Function at 0x41c1e0
Capabilities:
Contain obfuscated stackstrings
Get graphical window text
Read .ini file
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4afdd1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x578
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x28], edi
mov edx, dword [edi + 0x1cb8]
cmp edx, ebx
je 0x41c231
mov eax, dword [edi + 0x1cbc]
cmp eax, ebx
jbe 0x41c231
mov ecx, edx
mov esi, eax
mov eax, dword [ecx]
cmp eax, ebx
je 0x41c22b
mov eax, dword [eax]
cmp eax, ebx
jne 0x41c225
add ecx, 4
dec esi
jne 0x41c21f
push edx
call fcn.00493b2c
mov ecx, dword [edi + 0x1cc8]
add esp, 4
mov dword [edi + 0x1cb8], ebx
mov dword [edi + 0x1cc0], ebx
mov dword [edi + 0x1cc4], ebx
call fcn.0049271b
mov dword [edi + 0x1cc8], ebx
mov eax, dword [edi + 0x1c80]
cmp eax, ebx
je 0x41c287
mov ecx, dword [edi + 0x1c84]
cmp ecx, ebx
jbe 0x41c287
mov edx, eax
mov esi, ecx
mov ecx, dword [edx]
cmp ecx, ebx
je 0x41c281
mov ecx, dword [ecx]
cmp ecx, ebx
jne 0x41c27b
add edx, 4
dec esi
jne 0x41c275
push eax
call fcn.00493b2c
mov ecx, dword [edi + 0x1c90]
xor ebx, ebx
add esp, 4
mov dword [edi + 0x1c80], ebx
mov dword [edi + 0x1c88], ebx
mov dword [edi + 0x1c8c], ebx
call fcn.0049271b
lea ecx, [esp + 0x88]
mov dword [edi + 0x1c90], ebx
call fcn.00493d52
push ebx
push 0x9d
lea ecx, [esp + 0x90]
mov dword [esp + 0x598], ebx
call fcn.00493dce
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x11
push ebx
push ebx
push 1
call esi
cdq
sub eax, edx
sar eax, 1
sub eax, 0x78
push eax
push ebx
call esi
cdq
sub eax, edx
lea ecx, [esp + 0x98]
sar eax, 1
sub eax, 0xa0
push eax
push ebx
call fcn.004979f2
push 5
lea ecx, [esp + 0x8c]
call fcn.00497a41
mov eax, dword [esp + 0xa4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x435
lea ecx, [esp + 0x8c]
call fcn.004977db
mov ebx, eax
push 0x444
lea ecx, [esp + 0x8c]
mov dword [esp + 0x44], ebx
call fcn.004977db
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.0049a86d
mov esi, eax
push 0xf
mov dword [esp + 0x30], esi
mov ebp, dword [esi]
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
mov ecx, esi
call dword [ebp + 0x2c]
mov edx, dword [ebx + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0x60000
push 0
push 0x401
push edx
call ebp
mov eax, dword [ebx + 0x1c]
push 0
push 1
push 0x404
push eax
call ebp
push 0
push 0
mov ecx, dword [ebx + 0x1c]
push 0x402
push ecx
call ebp
push 0x4d7ca8
lea ecx, [esp + 0x14]
call fcn.004935b8
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov byte [esp + 0x590], 1
mov ecx, dword [eax - 8]
push ecx
push eax
push 0
push 0x10
mov ecx, esi
call dword [edx + 0x5c]
lea ecx, [esp + 0x10]
mov byte [esp + 0x590], 0
call fcn.0049354a
lea ebp, [edi + 0x1c18]
push str.user_
lea eax, [esp + 0x20]
push ebp
push eax
call fcn.004937df
lea ebx, [edi + 0x1c24]
lea ecx, [esp + 0x14]
push ebx
push eax
push ecx
mov byte [esp + 0x59c], 2
call fcn.00493779
push str.work.sf
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x59c], 3
call fcn.004937df
mov eax, dword [eax]
lea ecx, [edi + 0x1c28]
push eax
push 0x64
push 0x64
mov byte [esp + 0x59c], 4
call fcn.0049397a
push eax
push 0x4d7c98
push str.Title
push str.User
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x10]
mov byte [esp + 0x590], 3
call fcn.0049354a
lea ecx, [esp + 0x14]
mov byte [esp + 0x590], 2
call fcn.0049354a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x590], 0
call fcn.0049354a
push 0xffffffffffffffff
lea ecx, [edi + 0x1c28]
call fcn.004939c9
push str.user_
lea eax, [esp + 0x20]
push ebp
push eax
call fcn.004937df
push ebx
lea ecx, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x59c], 5
call fcn.00493779
mov byte [esp + 0x590], 6
push str.work.sf
lea edx, [esp + 0x14]
push eax
push edx
call fcn.004937df
mov eax, dword [eax]
lea ecx, [edi + 0x1c2c]
push eax
push 0x64
push 0x64
mov byte [esp + 0x59c], 7
call fcn.0049397a
push eax
push 0x4e0dd0
push str.Name
push str.User
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x10]
mov byte [esp + 0x590], 6
call fcn.0049354a
lea ecx, [esp + 0x14]
mov byte [esp + 0x590], 5
call fcn.0049354a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x590], 0
call fcn.0049354a
push 0xffffffffffffffff
lea ecx, [edi + 0x1c2c]
call fcn.004939c9
push str.user_
lea eax, [esp + 0x20]
push ebp
push eax
call fcn.004937df
push ebx
lea ecx, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x59c], 8
call fcn.00493779
push str.work.sf
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x59c], 9
call fcn.004937df
mov eax, dword [eax]
lea ecx, [edi + 0x1c30]
push eax
push 0x64
push 0x64
mov byte [esp + 0x59c], 0xa
call fcn.0049397a
push eax
push 0x4e0dd0
push str.Address
push str.User
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x10]
mov byte [esp + 0x590], 9
call fcn.0049354a
lea ecx, [esp + 0x14]
mov byte [esp + 0x590], 8
call fcn.0049354a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x590], 0
call fcn.0049354a
push 0xffffffffffffffff
lea ecx, [edi + 0x1c30]
call fcn.004939c9
push str.user_
lea eax, [esp + 0x20]
push ebp
push eax
call fcn.004937df
mov byte [esp + 0x590], 0xb
push ebx
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00493779
push str.work.sf
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x59c], 0xc
call fcn.004937df
mov eax, dword [eax]
lea ecx, [edi + 0x1c34]
push eax
push 0x64
push 0x64
mov byte [esp + 0x59c], 0xd
call fcn.0049397a
push eax
push 0x4e0dd0
push str.About
push str.User
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x10]
mov byte [esp + 0x590], 0xc
call fcn.0049354a
lea ecx, [esp + 0x14]
mov byte [esp + 0x590], 0xb
call fcn.0049354a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x590], 0
call fcn.0049354a
push 0xffffffffffffffff
lea ecx, [edi + 0x1c34]
call fcn.004939c9
mov eax, dword [esp + 0x40]
push 0
push 0
push 0x405
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x4d7c54
lea ecx, [esp + 0x18]
call fcn.004935b8
mov eax, dword [esp + 0x14]
mov edx, dword [esi]
mov byte [esp + 0x590], 0xe
mov ecx, dword [eax - 8]
push ecx
push eax
push 0
push 0x10
mov ecx, esi
call dword [edx + 0x5c]
lea ecx, [esp + 0x14]
mov byte [esp + 0x590], 0
call fcn.0049354a
lea ecx, [esp + 0x50]
call fcn.00477fcc
push str.user_
lea eax, [esp + 0x40]
push ebp
push eax
mov byte [esp + 0x59c], 0xf
call fcn.004937df
push ebx
lea ecx, [esp + 0x28]
push eax
push ecx
mov byte [esp + 0x59c], 0x10
call fcn.00493779
push str..fda
mov byte [esp + 0x594], 0x11
push eax
lea edx, [esp + 0x24]
push edx
call fcn.004937df
mov eax, dword [eax]
push 0
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x598], 0x12
call fcn.0047808f
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], eax
mov byte [esp + 0x590], 0x11
call fcn.0049354a
lea ecx, [esp + 0x24]
mov byte [esp + 0x590], 0x10
call fcn.0049354a
lea ecx, [esp + 0x3c]
mov byte [esp + 0x590], 0xf
call fcn.0049354a
mov eax, dword [0x4dca08]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov byte [esp + 0x590], 0x14
test eax, eax
je 0x41ccd8
lea ecx, [esp + 0x50]
call fcn.004782af
mov dword [esp + 0x14], eax
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x54]
call fcn.0047837e
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x594], 0x15
call fcn.00493683
lea ecx, [esp + 0x80]
mov byte [esp + 0x590], 0x14
call fcn.0049354a
lea ecx, [esp + 0x74]
push ecx
lea ecx, [esp + 0x54]
call fcn.004784a7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x594], 0x16
call fcn.00493683
lea ecx, [esp + 0x74]
mov byte [esp + 0x590], 0x14
call fcn.0049354a
mov edx, dword [esp + 0x50]
push 0x10
lea ecx, [esp + 0x54]
call dword [edx + 0x38]
test eax, eax
jne 0x41ccc8
mov eax, dword [esp + 0x10]
push eax
call fcn.0047edbd
push 0xa8
mov dword [esp + 0x44], eax
call fcn.00493b03
mov esi, eax
add esp, 8
mov dword [esp + 0x24], esi
test esi, esi
je 0x41c8c8
mov ecx, dword [0x4dca08]
mov dword [esi + 0xc], ecx
mov edx, dword [0x4dca08]
mov dword [esi + 0x28], edx
lea ecx, [esi + 0x34]
mov byte [esp + 0x590], 0x19
call fcn.00430140
lea ecx, [esi + 0x58]
mov byte [esp + 0x590], 0x1a
call fcn.00430140
xor eax, eax
mov dword [esi + 0x7c], 0x4b5e74
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], 0x11
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], 0xa
jmp 0x41c8ca
xor esi, esi
xor eax, eax
xor ecx, ecx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], 0x64
mov ecx, dword [esi + 0x80]
test ecx, ecx
mov byte [esp + 0x590], 0x14
je 0x41c916
mov eax, dword [esi + 0x84]
test eax, eax
jbe 0x41c916
mov edx, ecx
mov dword [esp + 0x24], eax
mov eax, dword [edx]
test eax, eax
je 0x41c908
mov eax, dword [eax]
test eax, eax
jne 0x41c902
mov eax, dword [esp + 0x24]
add edx, 4
dec eax
mov dword [esp + 0x24], eax
jne 0x41c8fc
push ecx
call fcn.00493b2c
mov ecx, dword [esi + 0x90]
xor eax, eax
add esp, 4
mov dword [esi + 0x80], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
call fcn.0049271b
mov dword [esi + 0x90], 0
mov eax, dword [esp + 0x18]
push 0
push 0
mov eax, dword [eax - 8]
lea ecx, [esp + 0x20]
push eax
call fcn.0049397a
mov ecx, dword [edi + 0x1c]
push eax
push ecx
lea ecx, [esi + 0x34]
call fcn.004301e0
xor eax, eax
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
mov dword [esi + 0x98], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0x9c], eax
call fcn.004939c9
mov al, byte [esi + 0x38]
test al, al
jne 0x41ca52
mov edx, dword [0x4dca08]
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x24]
push eax
push 0x4d7c34
push ecx
mov byte [esp + 0x59c], 0x1b
call fcn.00490e4f
mov edx, dword [esp + 0x30]
add esp, 0xc
mov ecx, edi
push 0x10
push 0x4d3d58
push edx
call fcn.004961b2
test esi, esi
mov dword [esp + 0x3c], esi
je 0x41ca41
lea ecx, [esi + 0x7c]
mov dword [esp + 0x48], ecx
mov dword [ecx], 0x4b5e74
mov byte [esp + 0x590], 0x20
call fcn.00418d00
lea ecx, [esi + 0x58]
mov byte [esp + 0x590], 0x1e
call fcn.00430190
lea ecx, [esi + 0x34]
mov byte [esp + 0x590], 0x1d
call fcn.00430190
lea ecx, [esi + 0x28]
mov byte [esp + 0x590], 0x1c
call fcn.0049354a
lea ecx, [esi + 0xc]
mov byte [esp + 0x590], 0x1b
call fcn.0049354a
push esi
call fcn.00493b2c
add esp, 4
mov byte [esp + 0x590], 0x14
lea ecx, [esp + 0x24]
jmp 0x41ccc3
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
lea edx, [esp + 0x18]
mov dword [esi + 0x18], ecx
push edx
lea ecx, [esi + 0x28]
mov dword [esi + 0x14], eax
call fcn.00493683
mov eax, dword [0x4dca08]
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x44]
push ecx
push 0x4d743c
push edx
mov byte [esp + 0x59c], 0x21
call fcn.00490e4f
add esp, 0xc
lea eax, [esp + 0x84]
push str.user_
push ebp
push eax
call fcn.004937df
push ebx
lea ecx, [esp + 0x80]
push eax
push ecx
mov byte [esp + 0x59c], 0x22
call fcn.00493779
push str.work.sf
lea edx, [esp + 0x70]
push eax
push edx
mov byte [esp + 0x59c], 0x23
call fcn.004937df
mov eax, dword [eax]
mov ecx, dword [esp + 0x44]
push eax
mov dword [esp + 0x28], ecx
push 0x64
lea ecx, [esi + 0xc]
push 0x65
mov byte [esp + 0x59c], 0x24
call fcn.0049397a
mov edx, dword [esp + 0x2c]
push eax
push 0x4d7c2c
push edx
push str.Floor
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x6c]
mov byte [esp + 0x590], 0x23
call fcn.0049354a
lea ecx, [esp + 0x7c]
mov byte [esp + 0x590], 0x22
call fcn.0049354a
lea ecx, [esp + 0x84]
mov byte [esp + 0x590], 0x21
call fcn.0049354a
push str.user_
lea eax, [esp + 0x3c]
push ebp
push eax
call fcn.004937df
push ebx
lea ecx, [esp + 0x7c]
push eax
push ecx
mov byte [esp + 0x59c], 0x25
call fcn.00493779
push str.work.sf
lea edx, [esp + 0x74]
push eax
mov byte [esp + 0x598], 0x26
push edx
call fcn.004937df
mov eax, dword [eax]
push eax
mov eax, dword [esp + 0x48]
push 0
push eax
push str.Index
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x70]
mov dword [esi + 0x2c], eax
call fcn.0049354a
lea ecx, [esp + 0x78]
mov byte [esp + 0x590], 0x25
call fcn.0049354a
lea ecx, [esp + 0x38]
mov byte [esp + 0x590], 0x21
call fcn.0049354a
push str.user_
lea ecx, [esp + 0x34]
push ebp
push ecx
call fcn.004937df
push ebx
lea edx, [esp + 0x24]
push eax
push edx
mov byte [esp + 0x59c], 0x27
call fcn.00493779
push str.work.sf
push eax
lea eax, [esp + 0x3c]
mov byte [esp + 0x598], 0x28
push eax
call fcn.004937df
mov eax, dword [eax]
mov ecx, dword [esp + 0x44]
push eax
push 0
push ecx
push str.Mask
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x34]
mov dword [esi + 0x30], eax
call fcn.0049354a
lea ecx, [esp + 0x20]
mov byte [esp + 0x590], 0x27
call fcn.0049354a
lea ecx, [esp + 0x30]
mov byte [esp + 0x590], 0x21
call fcn.0049354a
push 0xffffffffffffffff
lea ecx, [esi + 0xc]
call fcn.004939c9
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x1c]
push edx
push eax
lea ecx, [edi + 0x1cb4]
call fcn.00411f90
test eax, eax
jne 0x41ccb4
mov eax, dword [edi + 0x1cb8]
test eax, eax
jne 0x41cc7f
mov edx, dword [edi + 0x1cbc]
lea ecx, [edi + 0x1cb4]
push 1
push edx
call fcn.00405190
lea ecx, [edi + 0x1cb4]
call fcn.00405200
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x3c]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov ecx, dword [edi + 0x1cb8]
mov edx, dword [esp + 0x1c]
mov ecx, dword [ecx + edx*4]
mov dword [eax], ecx
mov edx, dword [edi + 0x1cb8]
mov ecx, dword [esp + 0x1c]
mov dword [edx + ecx*4], eax
mov dword [eax + 0xc], esi
mov byte [esp + 0x590], 0x14
lea ecx, [esp + 0x44]
call fcn.0049354a
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x41c7b0
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x40]
push 0
push 0
push 0x405
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x18]
mov byte [esp + 0x590], 0x13
call fcn.0049354a
lea ecx, [esp + 0x10]
mov byte [esp + 0x590], 0xf
call fcn.0049354a
lea ecx, [esp + 0x50]
mov byte [esp + 0x590], 0
call fcn.00478009
push 0x4d7c00
lea ecx, [esp + 0x14]
call fcn.004935b8
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov byte [esp + 0x590], 0x29
mov ecx, dword [eax - 8]
push ecx
push eax
push 0
push 0x10
mov ecx, esi
call dword [edx + 0x5c]
lea ecx, [esp + 0x10]
mov byte [esp + 0x590], 0
call fcn.0049354a
lea ecx, [esp + 0x50]
call fcn.004981c7
push str.user_
lea eax, [esp + 0x38]
push ebp
push eax
mov byte [esp + 0x59c], 0x2a
call fcn.004937df
push ebx
lea ecx, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x59c], 0x2b
call fcn.00493779
push str._sebei.sf
lea edx, [esp + 0x34]
push eax
push edx
mov byte [esp + 0x59c], 0x2c
call fcn.004937df
mov eax, dword [eax]
push 0
push 0
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x59c], 0x2d
call fcn.004982d9
lea ecx, [esp + 0x30]
mov dword [esp + 0x38], eax
mov byte [esp + 0x590], 0x2c
call fcn.0049354a
lea ecx, [esp + 0x20]
mov byte [esp + 0x590], 0x2b
call fcn.0049354a
lea ecx, [esp + 0x34]
mov byte [esp + 0x590], 0x2a
call fcn.0049354a
mov eax, dword [esp + 0x38]
test eax, eax
je 0x41d392
lea eax, [esp + 0x30]
push 1
push eax
lea ecx, [esp + 0x58]
call fcn.004983f6
mov ecx, 0x29
xor eax, eax
lea edi, [esp + 0xe4]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x30]
and eax, 0xff
sub eax, 0x80
je 0x41d0fd
dec eax
je 0x41ce53
mov ecx, dword [esp + 0x28]
push 0
push 0
push 0x4d7be4
call fcn.004961b2
jmp 0x41d381
mov dword [esp + 0x10], 0
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0x18]
push 4
push ecx
lea ecx, [esp + 0x58]
call fcn.004983f6
cmp eax, 4
jb 0x41d0a8
lea edx, [esp + 0xe4]
push 0xa4
push edx
lea ecx, [esp + 0x58]
call fcn.004983f6
cmp eax, 0xa4
jb 0x41d0a8
lea eax, [esp + 0xe4]
mov ecx, esi
push eax
call fcn.00426e00
mov ecx, dword [esp + 0x18]
cmp ecx, eax
je 0x41ceb6
inc dword [esp + 0x10]
jmp 0x41ce5f
mov edi, dword [esi + 0x1c84]
mov eax, ecx
shr eax, 4
xor edx, edx
mov dword [esp + 0x20], ecx
div edi
mov edi, edx
mov edx, dword [esi + 0x1c80]
test edx, edx
je 0x41cef1
mov eax, dword [edx + edi*4]
test eax, eax
je 0x41ceed
cmp dword [eax + 8], ecx
je 0x41cee9
mov eax, dword [eax]
test eax, eax
jne 0x41cedc
jmp 0x41ceed
test eax, eax
jne 0x41cf2a
test edx, edx
jne 0x41cf05
mov eax, dword [esi + 0x1c84]
push 1
push eax
lea ecx, [esi + 0x1c7c]
call fcn.00405190
add esi, 0x1c7c
mov ecx, esi
call fcn.00414a40
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], edi
mov dword [eax + 8], ecx
mov edx, dword [esi + 4]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [edx + edi*4], eax
lea edi, [eax + 0xc]
mov eax, dword [esp + 0x28]
mov ecx, 0x29
lea esi, [esp + 0xe4]
add eax, 0x1cb4
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41cffe
mov edi, dword [esp + 0xf8]
mov esi, dword [esp + 0x28]
mov eax, edi
add esi, 0x1cb4
shr eax, 4
xor edx, edx
div dword [esi + 8]
mov edx, dword [ecx + edx*4]
test edx, edx
je 0x41cffe
cmp dword [edx + 8], edi
je 0x41cf82
mov edx, dword [edx]
test edx, edx
jne 0x41cf75
jmp 0x41cffe
test edx, edx
je 0x41cffe
mov edx, dword [edx + 0xc]
mov edi, dword [esp + 0x18]
mov eax, edi
mov dword [esp + 0x20], edi
mov ecx, dword [edx + 0x84]
lea esi, [edx + 0x7c]
shr eax, 4
xor edx, edx
div ecx
mov ecx, dword [esi + 4]
test ecx, ecx
mov dword [esp + 0x14], edx
je 0x41cfca
mov eax, dword [ecx + edx*4]
test eax, eax
je 0x41cfc6
cmp dword [eax + 8], edi
je 0x41cfc2
mov eax, dword [eax]
test eax, eax
jne 0x41cfb5
jmp 0x41cfc6
test eax, eax
jne 0x41cffa
test ecx, ecx
jne 0x41cfd7
mov eax, dword [esi + 8]
push 1
push eax
mov ecx, esi
call fcn.00405190
mov ecx, esi
call fcn.004296b0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov edx, dword [esi + 4]
mov edx, dword [edx + ecx*4]
mov dword [eax], edx
mov edx, dword [esi + 4]
mov dword [edx + ecx*4], eax
mov byte [eax + 0xc], 1
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xe4]
mov dword [esp + 0x20], eax
push ecx
mov ecx, esi
call fcn.00426d70
mov ecx, dword [esi + 0x1ca0]
add esi, 0x1c98
mov edi, eax
mov dword [esp + 0x4c], edx
shr eax, 4
xor edx, edx
div ecx
mov eax, dword [esi + 4]
test eax, eax
mov dword [esp + 0x14], edx
je 0x41d062
mov eax, dword [eax + edx*4]
test eax, eax
je 0x41d062
mov ecx, dword [esp + 0x4c]
mov edx, dword [eax + 8]
cmp edx, edi
jne 0x41d056
mov edx, dword [eax + 0xc]
cmp edx, ecx
je 0x41d05e
mov eax, dword [eax]
test eax, eax
je 0x41d062
jmp 0x41d048
test eax, eax
jne 0x41d09c
mov eax, dword [esi + 4]
test eax, eax
jne 0x41d076
mov eax, dword [esi + 8]
push 1
push eax
mov ecx, esi
call fcn.00405190
mov ecx, esi
call fcn.00418d50
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x4c]
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
mov dword [eax + 0xc], edx
mov edx, dword [esi + 4]
mov edx, dword [edx + ecx*4]
mov dword [eax], edx
mov edx, dword [esi + 4]
mov dword [edx + ecx*4], eax
mov ecx, dword [esp + 0x20]
mov dword [eax + 0x10], ecx
jmp 0x41ce5b
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41d381
mov edx, dword [0x4dca08]
mov dword [esp + 0x10], edx
push eax
lea eax, [esp + 0x14]
push 0x4d7bbc
push eax
mov byte [esp + 0x59c], 0x2f
call fcn.00490e4f
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0
push 0x4d3d58
push ecx
mov ecx, esi
call fcn.004961b2
mov byte [esp + 0x590], 0x2a
lea ecx, [esp + 0x10]
jmp 0x41d37c
mov dword [esp + 0x24], 0
mov esi, dword [esp + 0x28]
lea edx, [esp + 0x18]
push 4
push edx
lea ecx, [esp + 0x58]
call fcn.004983f6
cmp eax, 4
jb 0x41d330
lea eax, [esp + 0xe4]
push 0xa4
push eax
lea ecx, [esp + 0x58]
call fcn.004983f6
cmp eax, 0xa4
jb 0x41d330
lea ecx, [esp + 0xe4]
push ecx
mov ecx, esi
call fcn.00426e00
cmp dword [esp + 0x18], eax
je 0x41d15e
inc dword [esp + 0x24]
jmp 0x41d109
mov edx, dword [esp + 0xe5]
and edx, 0xff
and edx, 0x8000000f
jns 0x41d178
dec edx
or edx, 0xfffffff0
inc edx
mov al, byte [esp + 0xe5]
lea ecx, [esp + 0xe4]
shr al, 4
shl al, 5
add dl, al
push ecx
mov ecx, esi
mov byte [esp + 0xe9], dl
call fcn.00426e00
lea edx, [esp + 0x10]
add esi, 0x1c7c
push edx
push eax
mov ecx, esi
mov dword [esp + 0x20], eax
mov edi, eax
call fcn.00411f90
test eax, eax
jne 0x41d1f5
mov eax, dword [esi + 4]
test eax, eax
jne 0x41d1ce
mov eax, dword [esi + 8]
push 1
push eax
mov ecx, esi
call fcn.00405190
mov ecx, esi
call fcn.00414a40
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [edx + ecx*4]
mov dword [eax], edx
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x10]
mov dword [ecx + edx*4], eax
lea edi, [eax + 0xc]
mov eax, dword [esp + 0x28]
mov ecx, 0x29
lea esi, [esp + 0xe4]
add eax, 0x1cb4
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41d2a9
mov edi, dword [esp + 0xf8]
mov esi, dword [esp + 0x28]
mov eax, edi
add esi, 0x1cb4
shr eax, 4
xor edx, edx
div dword [esi + 8]
mov edx, dword [ecx + edx*4]
test edx, edx
je 0x41d2a9
cmp dword [edx + 8], edi
je 0x41d249
mov edx, dword [edx]
test edx, edx
jne 0x41d23c
jmp 0x41d2a9
test edx, edx
je 0x41d2a9
mov edx, dword [edx + 0xc]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
mov edi, eax
lea esi, [edx + 0x7c]
push ecx
push eax
mov ecx, esi
call fcn.00411f90
test eax, eax
jne 0x41d2a5
mov eax, dword [esi + 4]
test eax, eax
jne 0x41d27e
mov edx, dword [esi + 8]
push 1
push edx
mov ecx, esi
call fcn.00405190
mov ecx, esi
call fcn.004296b0
mov ecx, dword [esp + 0x14]
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x14]
mov edx, dword [edx + ecx*4]
mov dword [eax], edx
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x14]
mov dword [ecx + edx*4], eax
mov byte [eax + 0xc], 1
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xe4]
mov dword [esp + 0x20], eax
push ecx
mov ecx, esi
call fcn.00426d70
mov edi, eax
lea eax, [esp + 0x1c]
add esi, 0x1c98
push eax
push edx
push edi
mov ecx, esi
mov dword [esp + 0x58], edx
call fcn.00418cb0
test eax, eax
jne 0x41d324
mov eax, dword [esi + 4]
test eax, eax
jne 0x41d2f6
mov ecx, dword [esi + 8]
push 1
push ecx
mov ecx, esi
call fcn.00405190
mov ecx, esi
call fcn.00418d50
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x4c]
mov dword [eax + 8], edi
mov dword [eax + 4], edx
mov dword [eax + 0xc], ecx
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x1c]
mov edx, dword [edx + ecx*4]
mov dword [eax], edx
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x1c]
mov dword [ecx + edx*4], eax
mov ecx, dword [esp + 0x20]
mov dword [eax + 0x10], ecx
jmp 0x41d105
mov eax, dword [esp + 0x24]
test eax, eax
je 0x41d381
mov edx, dword [0x4dca08]
mov dword [esp + 0x10], edx
push eax
lea eax, [esp + 0x14]
push 0x4d7bbc
push eax
mov byte [esp + 0x59c], 0x2e
call fcn.00490e4f
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0
push 0x4d3d58
push ecx
mov ecx, esi
call fcn.004961b2
mov byte [esp + 0x590], 0x2a
lea ecx, [esp + 0x10]
call fcn.0049354a
lea ecx, [esp + 0x50]
call fcn.004984f4
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x40]
push 0
push 0
push 0x405
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x50]
mov byte [esp + 0x590], 0
call fcn.0049821c
push 0x4d7b9c
lea ecx, [esp + 0x30]
call fcn.004935b8
mov eax, dword [esp + 0x2c]
mov edx, dword [esi]
mov byte [esp + 0x590], 0x30
mov ecx, dword [eax - 8]
push ecx
push eax
push 0
push 0x10
mov ecx, esi
call dword [edx + 0x5c]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x590], 0
call fcn.0049354a
mov eax, dword [0x4dca08]
mov dword [esp + 0x18], eax
push str.user_
lea ecx, [esp + 0x38]
push ebp
push ecx
mov byte [esp + 0x59c], 0x31
call fcn.004937df
push ebx
lea edx, [esp + 0x24]
push eax
push edx
mov byte [esp + 0x59c], 0x32
call fcn.00493779
push str.work.sf
push eax
lea eax, [esp + 0x38]
mov byte [esp + 0x598], 0x33
push eax
call fcn.004937df
mov eax, dword [eax]
lea ecx, [esp + 0x18]
push eax
push 0xa
push 0xa
mov byte [esp + 0x59c], 0x34
call fcn.0049397a
push eax
push 0x4d3f48
push str.Count
push 0x4d3730
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x30]
mov byte [esp + 0x590], 0x33
call fcn.0049354a
lea ecx, [esp + 0x20]
mov byte [esp + 0x590], 0x32
call fcn.0049354a
lea ecx, [esp + 0x34]
mov byte [esp + 0x590], 0x31
call fcn.0049354a
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
call fcn.004939c9
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0047edbd
add esp, 4
mov dword [esp + 0x38], eax
mov dword [esp + 0x10], 0
test eax, eax
jle 0x41d59a
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0x4d743c
push eax
call fcn.00490e4f
add esp, 0xc
lea ecx, [esp + 0x34]
push str.user_
push ebp
push ecx
call fcn.004937df
push ebx
lea edx, [esp + 0x24]
push eax
push edx
mov byte [esp + 0x59c], 0x35
call fcn.00493779
push str.work.sf
push eax
lea eax, [esp + 0x38]
mov byte [esp + 0x598], 0x36
push eax
call fcn.004937df
mov eax, dword [eax]
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x18c]
push 0x400
push ecx
push 0x4e0dd0
push edx
push 0x4d3730
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x30]
call fcn.0049354a
lea ecx, [esp + 0x20]
mov byte [esp + 0x590], 0x35
call fcn.0049354a
lea ecx, [esp + 0x34]
mov byte [esp + 0x590], 0x31
call fcn.0049354a
lea eax, [esp + 0x188]
lea ecx, [edi + 0x1e84]
push eax
call fcn.00492897
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x41d4cf
mov ecx, dword [esp + 0x40]
push 0
push 0
push 0x405
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x18]
mov byte [esp + 0x590], 0
call fcn.0049354a
push 0x4d7b7c
lea ecx, [esp + 0x30]
call fcn.004935b8
mov eax, dword [esp + 0x2c]
mov edx, dword [esi]
mov byte [esp + 0x590], 0x37
mov ecx, dword [eax - 8]
push ecx
push eax
push 0
push 0x10
mov ecx, esi
call dword [edx + 0x5c]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x590], 0
call fcn.0049354a
mov eax, dword [edi + 0x1b2c]
push 0
dec eax
mov byte [edi + 0x114], 0xff
push 0
je 0x41d645
push 0x88
push 0x4b8568
mov ecx, edi
call fcn.004a42b6
push 0
push 0
push 0x84
push 0x4b59a0
mov ecx, edi
mov dword [edi + 0x1c58], eax
call fcn.004a42b6
mov dword [edi + 0x1c5c], eax
jmp 0x41d65c
push 0x98
push 0x4b8130
mov ecx, edi
call fcn.004a42b6
mov dword [edi + 0x1c54], eax
push 0
push 0
push 0x82
push 0x4b6e70
mov ecx, edi
call fcn.004a42b6
mov dword [edi + 0x1c50], eax
mov eax, dword [edi + 0x1cc0]
mov ecx, dword [edi + 0x1c50]
neg eax
sbb eax, eax
mov dword [ecx + 0xd0], 0xffffffff
test eax, eax
je 0x41d800
jmp 0x41d69f
mov eax, dword [esp + 0x30]
mov edx, dword [0x4dca08]
mov dword [esp + 0x10], edx
cmp eax, 0xffffffff
mov byte [esp + 0x590], 0x38
jne 0x41d6d6
mov esi, dword [edi + 0x1cbc]
xor ecx, ecx
test esi, esi
jbe 0x41d6d6
mov edx, dword [edi + 0x1cb8]
mov eax, dword [edx]
test eax, eax
jne 0x41d6d6
inc ecx
add edx, 4
cmp ecx, esi
jb 0x41d6c8
mov ecx, dword [eax]
test ecx, ecx
mov dword [esp + 0x14], ecx
jne 0x41d70f
mov ecx, dword [eax + 4]
mov edx, dword [edi + 0x1cbc]
inc ecx
cmp ecx, edx
jae 0x41d70f
mov edx, dword [edi + 0x1cb8]
lea edx, [edx + ecx*4]
mov esi, dword [edx]
test esi, esi
mov dword [esp + 0x14], esi
jne 0x41d70f
mov esi, dword [edi + 0x1cbc]
inc ecx
add edx, 4
cmp ecx, esi
jb 0x41d6f7
mov ecx, dword [esp + 0x14]
mov esi, dword [eax + 0xc]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax + 8]
push ecx
lea edx, [esp + 0x14]
push 0x4d743c
push edx
mov dword [esp + 0x38], ecx
call fcn.00490e4f
add esp, 0xc
lea eax, [esp + 0x38]
push str.user_
push ebp
push eax
call fcn.004937df
push ebx
lea ecx, [esp + 0x38]
push eax
push ecx
mov byte [esp + 0x59c], 0x39
call fcn.00493779
push str.work.sf
lea edx, [esp + 0x24]
push eax
push edx
mov byte [esp + 0x59c], 0x3a
call fcn.004937df
mov eax, dword [eax]
push eax
mov eax, dword [esp + 0x14]
push 0x64
push eax
push str.FloorZoom
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x20]
mov dword [esi + 8], eax
call fcn.0049354a
lea ecx, [esp + 0x34]
mov byte [esp + 0x590], 0x39
call fcn.0049354a
lea ecx, [esp + 0x38]
mov byte [esp + 0x590], 0x38
call fcn.0049354a
mov eax, dword [esp + 0x2c]
mov dword [esi], 0
cmp eax, 0x320
mov dword [esi + 4], 0
jae 0x41d7e3
mov eax, dword [edi + 0x1c50]
mov ecx, dword [esp + 0x2c]
cmp dword [eax + 0xd0], ecx
jge 0x41d7e3
mov dword [eax + 0xd0], ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x590], 0
call fcn.0049354a
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x41d69b
mov ecx, dword [edi + 0x1c50]
push 3
call fcn.00497a41
mov ecx, dword [edi + 0x1c50]
mov ecx, dword [ecx + 0xd8]
call fcn.00413870
mov edx, dword [edi + 0x1c50]
mov ecx, dword [edx + 0xd8]
call fcn.004141e0
mov eax, dword [esp + 0x40]
mov dword [edi + 0x1c20], 1
push 0
push 0
mov ecx, dword [eax + 0x1c]
push 0x405
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x88]
call fcn.004952c0
mov ecx, edi
call fcn.00426240
lea ecx, [esp + 0x88]
mov dword [esp + 0x590], 0xffffffff
call fcn.00493d90
mov ecx, dword [esp + 0x588]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x584
ret