Function at 0x407ae0
Capabilities:
Get common file path
Get graphical window text
Get process heap flags
Get process heap force flags
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x43156b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x288
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x445928
lea ecx, [esp + 0x14]
call fcn.004289e3
push 0x104
lea ecx, [esp + 0x14]
mov dword [esp + 0x2a4], 0
call fcn.00428c9e
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.00428ced
push str.config.ini
lea ecx, [esp + 0x14]
call fcn.00428c77
mov eax, dword [esi + 0x1e0]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x44156c
push 0
push 0x143
push eax
call edi
mov ecx, dword [esi + 0x1e0]
push 0x441560
push 0
push 0x143
push ecx
call edi
mov edx, dword [esi + 0x1e0]
push 0x441554
push 0
push 0x143
push edx
call edi
mov eax, dword [esi + 0x1e0]
push 0
push 0
push 0x14e
push eax
call edi
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push ecx
push 0
push str.GetRoom
push str.SYSTEM
call ebp
mov edx, dword [esi + 0x1e0]
push 0
push eax
push 0x14e
push edx
call edi
mov eax, dword [esi + 0x1a4]
push str.CT5T4
push 0
push 0x143
push eax
call edi
mov ecx, dword [esi + 0x1a4]
push 0x441524
push 0
push 0x143
push ecx
call edi
mov edx, dword [esi + 0x1a4]
push 0x44151c
push 0
push 0x143
push edx
call edi
push 0x441510
push 0
push 0x143
mov eax, dword [esi + 0x1a4]
push eax
call edi
mov ecx, dword [esi + 0x1a4]
push 0x441508
push 0
push 0x143
push ecx
call edi
mov edx, dword [esi + 0x1a4]
push 0
push 4
push 0x14e
push edx
call edi
mov eax, dword [esp + 0x10]
push eax
push 0
push str.DMode
push str.SYSTEM
call ebp
mov ecx, dword [esi + 0x1a4]
push 0
push eax
push 0x14e
push ecx
call edi
mov edx, dword [esi + 0x168]
push 0x4414f8
push 0
push 0x143
push edx
call edi
mov eax, dword [esi + 0x168]
push 0x4414f0
push 0
push 0x143
push eax
call edi
mov ecx, dword [esi + 0x168]
push 0x4414e8
push 0
push 0x143
push ecx
call edi
mov edx, dword [esi + 0x168]
push 0x4414e0
push 0
push 0x143
push edx
call edi
mov eax, dword [esi + 0x168]
push 0
push 0
push 0x14e
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
push 0
push str.cgTeam
push str.SYSTEM
call ebp
mov edx, dword [esi + 0x168]
push 0
push eax
push 0x14e
push edx
call edi
mov eax, dword [esi + 0x12c]
push 0x4414cc
push 0
push 0x143
push eax
call edi
mov ecx, dword [esi + 0x12c]
push 0x4414c0
push 0
push 0x143
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
push 0
push str.RmManager
push str.SYSTEM
call ebp
push 0
push eax
mov eax, dword [esi + 0x12c]
push 0x14e
push eax
call edi
push 0x4414ac
lea ecx, [esp + 0x40]
call fcn.004289e3
push 0x4414a4
lea ecx, [esp + 0x44]
mov byte [esp + 0x2a4], 1
call fcn.004289e3
push 0x44149c
lea ecx, [esp + 0x48]
mov byte [esp + 0x2a4], 2
call fcn.004289e3
push 0x441494
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2a4], 3
call fcn.004289e3
push 0x44148c
lea ecx, [esp + 0x50]
mov byte [esp + 0x2a4], 4
call fcn.004289e3
push 0x441484
lea ecx, [esp + 0x54]
mov byte [esp + 0x2a4], 5
call fcn.004289e3
push 0x44147c
lea ecx, [esp + 0x58]
mov byte [esp + 0x2a4], 6
call fcn.004289e3
push 0x441474
lea ecx, [esp + 0x5c]
mov byte [esp + 0x2a4], 7
call fcn.004289e3
push 0x44146c
lea ecx, [esp + 0x60]
mov byte [esp + 0x2a4], 8
call fcn.004289e3
push 0x441464
lea ecx, [esp + 0x64]
mov byte [esp + 0x2a4], 9
call fcn.004289e3
mov byte [esp + 0x2a0], 0xa
lea ebx, [esp + 0x3c]
mov dword [esp + 0x14], 0xa
mov eax, dword [ebx]
mov ecx, dword [esi + 0xf0]
push eax
push 0
push 0x143
push ecx
call edi
mov eax, dword [esp + 0x14]
add ebx, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x407e2d
mov edx, dword [esp + 0x10]
push edx
push 0
push str.Serv
push str.SYSTEM
call ebp
push 0
push eax
mov eax, dword [esi + 0xf0]
push 0x14e
push eax
call edi
push 0x441458
lea ecx, [esp + 0x1c]
call fcn.004289e3
push 0x441454
lea ecx, [esp + 0x20]
mov byte [esp + 0x2a4], 0xb
call fcn.004289e3
push 0x441450
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a4], 0xc
call fcn.004289e3
push 0x44144c
lea ecx, [esp + 0x28]
mov byte [esp + 0x2a4], 0xd
call fcn.004289e3
push 0x441448
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2a4], 0xe
call fcn.004289e3
push 0x441444
lea ecx, [esp + 0x30]
mov byte [esp + 0x2a4], 0xf
call fcn.004289e3
push 0x441440
lea ecx, [esp + 0x34]
mov byte [esp + 0x2a4], 0x10
call fcn.004289e3
push 0x44143c
lea ecx, [esp + 0x38]
mov byte [esp + 0x2a4], 0x11
call fcn.004289e3
push 0x441438
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2a4], 0x12
call fcn.004289e3
mov byte [esp + 0x2a0], 0x13
lea ebx, [esp + 0x18]
mov dword [esp + 0x14], 9
mov eax, dword [ebx]
mov ecx, dword [esi + 0xb4]
push eax
push 0
push 0x143
push ecx
call edi
mov eax, dword [esp + 0x14]
add ebx, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x407f44
mov edx, dword [esp + 0x10]
push edx
push 0
push str.ServNum
push str.SYSTEM
call ebp
push 0
push eax
mov eax, dword [esi + 0xb4]
push 0x14e
push eax
call edi
push 0x44142c
lea ecx, [esp + 0x68]
call fcn.004289e3
push 0x441428
lea ecx, [esp + 0x6c]
mov byte [esp + 0x2a4], 0x14
call fcn.004289e3
push 0x441424
lea ecx, [esp + 0x70]
mov byte [esp + 0x2a4], 0x15
call fcn.004289e3
push 0x441420
lea ecx, [esp + 0x74]
mov byte [esp + 0x2a4], 0x16
call fcn.004289e3
push 0x44141c
lea ecx, [esp + 0x78]
mov byte [esp + 0x2a4], 0x17
call fcn.004289e3
push 0x441418
lea ecx, [esp + 0x7c]
mov byte [esp + 0x2a4], 0x18
call fcn.004289e3
push 0x441414
lea ecx, [esp + 0x80]
mov byte [esp + 0x2a4], 0x19
call fcn.004289e3
push 0x441410
lea ecx, [esp + 0x84]
mov byte [esp + 0x2a4], 0x1a
call fcn.004289e3
push 0x44140c
lea ecx, [esp + 0x88]
mov byte [esp + 0x2a4], 0x1b
call fcn.004289e3
push 0x441404
lea ecx, [esp + 0x8c]
mov byte [esp + 0x2a4], 0x1c
call fcn.004289e3
push 0x4413fc
lea ecx, [esp + 0x90]
mov byte [esp + 0x2a4], 0x1d
call fcn.004289e3
push 0x4413f4
lea ecx, [esp + 0x94]
mov byte [esp + 0x2a4], 0x1e
call fcn.004289e3
push 0x4413ec
lea ecx, [esp + 0x98]
mov byte [esp + 0x2a4], 0x1f
call fcn.004289e3
mov byte [esp + 0x2a0], 0x20
lea ebx, [esp + 0x64]
mov dword [esp + 0x14], 0xd
mov eax, dword [ebx]
mov ecx, dword [esi + 0x78]
push eax
push 0
push 0x143
push ecx
call edi
mov eax, dword [esp + 0x14]
add ebx, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x4080c8
mov edx, dword [esp + 0x10]
push edx
push 0
push str.Pindao
push str.SYSTEM
call ebp
push 0
push eax
mov eax, dword [esi + 0x78]
push 0x14e
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
push 3
push str.StartDelay
push str.SYSTEM
call ebp
mov edx, dword [esp + 0x10]
mov byte [esi + 0x200], al
push edx
push 1
push str.WaitTime
push str.SYSTEM
call ebp
mov byte [esi + 0x201], al
mov eax, dword [esp + 0x10]
push eax
push 7
push str.Pipei
push str.SYSTEM
call ebp
mov ecx, dword [esp + 0x10]
mov byte [esi + 0x203], al
push ecx
push 5
push str.RmPepNum
push str.SYSTEM
call ebp
mov edx, dword [esp + 0x10]
mov byte [esi + 0x202], al
push edx
push 1
push str.JionWaitRoom
push str.SYSTEM
call ebp
mov dword [esi + 0x204], eax
mov eax, dword [esp + 0x10]
push eax
push 1
push str.ScrollFind
push str.SYSTEM
call ebp
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x208], eax
push ecx
push 1
push str.ReFriend
push str.SYSTEM
call ebp
mov edx, dword [esp + 0x10]
mov dword [esi + 0x20c], eax
push edx
push 0
push str.OutRing
push str.SYSTEM
call ebp
mov dword [esi + 0x210], eax
mov eax, dword [esp + 0x10]
push eax
push 1
push str.TuanDui
push str.SYSTEM
call ebp
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x98]
push ecx
push 0xff
push edx
mov dword [esi + 0x214], eax
push 0x445928
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x44137c
push str.SYSTEM
call edi
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x198]
push eax
push 0xff
push ecx
push 0x445928
push str.Pass
push str.SYSTEM
call edi
lea edx, [esp + 0x98]
lea eax, [esi + 0x218]
push edx
push 0x441370
push eax
call fcn.0042438b
add esp, 0xc
lea ecx, [esp + 0x198]
lea edx, [esi + 0x21c]
push ecx
push 0x441370
push edx
call fcn.0042438b
add esp, 0xc
mov ecx, esi
push 0
call fcn.004275a1
lea ecx, [esp + 0x94]
mov byte [esp + 0x2a0], 0x1f
call fcn.004289b9
lea ecx, [esp + 0x90]
mov byte [esp + 0x2a0], 0x1e
call fcn.004289b9
lea ecx, [esp + 0x8c]
mov byte [esp + 0x2a0], 0x1d
call fcn.004289b9
lea ecx, [esp + 0x88]
mov byte [esp + 0x2a0], 0x1c
call fcn.004289b9
lea ecx, [esp + 0x84]
mov byte [esp + 0x2a0], 0x1b
call fcn.004289b9
lea ecx, [esp + 0x80]
mov byte [esp + 0x2a0], 0x1a
call fcn.004289b9
lea ecx, [esp + 0x7c]
mov byte [esp + 0x2a0], 0x19
call fcn.004289b9
lea ecx, [esp + 0x78]
mov byte [esp + 0x2a0], 0x18
call fcn.004289b9
lea ecx, [esp + 0x74]
mov byte [esp + 0x2a0], 0x17
call fcn.004289b9
lea ecx, [esp + 0x70]
mov byte [esp + 0x2a0], 0x16
call fcn.004289b9
lea ecx, [esp + 0x6c]
mov byte [esp + 0x2a0], 0x15
call fcn.004289b9
lea ecx, [esp + 0x68]
mov byte [esp + 0x2a0], 0x14
call fcn.004289b9
lea ecx, [esp + 0x64]
mov byte [esp + 0x2a0], 0x13
call fcn.004289b9
lea ecx, [esp + 0x38]
mov byte [esp + 0x2a0], 0x12
call fcn.004289b9
lea ecx, [esp + 0x34]
mov byte [esp + 0x2a0], 0x11
call fcn.004289b9
lea ecx, [esp + 0x30]
mov byte [esp + 0x2a0], 0x10
call fcn.004289b9
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2a0], 0xf
call fcn.004289b9
lea ecx, [esp + 0x28]
mov byte [esp + 0x2a0], 0xe
call fcn.004289b9
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a0], 0xd
call fcn.004289b9
lea ecx, [esp + 0x20]
mov byte [esp + 0x2a0], 0xc
call fcn.004289b9
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2a0], 0xb
call fcn.004289b9
lea ecx, [esp + 0x18]
mov byte [esp + 0x2a0], 0xa
call fcn.004289b9
lea ecx, [esp + 0x60]
mov byte [esp + 0x2a0], 9
call fcn.004289b9
lea ecx, [esp + 0x5c]
mov byte [esp + 0x2a0], 8
call fcn.004289b9
lea ecx, [esp + 0x58]
mov byte [esp + 0x2a0], 7
call fcn.004289b9
lea ecx, [esp + 0x54]
mov byte [esp + 0x2a0], 6
call fcn.004289b9
lea ecx, [esp + 0x50]
mov byte [esp + 0x2a0], 5
call fcn.004289b9
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2a0], 4
call fcn.004289b9
lea ecx, [esp + 0x48]
mov byte [esp + 0x2a0], 3
call fcn.004289b9
lea ecx, [esp + 0x44]
mov byte [esp + 0x2a0], 2
call fcn.004289b9
lea ecx, [esp + 0x40]
mov byte [esp + 0x2a0], 1
call fcn.004289b9
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2a0], 0
call fcn.004289b9
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a0], 0xffffffff
call fcn.004289b9
mov ecx, dword [esp + 0x298]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x294
ret