 0x4a7ea0
call fcn.00420bd0
mov ecx, 0x4a7f80
call fcn.00419560
mov ecx, 0x4a7f80
call fcn.00419b40
mov ecx, 0x4a7cb8
call fcn.00402360
cmp dword [0x4a7cb0], ebx
jne 0x40b4bd
push 0
push str.AutoLoad
push str.Cash
mov ecx, 0x48f560
call fcn.00401ab0
test eax, eax
je 0x40b4bd
mov ecx, esi
call fcn.0040b590
mov eax, dword [0x4a8080]
test eax, eax
je 0x40b507
mov edx, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x5dc
push ebx
push edx
call edi
mov eax, dword [esi + 0x1c]
push 0
push 0x2710
push 5
push eax
call edi
mov ecx, dword [esi + 0x1c]
push 0
push 0x7d0
push 6
push ecx
call edi
mov edx, dword [esi + 0x1c]
push 0
push 0x124f80
push 7
push edx
call edi
push 0
mov ecx, 0x4a79d0
mov dword [0x4a8074], 0
mov dword [0x4a8028], 0
call fcn.00402a60
mov eax, dword [0x4a8074]
mov dword [0x4594b4], eax
inc eax
mov dword [0x4a8074], eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
lea ecx, [esp + 0xc]
mov byte [esp + 0x44], 0
call fcn.0043bba3
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], 0xffffffff
call fcn.0043bba3
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret