Function at 0x41a3c0
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x473677
mov eax, dword fs:[0]
push eax
sub esp, 0x2f0
mov eax, dword [0x4878d4]
xor eax, esp
mov dword [esp + 0x2e8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4878d4]
xor eax, esp
push eax
lea eax, [esp + 0x304]
mov dword fs:[0], eax
mov eax, dword [esp + 0x31c]
mov ebp, dword [esp + 0x314]
mov edi, 1
mov dword [eax], edi
mov eax, dword [esp + 0x318]
xor ebx, ebx
add eax, 0xffffff9c
mov esi, ecx
mov dword [esp + 0x1c], ebx
cmp eax, 0xe0
ja case.0x41a434.114
movzx eax, byte [eax + 0x41be00]
jmp dword [eax*4 + 0x41bca4]
mov edx, dword [ebp + 0x9d0]
mov eax, dword [ebp + 0xdbc]
mov edx, dword [edx + 0x64]
lea esi, [ebp + 0x9d0]
push eax
mov ecx, esi
call edx
mov ecx, dword [ebp + 0xdbc]
mov eax, dword [esi]
mov edx, dword [eax + 0x84]
push ecx
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0xc0]
push edi
mov ecx, esi
call edx
jmp case.0x41a434.114
mov eax, dword [ebp + 0x9d0]
mov edx, dword [eax + 0xc0]
add ebp, 0x9d0
push ebx
mov ecx, ebp
call edx
jmp case.0x41a434.114
mov ebp, dword [ebp + 0x510]
mov eax, dword [ebp]
mov ecx, dword [eax + 0x1c]
push ebp
call ecx
jmp 0x41bc77
mov ebp, dword [ebp + 0x510]
mov edx, dword [ebp]
mov eax, dword [edx + 0x20]
push ebp
call eax
jmp 0x41bc77
mov ebp, dword [ebp + 0x510]
mov ecx, dword [ebp]
mov edx, dword [ecx + 0x30]
push ebp
call edx
jmp 0x41bc77
push ebp
call fcn.00416770
jmp case.0x41a434.114
push ebp
call fcn.00416970
jmp case.0x41a434.114
lea eax, [ebp + 0x480]
call fcn.0041de40
mov ebp, dword [ebp + 0x510]
push ebx
push ebx
push ebx
mov esi, eax
mov eax, dword [ebp]
mov ecx, dword [eax + 0x2c]
push ebx
push esi
push ebp
call ecx
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp case.0x41a434.114
push edi
push ebx
push ebx
push 0x47cfa4
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x41a434.114
mov edi, ebp
call fcn.004164b0
jmp case.0x41a434.114
mov edx, dword [ebp + 0x480]
lea eax, [ebp + 0x480]
cmp dword [edx - 0xc], ebx
je case.0x41a434.114
call fcn.0041de40
mov ebp, dword [ebp + 0x510]
push ebx
push ebx
push ebx
mov esi, eax
mov eax, dword [ebp]
mov ecx, dword [eax + 0x2c]
push ebx
push esi
push ebp
call ecx
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp case.0x41a434.114
mov edx, dword [ebp + 0x548]
push edx
call fcn.0040cab0
mov ecx, dword [ebp + 0x548]
push edi
push edi
call fcn.00432550
mov ecx, dword [ebp + 0x548]
call fcn.004325a0
jmp case.0x41a434.114
mov esi, ebp
call fcn.00417300
jmp case.0x41a434.114
push edi
push edi
mov ecx, ebp
call fcn.00432550
mov eax, dword [ebp + 4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x41a434.114
mov ecx, dword [ebp + 0x520]
mov edx, dword [ecx + 0x3e4]
mov eax, dword [edx + 4]
add ecx, 0x3e4
call eax
mov ecx, dword [ebp + 0x520]
mov edx, dword [ecx + 0x3b4]
add ecx, 0x3b4
push eax
mov eax, dword [edx]
call eax
cmp eax, ebx
je case.0x41a434.114
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xb0]
call eax
cmp eax, ebx
je case.0x41a434.114
cmp dword [eax + 0x1c], ebx
jne 0x41a61b
xor edi, edi
mov esi, eax
call fcn.0040c1f0
push eax
push ebp
call fcn.00411f60
jmp case.0x41a434.114
mov ecx, dword [ebp + 0x520]
mov edx, dword [ecx + 0x3e4]
mov eax, dword [edx + 4]
add ecx, 0x3e4
call eax
mov ecx, dword [ebp + 0x520]
mov edx, dword [ecx + 0x3b4]
add ecx, 0x3b4
push eax
mov eax, dword [edx]
call eax
cmp eax, ebx
je case.0x41a434.114
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xb0]
call eax
mov esi, eax
cmp esi, ebx
je case.0x41a434.114
cmp dword [esi + 0x1c], ebx
jle case.0x41a434.114
mov ecx, dword [esi + 0x2c]
cmp dword [ecx - 0xc], 0
lea ebx, [esi + 0x2c]
je 0x41a6a2
push 0
mov esi, ebx
call fcn.00404080
push eax
mov eax, dword [ebp + 0x528]
call fcn.00424cf0
jmp case.0x41a434.114
push 0x29
call fcn.00459cc6
add esp, 4
push 0x29
mov edi, eax
push 0
push edi
call fcn.0045cac0
mov esi, dword [esi + 0x28]
mov eax, dword [ebp + 0x528]
add esp, 0xc
push edi
push esi
call fcn.00424db0
test eax, eax
jne 0x41a6db
mov edx, edi
call fcn.00404040
jmp case.0x41a434.114
push edi
call fcn.00459cd1
add esp, 4
jmp case.0x41a434.114
mov ecx, dword [ebp + 0x520]
mov edx, dword [ecx + 0x3e4]
mov eax, dword [edx + 4]
add ecx, 0x3e4
call eax
mov ecx, dword [ebp + 0x520]
mov edx, dword [ecx + 0x3b4]
add ecx, 0x3b4
push eax
mov eax, dword [edx]
call eax
cmp eax, ebx
je case.0x41a434.114
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xb0]
call eax
cmp eax, ebx
je case.0x41a434.114
mov ecx, dword [eax + 0x2c]
lea esi, [eax + 0x2c]
cmp dword [ecx - 0xc], ebx
je case.0x41a434.114
push ebx
call fcn.00404080
push eax
mov eax, dword [ebp + 0x528]
call fcn.00424d30
jmp case.0x41a434.114
mov eax, dword [ebp + 0x528]
push edi
push ebx
call fcn.00424cf0
jmp case.0x41a434.114
mov eax, dword [ebp + 0x528]
push edi
push ebx
call fcn.00424d30
jmp case.0x41a434.114
mov dword [esp + 0x1c], edi
mov eax, dword [ebp + 0x520]
mov edx, dword [eax + 0x3b4]
lea ecx, [eax + 0x3b4]
mov eax, dword [edx + 0xc]
xor edi, edi
call eax
test eax, eax
jle case.0x41a434.114
mov eax, dword [ebp + 0x520]
mov edx, dword [eax + 0x3b4]
lea ecx, [eax + 0x3b4]
mov eax, dword [edx]
push edi
call eax
mov esi, eax
cmp esi, ebx
je 0x41a7f1
mov edx, dword [esi + 0x3e4]
mov eax, dword [edx + 0x10]
lea ecx, [esi + 0x3e4]
call eax
test al, al
je 0x41a7f1
mov edx, dword [esi]
mov eax, dword [edx + 0xb0]
mov ecx, esi
dec edi
call eax
mov ecx, dword [esp + 0x1c]
push ecx
mov ecx, eax
mov ebx, ebp
call fcn.00416a80
xor ebx, ebx
mov eax, dword [ebp + 0x520]
mov edx, dword [eax + 0x3b4]
lea ecx, [eax + 0x3b4]
mov eax, dword [edx + 0xc]
inc edi
call eax
cmp edi, eax
jl 0x41a7a2
jmp case.0x41a434.114
mov eax, dword [ebp + 0x520]
mov edx, dword [eax + 0x3e4]
lea ecx, [eax + 0x3e4]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 0x520]
mov edx, dword [ecx + 0x3b4]
add ecx, 0x3b4
push eax
mov eax, dword [edx]
call eax
mov esi, eax
mov edx, dword [esi]
mov edx, dword [edx + 0xa8]
lea eax, [esp + 0x70]
push eax
mov ecx, esi
call edx
mov ecx, eax
mov dword [esp + 0x30c], 0
call fcn.00432050
lea ecx, [esp + 0x28]
push ecx
mov ecx, eax
call fcn.004040c0
lea ecx, [esp + 0x70]
mov byte [esp + 0x30c], 2
call fcn.00432010
mov edx, dword [esi]
mov eax, dword [edx + 0xb0]
mov ecx, esi
call eax
mov ebx, eax
mov dword [esp + 0x24], ebx
test ebx, ebx
je 0x41aa40
mov eax, dword [ebx + 0x18]
cmp eax, dword [ebp + 0x538]
jne 0x41a902
lea ecx, [esp + 0x1c]
push ecx
mov ecx, str.__select_
call fcn.004040c0
mov byte [esp + 0x30c], 3
mov eax, dword [ebx + 0x28]
mov edx, dword [eax - 0xc]
push edx
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00404fe0
mov ecx, dword [esp + 0x1c]
push 0xa
push 0
push ecx
push str.Explorer.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x1c]
call fcn.00404200
lea ecx, [esp + 0x28]
call fcn.00404200
jmp case.0x41a434.114
cmp dword [ebx + 0x1c], 1
jne 0x41aa40
mov edx, dword [ebx + 0x2c]
cmp dword [edx - 0xc], 0
je 0x41aa40
mov eax, dword [ebp + 0x528]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x528]
mov ecx, dword [eax + 0x34]
sub ecx, dword [eax + 0x30]
add eax, 0x24
mov eax, 0x38e38e39
imul ecx
sar edx, 7
mov edi, edx
shr edi, 0x1f
add edi, edx
mov dword [esp + 0x18], 0
test edi, edi
jle 0x41aa30
lea esp, [esp]
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 0x528]
push ecx
add eax, 0x24
call fcn.00404770
mov ecx, dword [ebx + 0x2c]
mov esi, eax
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41a998
test dl, dl
je 0x41a994
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41a998
add eax, 2
add ecx, 2
test dl, dl
jne 0x41a978
xor eax, eax
jmp 0x41a99d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41aa1f
push 0x47b498
lea ebx, [esp + 0x20]
call fcn.004213d0
add esi, 0x38
push esi
lea ecx, [esp + 0x24]
mov byte [esp + 0x310], 4
call fcn.00421800
lea edx, [esp + 0x20]
push edx
mov ecx, ebx
mov byte [esp + 0x310], 5
call fcn.00421720
lea ecx, [esp + 0x20]
call fcn.004217b0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41a9f1
mov eax, dword [eax]
jmp 0x41a9f3
xor eax, eax
push 0xa
push 0
push eax
push str.Explorer.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30c], 2
call fcn.004217b0
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
inc eax
cmp eax, edi
mov dword [esp + 0x18], eax
jl 0x41a960
mov eax, dword [ebp + 0x528]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esp + 0x28]
call fcn.00404200
jmp case.0x41a434.114
mov ecx, dword [ebp + 0x59c]
push ecx
mov dword [ebp + 0x60c], ebx
push 0x47b710
push str.PlayMode
push str.memory
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp case.0x41a434.114
mov edx, dword [ebp + 0x59c]
push edx
mov dword [ebp + 0x60c], edi
push str.12568
jmp 0x41aa60
mov eax, dword [ebp + 0x59c]
push eax
mov dword [ebp + 0x60c], 2
push 0x47cfe8
jmp 0x41aa60
mov ecx, dword [ebp + 0x59c]
push ecx
mov dword [ebp + 0x60c], 3
push 0x47c6e0
jmp 0x41aa60
mov edx, dword [ebp + 0x53c]
mov ecx, dword [edx + 0x18]
push edi
call fcn.0042c930
mov edi, ebp
call fcn.00417140
jmp case.0x41a434.114
mov eax, dword [ebp + 0x518]
mov ecx, dword [eax]
lea edx, [esp + 0x68]
push edx
push eax
mov eax, dword [ecx + 0x7c]
call eax
mov eax, dword [esp + 0x68]
cmp eax, ebx
je case.0x41a434.114
cmp eax, edi
jne 0x41ab2d
mov ecx, dword [ebp + 0x4a0]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc0]
push ebx
call eax
mov ecx, dword [ebp + 0x4a4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc0]
push edi
call eax
mov ebp, dword [ebp + 0x518]
mov ecx, dword [ebp]
mov edx, dword [ecx + 0x3c]
push ebp
call edx
jmp case.0x41a434.114
cmp eax, 2
jne case.0x41a434.114
mov ecx, dword [ebp + 0x4a0]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc0]
push edi
call edx
mov ecx, dword [ebp + 0x4a4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc0]
push ebx
call edx
mov ebp, dword [ebp + 0x518]
mov eax, dword [ebp]
mov ecx, dword [eax + 0x40]
push ebp
call ecx
jmp case.0x41a434.114
mov esi, ebp
call fcn.00418990
jmp case.0x41a434.114
mov edx, dword [ebp + 0x4b8]
lea eax, [esp + 0x38]
push eax
lea ecx, [ebp + 0x78]
mov dword [esp + 0x40], edx
mov dword [esp + 0x3c], ebx
call fcn.00433cf0
jmp case.0x41a434.114
mov ecx, dword [ebp + 0x4bc]
lea edx, [esp + 0x38]
mov dword [esp + 0x3c], ecx
push edx
lea ecx, [ebp + 0x78]
mov dword [esp + 0x3c], ebx
call fcn.00433cf0
jmp case.0x41a434.114
mov eax, dword [ebp + 0x518]
mov ecx, dword [eax]
lea edx, [esp + 0x64]
push edx
push eax
mov eax, dword [ecx + 0x2c]
call eax
cmp dword [esp + 0x64], ebx
je 0x41abe4
mov ebp, dword [ebp + 0x518]
mov ecx, dword [ebp]
mov edx, dword [ecx + 0x30]
push ebx
push ebp
jmp 0x41bc70
cmp esi, 0x1b
je case.0x41a434.114
mov ebp, dword [ebp + 0x518]
mov eax, dword [ebp]
mov ecx, dword [eax + 0x30]
push edi
push ebp
call ecx
jmp case.0x41a434.114
lea esi, [ebp + 0x78]
push str.listctner
mov ecx, esi
call fcn.004345a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xb8]
call eax
push str.listctner
mov ecx, esi
test al, al
jne 0x41ac64
call fcn.004345a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc0]
push edi
call eax
mov ecx, dword [ebp + 0x4c0]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc0]
push ebx
call eax
mov ebp, dword [ebp + 0x4c4]
mov edx, dword [ebp]
mov eax, dword [edx + 0xc0]
push edi
mov ecx, ebp
call eax
jmp case.0x41a434.114
call fcn.004345a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xb8]
call eax
test al, al
je case.0x41a434.114
push str.listctner
mov ecx, esi
call fcn.004345a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc0]
push ebx
call eax
mov ecx, dword [ebp + 0x4c0]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc0]
push edi
call eax
mov ebp, dword [ebp + 0x4c4]
mov edx, dword [ebp]
mov eax, dword [edx + 0xc0]
push ebx
mov ecx, ebp
call eax
jmp case.0x41a434.114
mov ecx, dword [ebp + 0x59c]
push ecx
push str.12568
push 0x47bae8
push str.memory
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp + 0x518]
lea ecx, [esp + 0x28]
mov dword [ebp + 0x5fc], edi
mov edx, dword [eax]
mov edx, dword [edx + 0x7c]
push ecx
push eax
call edx
push 3
push ebx
push ebx
push ebx
push ebx
cmp dword [esp + 0x3c], ebx
je 0x41ad12
mov eax, dword [ebp + 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp case.0x41a434.114
mov ecx, dword [ebp + 4]
push 0xfffffffffffffffe
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp case.0x41a434.114
mov edx, dword [ebp + 0x59c]
push edx
push 0x47c6e0
push 0x47bae8
push str.memory
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp + 4]
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push eax
mov dword [ebp + 0x5fc], 3
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp case.0x41a434.114
mov ecx, dword [ebp + 0x59c]
push ecx
push 0x47cfe8
push 0x47bae8
push str.memory
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [ebp + 4]
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push edx
mov dword [ebp + 0x5fc], 2
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp case.0x41a434.114
mov eax, dword [ebp + 0x53c]
mov ecx, dword [eax + 0x1c]
push edi
call fcn.0042c930
mov edi, ebp
call fcn.00417140
jmp case.0x41a434.114
mov eax, ebp
call fcn.00417690
jmp case.0x41a434.114
mov ecx, dword [ebp + 0x59c]
push ecx
mov dword [ebp + 0x5f4], 4
push 0x47c2a8
push str.FRAMERATIO
push str.memory
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp + 0x518]
mov ecx, dword [ebp + 0x5f4]
mov edx, dword [eax]
mov edx, dword [edx + 0x5c]
push ecx
push eax
jmp 0x41bc70
mov eax, dword [ebp + 0x59c]
push eax
mov dword [ebp + 0x5f4], 5
push 0x47cfec
push str.FRAMERATIO
push str.memory
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp + 0x518]
mov edx, dword [ebp + 0x5f4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x5c]
call eax
jmp case.0x41a434.114
mov ecx, dword [ebp + 0x59c]
push ecx
mov dword [ebp + 0x5f4], 6
push 0x47cff0
jmp 0x41adda
mov eax, dword [ebp + 0x59c]
push eax
mov dword [ebp + 0x5f4], 8
push 0x47cff4
jmp 0x41ae18
mov eax, dword [ebp + 0x518]
lea edx, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x7c]
call eax
cmp esi, ebx
je 0x41af63
mov ecx, dword [ebp + 0x508]
call fcn.0042d680
cmp eax, 0x64
jne 0x41af4d
cmp dword [esp + 0x18], ebx
je 0x41af4d
add dword [ebp + 0x554], 4
cmp dword [ebp + 0x554], eax
jle 0x41aec4
mov dword [ebp + 0x554], eax
mov eax, dword [ebp + 0x518]
mov edx, dword [ebp + 0x554]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x120]
call eax
cmp dword [ebp + 0x608], ebx
jne case.0x41a434.114
cmp dword [ebp + 0xde4], ebx
jne case.0x41a434.114
lea esi, [esp + 0x1c]
call fcn.004040a0
mov dword [esp + 0x30c], 6
mov eax, dword [ebp + 0x554]
lea ecx, [eax + eax*8 + 0x64]
push ecx
push 0x47c774
mov edi, esi
call fcn.00405490
add esp, 8
mov edx, 0x47b53c
call fcn.004042e0
mov eax, dword [ebp + 4]
lea edx, [esp + 0x38]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp + 0x508]
mov edx, dword [ecx]
mov eax, dword [edx + 0x30]
call eax
jmp 0x41b012
add eax, 5
cmp eax, 0x64
jle 0x41b06a
mov eax, 0x64
jmp 0x41b06a
mov eax, dword [ebp + 0x554]
cmp eax, ebx
jle 0x41b058
cmp dword [esp + 0x18], ebx
je 0x41b058
add eax, 0xfffffffc
cmp eax, ebx
mov dword [ebp + 0x554], eax
jge 0x41af8e
mov dword [ebp + 0x554], ebx
mov eax, dword [ebp + 0x518]
mov ecx, dword [ebp + 0x554]
mov edx, dword [eax]
mov edx, dword [edx + 0x120]
push ecx
push eax
call edx
cmp dword [ebp + 0x608], ebx
jne case.0x41a434.114
cmp dword [ebp + 0xde4], ebx
jne case.0x41a434.114
lea esi, [esp + 0x1c]
call fcn.004040a0
mov dword [esp + 0x30c], 7
mov eax, dword [ebp + 0x554]
lea eax, [eax + eax*8 + 0x64]
push eax
push 0x47c774
mov edi, esi
call fcn.00405490
add esp, 8
mov edx, 0x47b53c
call fcn.004042e0
mov edx, dword [ebp + 4]
lea ecx, [esp + 0x38]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp + 0x508]
mov eax, dword [ecx]
mov edx, dword [eax + 0x30]
call edx
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [esp + 0x2c], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x38]
add ecx, edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x3c]
add eax, ecx
mov dword [esp + 0x2c], eax
push edx
lea eax, [esp + 0x2c]
push eax
mov esi, ebp
call fcn.00412560
lea ecx, [esp + 0x1c]
call fcn.00404200
jmp case.0x41a434.114
mov ecx, dword [ebp + 0x508]
call fcn.0042d680
sub eax, 5
jns 0x41b06a
xor eax, eax
mov ecx, dword [ebp + 0x508]
push eax
call fcn.0042d690
mov ecx, dword [ebp + 0x508]
push ebx
push ebx
push 0x11
push ecx
lea ecx, [ebp + 0x78]
call fcn.004356b0
jmp case.0x41a434.114
mov eax, dword [ebp + 0x518]
mov edx, dword [eax]
push ebx
push eax
mov eax, dword [edx + 0x30]
call eax
push ebx
push ebx
push ebx
cmp dword [ebp + 0x608], ebx
jne 0x41b0bc
mov ecx, dword [ebp + 0x488]
push ecx
lea ecx, [ebp + 0x78]
call fcn.004356b0
jmp case.0x41a434.114
mov edx, dword [ebp + 0x4dc]
push edx
lea ecx, [ebp + 0x78]
call fcn.004356b0
jmp case.0x41a434.114
mov eax, dword [ebp + 0x518]
mov edx, dword [esi + 0xc]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0xac]
call eax
mov eax, dword [ebp + 0x518]
mov edx, dword [esi]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0xbc]
call eax
mov eax, dword [ebp + 0x518]
mov edx, dword [esi + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0xc4]
call eax
mov ebp, dword [ebp + 0x518]
mov edx, dword [esi + 0x10]
mov ecx, dword [ebp]
mov eax, dword [ecx + 0xcc]
push edx
push ebp
call eax
push esi
call fcn.004599df
add esp, 4
jmp case.0x41a434.114
cmp dword [ebp + 0x524], ebx
jne 0x41b157
mov ecx, dword [ebp + 0x520]
push ebx
push ecx
mov edx, 0x47b668
mov ecx, str._u7b
call fcn.00423900
mov dword [ebp + 0x524], eax
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.004040c0
lea esi, [esp + 0x20]
mov dword [esp + 0x30c], 8
call fcn.004040a0
mov bl, 9
mov byte [esp + 0x30c], bl
mov eax, dword [esp + 0x18]
push 0x7c
push eax
call fcn.0045b55b
add esp, 8
test eax, eax
jne 0x41b198
or eax, 0xffffffff
jmp 0x41b19e
sub eax, dword [esp + 0x18]
sar eax, 1
lea ecx, [esp + 0x54]
lea edx, [esp + 0x18]
call fcn.00404630
lea edi, [esp + 0x20]
mov byte [esp + 0x30c], 0xa
call fcn.004048f0
lea ecx, [esp + 0x54]
mov byte [esp + 0x30c], bl
call fcn.00404200
mov esi, dword [esp + 0x20]
mov edi, dword [esi - 0xc]
push 0x7c
push esi
call fcn.0045b55b
add esp, 8
test eax, eax
jne 0x41b1e7
or ecx, 0xffffffff
jmp 0x41b1ed
sub eax, esi
sar eax, 1
mov ecx, eax
mov eax, edi
sub eax, ecx
lea ecx, [esp + 0x20]
push ecx
dec eax
lea ecx, [esp + 0x64]
call fcn.0040a440
lea edi, [esp + 0x20]
mov byte [esp + 0x30c], 0xb
call fcn.004048f0
lea ecx, [esp + 0x60]
mov byte [esp + 0x30c], bl
call fcn.00404200
mov edx, dword [ebp + 0x524]
mov eax, dword [ebp + 0x520]
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x1c]
push eax
call fcn.00423900
lea esi, [esp + 0x20]
mov edi, eax
call fcn.00418960
mov ecx, dword [ebp + 0x598]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
push str._u7b
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test edi, edi
je 0x41b26e
push edi
push ebp
call fcn.00411f60
lea ecx, [esp + 0x20]
call fcn.00404200
lea ecx, [esp + 0x18]
call fcn.00404200
jmp case.0x41a434.114
cmp dword [ebp + 0x538], ebx
jne 0x41b2b2
mov ecx, dword [ebp + 0x520]
push ebx
push ecx
mov edx, 0x47b668
mov ecx, str._g0W
call fcn.00423900
mov dword [ebp + 0x538], eax
cmp eax, ebx
je case.0x41a434.114
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.004040c0
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x310], 0xc
call fcn.004040c0
mov bl, 0xd
mov byte [esp + 0x30c], bl
mov eax, dword [esp + 0x20]
mov esi, dword [eax - 0xc]
push 0x5c
push eax
call fcn.0045b55b
add esp, 8
test eax, eax
jne 0x41b2f9
or ecx, 0xffffffff
jmp 0x41b301
sub eax, dword [esp + 0x20]
sar eax, 1
mov ecx, eax
mov eax, esi
sub eax, ecx
lea ecx, [esp + 0x20]
push ecx
dec eax
lea ecx, [esp + 0x70]
call fcn.0040a440
lea edi, [esp + 0x20]
mov byte [esp + 0x30c], 0xe
call fcn.004048f0
lea ecx, [esp + 0x6c]
mov byte [esp + 0x30c], bl
call fcn.00404200
mov edx, dword [ebp + 0x538]
mov eax, dword [ebp + 0x520]
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x1c]
push eax
call fcn.00423900
mov edi, eax
test edi, edi
je 0x41b26e
lea esi, [esp + 0x20]
call fcn.00418960
mov ecx, dword [ebp + 0x598]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
push str._g0W
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x41b267
mov ecx, dword [ebp + 0x53c]
mov ecx, dword [ecx + 0x2c]
push edi
call fcn.0042c930
mov edi, ebp
call fcn.00417140
jmp case.0x41a434.114
mov eax, dword [ebp + 0x518]
mov edx, dword [eax]
push ebx
push eax
mov eax, dword [edx + 0x30]
call eax
cmp dword [ebp + 0x608], ebx
je case.0x41a434.114
mov ecx, dword [ebp + 0x4dc]
push ebx
push ebx
push ebx
push ecx
lea ecx, [ebp + 0x78]
call fcn.004356b0
jmp case.0x41a434.114
mov eax, dword [ebp + 0x518]
mov edx, dword [eax]
push ebx
push eax
mov eax, dword [edx + 0x30]
call eax
cmp dword [ebp + 0x608], ebx
jne case.0x41a434.114
mov ecx, dword [ebp + 0x488]
push ebx
push ebx
push ebx
push ecx
lea ecx, [ebp + 0x78]
call fcn.004356b0
jmp case.0x41a434.114
mov edx, dword [ebp + 0x4ac]
push ebx
push ebx
push ebx
push edx
lea ecx, [ebp + 0x78]
call fcn.004356b0
jmp case.0x41a434.114
mov eax, dword [ebp + 0x5a8]
push edi
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x41a434.114
mov ecx, dword [ebp + 0x59c]
push ecx
mov dword [ebp + 0x604], 0xa
push 0x47cff8
push str.speed
push str.memory
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [ebp + 0x604]
mov eax, dword [ebp + 0x528]
push edx
call fcn.00425000
jmp case.0x41a434.114
mov eax, dword [ebp + 0x59c]
push eax
push 0x47d000
push str.speed
push str.memory
mov dword [ebp + 0x604], 9
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp + 0x604]
mov eax, dword [ebp + 0x528]
push ecx
call fcn.00425000
jmp case.0x41a434.114
mov edx, dword [ebp + 0x59c]
push edx
push 0x47cff4
push str.speed
push str.memory
mov dword [ebp + 0x604], 8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp + 0x604]
push eax
mov eax, dword [ebp + 0x528]
call fcn.00425000
jmp case.0x41a434.114
mov ecx, dword [ebp + 0x59c]
push ecx
mov dword [ebp + 0x604], 7
push 0x47d004
jmp 0x41b44b
mov eax, dword [ebp + 0x59c]
push eax
mov dword [ebp + 0x604], 6
push 0x47cff0
push str.speed
push str.memory
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp + 0x604]
mov eax, dword [ebp + 0x528]
push ecx
call fcn.00425000
jmp case.0x41a434.114
mov edx, dword [ebp + 0x59c]
push edx
mov dword [ebp + 0x604], 5
push 0x47cfec
push str.speed
push str.memory
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp + 0x604]
push eax
mov eax, dword [ebp + 0x528]
call fcn.00425000
jmp case.0x41a434.114
mov ecx, dword [ebp + 0x59c]
push ecx
mov dword [ebp + 0x604], 4
push 0x47c2a8
jmp 0x41b44b
mov eax, dword [ebp + 0x59c]
push eax
mov dword [ebp + 0x604], 3
push 0x47c6e0
jmp 0x41b51d
mov edx, dword [ebp + 0x59c]
push edx
mov dword [ebp + 0x604], 2
push 0x47cfe8
jmp 0x41b55a
mov ecx, dword [ebp + 0x59c]
push ecx
mov dword [ebp + 0x604], edi
push str.12568
jmp 0x41b44b
mov ebp, dword [ebp + 0x518]
mov eax, dword [ebp]
mov ecx, dword [eax + 0x6c]
push 0xffffffffffffff9c
push ebp
call ecx
jmp case.0x41a434.114
mov ebp, dword [ebp + 0x518]
mov edx, dword [ebp]
mov eax, dword [edx + 0x6c]
push 0x64
push ebp
call eax
jmp case.0x41a434.114
mov ebp, dword [ebp + 0x518]
mov ecx, dword [ebp]
mov edx, dword [ecx + 0x6c]
push ebx
push ebp
jmp 0x41bc70
mov eax, dword [0x48a5bc]
push edi
push 0x8d
push 0x4c8
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x41a434.114
mov ecx, dword [0x48a5bc]
push ebx
push 0x8d
push 0x4c8
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x41a434.114
mov eax, dword [ebp + 0x518]
mov edx, dword [eax]
mov edx, dword [edx + 0x74]
lea ecx, [esp + 0x28]
push ecx
push eax
call edx
push ebx
push ebx
push ebx
cmp dword [esp + 0x34], ebx
je 0x41b68e
mov eax, dword [ebp + 0x4b4]
push eax
lea ecx, [ebp + 0x78]
call fcn.004356b0
jmp case.0x41a434.114
mov ecx, dword [ebp + 0x4b0]
push ecx
lea ecx, [ebp + 0x78]
call fcn.004356b0
jmp case.0x41a434.114
mov edx, dword [ebp + 4]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x41b6c5
mov eax, dword [ebp + 4]
push ebx
push 0xf120
push 0x112
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push edi
mov ecx, ebp
call fcn.00432550
jmp case.0x41a434.114
push ebp
xor ebx, ebx
mov ecx, 0x12e
call fcn.0041d400
jmp case.0x41a434.114
push ebp
xor ebx, ebx
mov ecx, 0x12f
call fcn.0041d400
jmp case.0x41a434.114
push ebp
xor ebx, ebx
mov ecx, 0x131
call fcn.0041d400
jmp case.0x41a434.114
push ebp
xor ebx, ebx
mov ecx, 0x132
call fcn.0041d400
jmp case.0x41a434.114
push 0x206
lea edx, [esp + 0xfa]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x100], cx
call fcn.0045cac0
mov eax, dword [ebp + 0x59c]
add esp, 0xc
push eax
push 0x104
lea ecx, [esp + 0xfc]
push ecx
push 0x47d008
push str.picpath
push str.memory
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0xf8]
call fcn.004040c0
lea eax, [esp + 0x18]
push eax
mov ecx, 0x47d008
call fcn.0041df30
add esp, 4
test al, al
jne 0x41b277
mov ecx, dword [esp + 0x18]
push 0xa
push ebx
push ebx
push ecx
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x18]
call fcn.00404200
jmp case.0x41a434.114
mov edx, dword [ebp + 0x53c]
mov ecx, dword [edx + 0x30]
push edi
call fcn.0042c930
mov edi, ebp
call fcn.00417140
jmp case.0x41a434.114
add dword [ebp + 0x558], 0xfffffe0c
mov eax, dword [ebp + 0x558]
mov ebp, dword [ebp + 0x518]
imul eax, eax, 0x2710
mov ecx, dword [ebp]
mov edx, dword [ecx + 0x128]
push eax
push ebp
jmp 0x41bc70
add dword [ebp + 0x558], 0xfffffc18
jmp 0x41b7d7
add dword [ebp + 0x558], 0xfffff830
jmp 0x41b7d7
add dword [ebp + 0x558], 0xffffec78
jmp 0x41b7d7
add dword [ebp + 0x558], 0x1f4
jmp 0x41b7d7
add dword [ebp + 0x558], 0x3e8
jmp 0x41b7d7
add dword [ebp + 0x558], 0x7d0
jmp 0x41b7d7
add dword [ebp + 0x558], 0x1388
jmp 0x41b7d7
lea eax, [esp + 0x38]
push eax
call fcn.0041ea10
mov dword [esp + 0x30c], 0xf
mov eax, dword [ebp + 0x520]
mov edx, dword [eax + 0x3e4]
lea ecx, [eax + 0x3e4]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 0x520]
mov edx, dword [ecx + 0x3b4]
add ecx, 0x3b4
push eax
mov eax, dword [edx]
call eax
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xb0]
call eax
mov edi, eax
mov ecx, dword [edi + 0x24]
lea edx, [esp + 0x38]
push edx
call fcn.0041a020
cmp eax, ebx
je 0x41b9e2
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x44]
xor ebx, ebx
sar eax, 3
test eax, eax
jbe 0x41b9e2
jmp 0x41b8d0
lea eax, [esp + 0x38]
call fcn.0041eac0
mov eax, dword [eax]
mov ecx, dword [ebp + 0x520]
push edi
push eax
push ecx
call fcn.00423210
mov esi, eax
test esi, esi
jne 0x41b91c
lea eax, [esp + 0x38]
call fcn.0041eac0
mov esi, dword [eax + 4]
add eax, 4
lea eax, [esp + 0x38]
call fcn.0041eac0
mov edx, dword [ebp + 0x520]
mov eax, dword [eax]
push edi
push edx
mov edx, esi
mov ecx, eax
call fcn.00423900
jmp 0x41b940
cmp esi, dword [ebp + 0x530]
je 0x41b9ce
lea eax, [esp + 0x38]
call fcn.0041eac0
mov ecx, dword [eax + 4]
add eax, 4
mov eax, esi
mov esi, ecx
call fcn.00423610
mov eax, dword [edi + 0x24]
sub eax, 0x10
call fcn.00404c80
add eax, 0x10
mov dword [esp + 0x18], eax
lea eax, [esp + 0x38]
mov byte [esp + 0x30c], 0x10
call fcn.0041eac0
mov eax, dword [eax]
sub eax, 0x10
call fcn.00404c80
add eax, 0x10
mov dword [esp + 0x1c], eax
lea esi, [esp + 0x18]
mov byte [esp + 0x30c], 0x11
call fcn.00418960
lea esi, [esp + 0x1c]
call fcn.00418960
mov esi, dword [ebp + 0x598]
lea eax, [esp + 0x38]
call fcn.0041eac0
mov ecx, dword [esp + 0x18]
add eax, 4
mov eax, dword [eax]
push esi
push eax
mov eax, dword [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [esp + 0x1c]
call fcn.00404200
lea ecx, [esp + 0x18]
mov byte [esp + 0x30c], 0xf
call fcn.00404200
mov edx, dword [esp + 0x48]
sub edx, dword [esp + 0x44]
inc ebx
sar edx, 3
cmp ebx, edx
jb 0x41b8d0
lea esi, [esp + 0x38]
call fcn.0041ea70
jmp case.0x41a434.114
mov eax, dword [ebp + 0x518]
lea edx, [esp + 0x24]
mov dword [esp + 0x24], ebx
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x7c]
call eax
cmp dword [esp + 0x24], ebx
je case.0x41a434.114
cmp esi, 0xffffffff
jne 0x41bb20
mov ecx, dword [ebp + 0x50c]
call fcn.00439780
mov ecx, dword [ebp + 0x50c]
mov ebx, eax
call fcn.0042d680
mov esi, eax
sub esi, 0x1388
jns 0x41ba3e
xor esi, esi
mov ecx, dword [ebp + 0x50c]
push esi
call fcn.0042d690
mov eax, dword [ebp + 0x518]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xe8]
push esi
push eax
call edx
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
lea eax, [esp + 0x18]
add ecx, edx
push eax
call fcn.00416370
mov edx, 0x47bf04
lea edi, [esp + 0x18]
mov dword [esp + 0x30c], 0x12
call fcn.004042e0
mov eax, 0x10624dd3
imul ebx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x58]
push edx
call fcn.00416370
mov byte [esp + 0x30c], 0x13
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov eax, edi
push eax
call fcn.00404fe0
lea ecx, [esp + 0x58]
mov byte [esp + 0x30c], 0x12
call fcn.00404200
mov ecx, dword [ebp + 0x4fc]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov edx, dword [edx + 0x2c]
push eax
call edx
mov ebx, dword [ebp + 0x518]
mov edi, dword [ebx]
lea esi, [esp + 0x18]
add edi, 0xec
call fcn.00404020
push eax
mov eax, dword [edi]
push ebx
call eax
call fcn.00407480
mov ecx, dword [ebp + 0x4fc]
call fcn.00434fe0
lea ecx, [esp + 0x18]
call fcn.00404200
jmp case.0x41a434.114
cmp esi, 0xfffffffe
jne 0x41bc30
mov ecx, dword [ebp + 0x50c]
call fcn.00439780
mov ecx, dword [ebp + 0x50c]
mov ebx, eax
call fcn.0042d680
mov esi, eax
add esi, 0x1388
cmp esi, ebx
jle 0x41bb53
sub esi, 0x1388
mov ecx, dword [ebp + 0x50c]
push esi
call fcn.0042d690
mov eax, dword [ebp + 0x518]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xe8]
push esi
push eax
call edx
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
lea eax, [esp + 0x1c]
add ecx, edx
push eax
call fcn.00416370
mov edx, 0x47bf04
lea edi, [esp + 0x1c]
mov dword [esp + 0x30c], 0x14
call fcn.004042e0
mov eax, 0x10624dd3
imul ebx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x5c]
push edx
call fcn.00416370
mov byte [esp + 0x30c], 0x15
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov eax, edi
push eax
call fcn.00404fe0
lea ecx, [esp + 0x5c]
mov byte [esp + 0x30c], 0x14
call fcn.00404200
mov ecx, dword [ebp + 0x4fc]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov edx, dword [edx + 0x2c]
push eax
call edx
mov ebx, dword [ebp + 0x518]
mov edi, dword [ebx]
lea esi, [esp + 0x1c]
add edi, 0xec
call fcn.00404020
push eax
mov eax, dword [edi]
push ebx
call eax
call fcn.00407480
mov ecx, dword [ebp + 0x4fc]
call fcn.00434fe0
mov ecx, esi
call fcn.00404200
jmp case.0x41a434.114
cmp esi, ebx
jne 0x41bc52
mov edi, dword [ebp + 0x518]
mov esi, dword [edi]
mov ecx, dword [ebp + 0x50c]
add esi, 0x4c
call fcn.0042d680
mov ecx, dword [esi]
push eax
push edi
call ecx
jmp case.0x41a434.114
cmp esi, edi
jne case.0x41a434.114
mov edi, dword [ebp + 0x518]
mov esi, dword [edi]
mov ecx, dword [ebp + 0x50c]
add esi, 0x4c
call fcn.0042d680
mov edx, dword [esi]
push eax
push edi
call edx
mov eax, 1
mov ecx, dword [esp + 0x304]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2e8]
xor ecx, esp
call fcn.004599ea
add esp, 0x2fc
ret 0xc