Function at 0x40c090
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x443633
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c0
mov eax, dword [0x452504]
push ebx
push ebp
push esi
push edi
push 0x17c
push 0x30c
xor ebx, ebx
push ebx
mov dword [esp + 0x2d8], eax
push ebx
lea eax, [esp + 0x60]
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_SetRect]
push 0x30
mov dword [esi + 0x58], 3
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x70], esi
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], ebx
je 0x409efa
mov ecx, eax
call fcn.004015a0
mov ebp, eax
jmp 0x409efc
xor ebp, ebp
push 0x126
mov dword [esp + 0x2dc], 0xffffffff
call fcn.00401810
push eax
mov ecx, ebp
call fcn.00401610
push 0x50
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 1
je 0x409f41
mov ecx, eax
call fcn.0040e4d0
mov edi, eax
jmp 0x409f43
xor edi, edi
push esi
push 0x1043
push 7
push 0x2d7
push 0x44654a
push ebp
mov ecx, edi
mov dword [esp + 0x2f0], 0xffffffff
call fcn.0040e820
test al, al
je 0x409fc5
push 0xc
push str.BTN_MINIMIZE
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00402c70
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x64]
mov dword [esp + 0x2dc], 2
call fcn.00409000
mov dword [eax], edi
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0x2d8], 0xffffffff
jb 0x409fc5
mov edx, dword [esp + 0x18]
push edx
call fcn.00435091
add esp, 4
push 0x30
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 3
je 0x409fed
mov ecx, eax
call fcn.004015a0
mov ebp, eax
jmp 0x409fef
xor ebp, ebp
push 0x127
mov dword [esp + 0x2dc], 0xffffffff
call fcn.00401810
push eax
mov ecx, ebp
call fcn.00401610
push 0x50
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 4
je 0x40a034
mov ecx, eax
call fcn.0040e4d0
mov edi, eax
jmp 0x40a036
xor edi, edi
push esi
push 0x1044
push 7
push 0x2ee
push 0x44654a
push ebp
mov ecx, edi
mov dword [esp + 0x2f0], 0xffffffff
call fcn.0040e820
test al, al
je 0x40a0bb
push 9
push str.BTN_CLOSE
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00402c70
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 0x64]
mov dword [esp + 0x2dc], 5
call fcn.00409000
mov dword [eax], edi
mov eax, dword [esp + 0x2c]
or ebp, 0xffffffff
cmp eax, 0x10
mov dword [esp + 0x2d8], ebp
jb 0x40a0be
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00435091
add esp, 4
jmp 0x40a0be
or ebp, 0xffffffff
push 0x130
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 6
je 0x40a0e7
mov ecx, eax
call fcn.00419970
jmp 0x40a0e9
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
mov dword [esp + 0x2dc], ebp
mov dword [esi + 0x80], eax
call edi
mov edx, dword [esi + 4]
mov ecx, dword [esi + 0x80]
push eax
push 0x1045
push edx
push 0x151
push 0x194
push 0x21
push 0xb
push 0x40000000
push str.IE_ADVERTISE
call fcn.00419830
test eax, eax
je 0x40a15d
call fcn.00415fa0
push 1
lea ecx, [esp + 0xc8]
push ecx
lea ecx, [eax + 0x6160]
call fcn.00405340
mov ecx, dword [esi + 0x80]
lea edx, [esp + 0xc4]
push edx
call fcn.00419550
push 0x130
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 7
je 0x40a186
mov ecx, eax
call fcn.00419970
jmp 0x40a188
xor eax, eax
push ebx
mov dword [esp + 0x2dc], ebp
mov dword [esi + 0x84], eax
call edi
mov ecx, dword [esi + 0x84]
push eax
mov eax, dword [esi + 4]
push 0x1046
push eax
push 0x97
push 0x15b
push 0x21
push 0x1a7
push 0x40000000
push str.IE_GAMERATE
call fcn.00419830
test eax, eax
je 0x40a1f8
call fcn.00415fa0
push ebx
lea ecx, [esp + 0xc8]
push ecx
lea ecx, [eax + 0x6160]
call fcn.00405340
mov ecx, dword [esi + 0x84]
lea edx, [esp + 0xc4]
push edx
call fcn.00419550
push 0x38
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 8
je 0x40a220
mov ecx, eax
call fcn.00402020
mov edi, eax
jmp 0x40a222
xor edi, edi
push ebx
push esi
push 0xf4
push 0x2b1
push 0xe0
push 0x1b3
push 0x1015
push 0x40000000
push 0x44654a
push str.EDIT
push 0x20200
mov ecx, edi
mov dword [esp + 0x304], ebp
mov byte [edi + 0x30], bl
call fcn.00402420
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
je 0x40a356
call fcn.00415fa0
cmp dword [eax + 0x590c], ebx
jne 0x40a2ab
call fcn.00415fa0
add eax, 0x5804
push eax
mov eax, dword [edi + 4]
push ebx
push 0xc
push eax
call ebp
mov eax, dword [esi + 0x8c]
mov ecx, dword [edi + 4]
push ebx
push eax
push 0x30
push ecx
call ebp
mov edx, dword [edi]
push ebx
mov ecx, edi
call dword [edx + 4]
jmp 0x40a2fd
push 0x104
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
movsx ecx, byte [esp + 0xc4]
push ecx
lea edx, [esp + 0x1cc]
push str._c:Hangame
push edx
call fcn.004352bf
mov ecx, dword [edi + 4]
add esp, 0xc
lea eax, [esp + 0x1c8]
push eax
push ebx
push 0xc
push ecx
call ebp
mov eax, dword [esi + 0x8c]
mov edx, dword [edi + 4]
push ebx
push eax
push 0x30
push edx
call ebp
push 8
push str.EDT_PATH
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00402c70
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 0x64]
mov dword [esp + 0x2dc], 9
call fcn.00409000
mov dword [eax], edi
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0x2d8], 0xffffffff
jb 0x40a356
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00435091
add esp, 4
push 0x30
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 0xa
je 0x40a380
mov ecx, eax
call fcn.004015a0
mov dword [esp + 0x10], eax
jmp 0x40a384
mov dword [esp + 0x10], ebx
push 0x12a
mov dword [esp + 0x2dc], 0xffffffff
call fcn.00401810
mov ecx, dword [esp + 0x14]
push eax
call fcn.00401610
push 0x50
call fcn.0043565d
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 0xb
je 0x40a3cb
mov ecx, eax
call fcn.0040e4d0
mov edi, eax
jmp 0x40a3cd
xor edi, edi
mov edx, dword [esp + 0x10]
push esi
push 0x1016
push 0xe0
push 0x2b7
push 0x44654a
push edx
mov ecx, edi
mov dword [esp + 0x2f0], 0xffffffff
call fcn.0040e820
test al, al
je 0x40a46b
call fcn.00415fa0
cmp dword [eax + 0x590c], ebx
jne 0x40a412
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 4]
push 0xe
push str.BTN_SELECT_DIR
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00402c70
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x64]
mov dword [esp + 0x2dc], 0xc
call fcn.00409000
mov dword [eax], edi
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0x2d8], 0xffffffff
jb 0x40a46b
mov edx, dword [esp + 0x18]
push edx
call fcn.00435091
add esp, 4
push 0x38
call fcn.0043565d
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 0xd
je 0x40a493
mov ecx, eax
call fcn.00402020
mov edi, eax
jmp 0x40a495
xor edi, edi
push ebx
push esi
push 0x113
push 0x2f3
push 0x106
push 0x1b3
push 0x1017
push 0x40008002
push 0x44654a
push str.BUTTON
push ebx
mov ecx, edi
mov dword [esp + 0x304], 0xffffffff
mov byte [edi + 0x30], bl
call fcn.00402420
test eax, eax
je 0x40a58b
push 0x104
lea eax, [esp + 0x64]
push eax
push 0x141
call fcn.0041a480
mov eax, dword [esi + 0x8c]
mov ecx, dword [edi + 4]
add esp, 0xc
push ebx
push eax
push 0x30
push ecx
call ebp
mov eax, dword [edi + 4]
lea edx, [esp + 0x60]
push edx
push ebx
push 0xc
push eax
call ebp
push 0xb
push str.CHK_HANGAME
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00402c70
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x64]
mov dword [esp + 0x2dc], 0xe
call fcn.00409000
mov dword [eax], edi
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0x2d8], 0xffffffff
jb 0x40a56b
mov edx, dword [esp + 0x18]
push edx
call fcn.00435091
add esp, 4
mov eax, dword [edi + 4]
push ebx
push 1
push 0xf1
push eax
call ebp
call fcn.00415fa0
push 8
lea ecx, [eax + 0x51e8]
call fcn.00402480
push 0x38
call fcn.0043565d
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 0xf
je 0x40a5b3
mov ecx, eax
call fcn.00402020
mov edi, eax
jmp 0x40a5b5
xor edi, edi
push ebx
push esi
push 0x12a
push 0x2f3
push 0x11d
push 0x1b3
push 0x1018
push 0x40008002
push 0x44654a
push str.BUTTON
push ebx
mov ecx, edi
mov dword [esp + 0x304], 0xffffffff
mov byte [edi + 0x30], bl
call fcn.00402420
test eax, eax
je 0x40a6b3
push 0x104
lea ecx, [esp + 0x64]
push ecx
push 0x142
call fcn.0041a480
mov eax, dword [esi + 0x8c]
mov edx, dword [edi + 4]
add esp, 0xc
push ebx
push eax
push 0x30
push edx
call ebp
mov ecx, dword [edi + 4]
lea eax, [esp + 0x60]
push eax
push ebx
push 0xc
push ecx
call ebp
mov edx, dword [edi + 4]
push ebx
push 1
push 0xf1
push edx
call ebp
mov eax, dword [edi + 4]
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00415fa0
push 0x14
push str.CHK_HANGAMEFLASHINST
lea ecx, [esp + 0x1c]
mov dword [eax + 0x591c], 1
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00402c70
lea ecx, [esp + 0x14]
push ecx
mov ebp, 0x10
lea ecx, [esi + 0x64]
mov dword [esp + 0x2dc], ebp
call fcn.00409000
mov dword [eax], edi
cmp dword [esp + 0x2c], ebp
mov dword [esp + 0x2d8], 0xffffffff
jb 0x40a6b3
mov edx, dword [esp + 0x18]
push edx
call fcn.00435091
add esp, 4
push 0x30
call fcn.0043565d
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 0x11
je 0x40a6db
mov ecx, eax
call fcn.004015a0
mov ebp, eax
jmp 0x40a6dd
xor ebp, ebp
push 0x124
mov dword [esp + 0x2dc], 0xffffffff
call fcn.00401810
push eax
mov ecx, ebp
call fcn.00401610
push 0x50
call fcn.0043565d
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 0x12
je 0x40a722
mov ecx, eax
call fcn.0040e4d0
mov edi, eax
jmp 0x40a724
xor edi, edi
push esi
push 0x101a
push 0x145
push 0x209
push 0x44654a
push ebp
mov ecx, edi
mov dword [esp + 0x2f0], 0xffffffff
call fcn.0040e820
test al, al
je 0x40a7b6
push 0x10
mov ebp, 0xf
push str.BTN_STARTINSTALL
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.00402c70
lea eax, [esp + 0x34]
push eax
lea ecx, [esi + 0x64]
mov dword [esp + 0x2dc], 0x13
call fcn.00409000
mov dword [eax], edi
cmp dword [esp + 0x4c], 0x10
mov dword [esp + 0x2d8], 0xffffffff
jb 0x40a7aa
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00435091
add esp, 4
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
call fcn.00415fa0
mov ecx, dword [esp + 0x2d0]
pop edi
pop esi
mov dword [eax + 0x5910], 1
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x2c0]
pop ebx
call fcn.00435083
add esp, 0x2cc
ret
push 0xffffffffffffffff
push 0x44372a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c0
mov eax, dword [0x452504]
push ebx
push ebp
push esi
push edi
push 0x17c
push 0x30c
xor ebx, ebx
push ebx
mov dword [esp + 0x2d8], eax
push ebx
lea eax, [esp + 0x60]
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_SetRect]
push 0x30
mov dword [esi + 0x58], 3
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x70], esi
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], ebx
je 0x40a86a
mov ecx, eax
call fcn.004015a0
mov ebp, eax
jmp 0x40a86c
xor ebp, ebp
push 0x126
mov dword [esp + 0x2dc], 0xffffffff
call fcn.00401810
push eax
mov ecx, ebp
call fcn.00401610
push 0x50
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 1
je 0x40a8b1
mov ecx, eax
call fcn.0040e4d0
mov edi, eax
jmp 0x40a8b3
xor edi, edi
push esi
push 0x1043
push 7
push 0x2d7
push 0x44654a
push ebp
mov ecx, edi
mov dword [esp + 0x2f0], 0xffffffff
call fcn.0040e820
test al, al
je 0x40a935
push 0xc
push str.BTN_MINIMIZE
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00402c70
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x64]
mov dword [esp + 0x2dc], 2
call fcn.00409000
mov dword [eax], edi
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0x2d8], 0xffffffff
jb 0x40a935
mov edx, dword [esp + 0x18]
push edx
call fcn.00435091
add esp, 4
push 0x30
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 3
je 0x40a95d
mov ecx, eax
call fcn.004015a0
mov ebp, eax
jmp 0x40a95f
xor ebp, ebp
push 0x127
mov dword [esp + 0x2dc], 0xffffffff
call fcn.00401810
push eax
mov ecx, ebp
call fcn.00401610
push 0x50
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 4
je 0x40a9a4
mov ecx, eax
call fcn.0040e4d0
mov edi, eax
jmp 0x40a9a6
xor edi, edi
push esi
push 0x1044
push 7
push 0x2ee
push 0x44654a
push ebp
mov ecx, edi
mov dword [esp + 0x2f0], 0xffffffff
call fcn.0040e820
test al, al
je 0x40aa2b
push 9
push str.BTN_CLOSE
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00402c70
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 0x64]
mov dword [esp + 0x2dc], 5
call fcn.00409000
mov dword [eax], edi
mov eax, dword [esp + 0x2c]
or ebp, 0xffffffff
cmp eax, 0x10
mov dword [esp + 0x2d8], ebp
jb 0x40aa2e
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00435091
add esp, 4
jmp 0x40aa2e
or ebp, 0xffffffff
push 0x130
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 6
je 0x40aa57
mov ecx, eax
call fcn.00419970
jmp 0x40aa59
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
mov dword [esp + 0x2dc], ebp
mov dword [esi + 0x80], eax
call edi
mov edx, dword [esi + 4]
mov ecx, dword [esi + 0x80]
push eax
push 0x1045
push edx
push 0x151
push 0x194
push 0x21
push 0xb
push 0x40000000
push str.IE_ADVERTISE
call fcn.00419830
test eax, eax
je 0x40aacd
call fcn.00415fa0
push 1
lea ecx, [esp + 0xc8]
push ecx
lea ecx, [eax + 0x6160]
call fcn.00405340
mov ecx, dword [esi + 0x80]
lea edx, [esp + 0xc4]
push edx
call fcn.00419550
push 0x130
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 7
je 0x40aaf6
mov ecx, eax
call fcn.00419970
jmp 0x40aaf8
xor eax, eax
push ebx
mov dword [esp + 0x2dc], ebp
mov dword [esi + 0x84], eax
call edi
mov ecx, dword [esi + 0x84]
push eax
mov eax, dword [esi + 4]
push 0x1046
push eax
push 0x97
push 0x15b
push 0x21
push 0x1a7
push 0x40000000
push str.IE_GAMERATE
call fcn.00419830
test eax, eax
je 0x40ab68
call fcn.00415fa0
push ebx
lea ecx, [esp + 0xc8]
push ecx
lea ecx, [eax + 0x6160]
call fcn.00405340
mov ecx, dword [esi + 0x84]
lea edx, [esp + 0xc4]
push edx
call fcn.00419550
push 0x38
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 8
je 0x40ab90
mov ecx, eax
call fcn.00402020
mov edi, eax
jmp 0x40ab92
xor edi, edi
push ebx
push esi
push 0xf4
push 0x2b1
push 0xe0
push 0x1b3
push 0x1015
push 0x40000000
push 0x44654a
push str.EDIT
push 0x20200
mov ecx, edi
mov dword [esp + 0x304], ebp
mov byte [edi + 0x30], bl
call fcn.00402420
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
je 0x40acc6
call fcn.00415fa0
cmp dword [eax + 0x590c], ebx
jne 0x40ac1b
call fcn.00415fa0
add eax, 0x5804
push eax
mov eax, dword [edi + 4]
push ebx
push 0xc
push eax
call ebp
mov eax, dword [esi + 0x8c]
mov ecx, dword [edi + 4]
push ebx
push eax
push 0x30
push ecx
call ebp
mov edx, dword [edi]
push ebx
mov ecx, edi
call dword [edx + 4]
jmp 0x40ac6d
push 0x104
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
movsx ecx, byte [esp + 0xc4]
push ecx
lea edx, [esp + 0x1cc]
push str._c:Hangame
push edx
call fcn.004352bf
mov ecx, dword [edi + 4]
add esp, 0xc
lea eax, [esp + 0x1c8]
push eax
push ebx
push 0xc
push ecx
call ebp
mov eax, dword [esi + 0x8c]
mov edx, dword [edi + 4]
push ebx
push eax
push 0x30
push edx
call ebp
push 8
push str.EDT_PATH
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00402c70
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 0x64]
mov dword [esp + 0x2dc], 9
call fcn.00409000
mov dword [eax], edi
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0x2d8], 0xffffffff
jb 0x40acc6
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00435091
add esp, 4
push 0x30
call fcn.0043565d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 0xa
je 0x40acf0
mov ecx, eax
call fcn.004015a0
mov dword [esp + 0x10], eax
jmp 0x40acf4
mov dword [esp + 0x10], ebx
push 0x12a
mov dword [esp + 0x2dc], 0xffffffff
call fcn.00401810
mov ecx, dword [esp + 0x14]
push eax
call fcn.00401610
push 0x50
call fcn.0043565d
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 0xb
je 0x40ad3b
mov ecx, eax
call fcn.0040e4d0
mov edi, eax
jmp 0x40ad3d
xor edi, edi
mov edx, dword [esp + 0x10]
push esi
push 0x1016
push 0xe0
push 0x2b7
push 0x44654a
push edx
mov ecx, edi
mov dword [esp + 0x2f0], 0xffffffff
call fcn.0040e820
test al, al
je 0x40addb
call fcn.00415fa0
cmp dword [eax + 0x590c], ebx
jne 0x40ad82
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 4]
push 0xe
push str.BTN_SELECT_DIR
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00402c70
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x64]
mov dword [esp + 0x2dc], 0xc
call fcn.00409000
mov dword [eax], edi
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0x2d8], 0xffffffff
jb 0x40addb
mov edx, dword [esp + 0x18]
push edx
call fcn.00435091
add esp, 4
push 0x38
call fcn.0043565d
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 0xd
je 0x40ae03
mov ecx, eax
call fcn.00402020
mov edi, eax
jmp 0x40ae05
xor edi, edi
push ebx
push esi
push 0x120
push 0x2f3
push 0x113
push 0x1b3
push 0x1017
push 0x40008002
push 0x44654a
push str.BUTTON
push ebx
mov ecx, edi
mov dword [esp + 0x304], 0xffffffff
mov byte [edi + 0x30], bl
call fcn.00402420
test eax, eax
je 0x40af9c
call fcn.00415fa0
cmp dword [eax + 0x12550], 3
jne 0x40ae6f
push 0x104
lea eax, [esp + 0x64]
push eax
push 0x143
jmp 0x40aef5
call fcn.00415fa0
cmp dword [eax + 0x12550], 4
jne 0x40ae8e
push 0x104
lea ecx, [esp + 0x64]
push ecx
push 0x145
jmp 0x40aef5
call fcn.00415fa0
cmp dword [eax + 0x12550], 6
jne 0x40aead
push 0x104
lea edx, [esp + 0x64]
push edx
push 0x144
jmp 0x40aef5
call fcn.00415fa0
cmp dword [eax + 0x12550], 7
jne 0x40aecc
push 0x104
lea eax, [esp + 0x64]
push eax
push 0x146
jmp 0x40aef5
call fcn.00415fa0
cmp dword [eax + 0x12550], 8
push 0x104
jne 0x40aeeb
lea ecx, [esp + 0x64]
push ecx
push 0x147
jmp 0x40aef5
lea edx, [esp + 0x64]
push edx
push 0x13f
call fcn.0041a480
mov eax, dword [esi + 0x8c]
add esp, 0xc
push ebx
push eax
mov eax, dword [edi + 4]
push 0x30
push eax
call ebp
mov edx, dword [edi + 4]
lea ecx, [esp + 0x60]
push ecx
push ebx
push 0xc
push edx
call ebp
mov eax, dword [edi + 4]
push ebx
push 1
push 0xf1
push eax
call ebp
mov ecx, dword [edi + 4]
push ebx
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00415fa0
push 0x14
push str.CHK_HANGAMEFLASHINST
lea ecx, [esp + 0x1c]
mov dword [eax + 0x591c], 1
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00402c70
lea edx, [esp + 0x14]
push edx
lea ecx, [esi + 0x64]
mov dword [esp + 0x2dc], 0xe
call fcn.00409000
mov dword [eax], edi
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0x2d8], 0xffffffff
jb 0x40af9c
mov eax, dword [esp + 0x18]
push eax
call fcn.00435091
add esp, 4
push 0x30
call fcn.0043565d
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 0xf
je 0x40afc4
mov ecx, eax
call fcn.004015a0
mov ebp, eax
jmp 0x40afc6
xor ebp, ebp
push 0x124
mov dword [esp + 0x2dc], 0xffffffff
call fcn.00401810
push eax
mov ecx, ebp
call fcn.00401610
push 0x50
call fcn.0043565d
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov dword [esp + 0x2d8], 0x10
je 0x40b00b
mov ecx, eax
call fcn.0040e4d0
mov edi, eax
jmp 0x40b00d
xor edi, edi
push esi
push 0x101a
push 0x145
push 0x209
push 0x44654a
push ebp
mov ecx, edi
mov dword [esp + 0x2f0], 0xffffffff
call fcn.0040e820
test al, al
je 0x40b09f
push 0x10
mov ebp, 0xf
push str.BTN_STARTINSTALL
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.00402c70
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esi + 0x64]
mov dword [esp + 0x2dc], 0x11
call fcn.00409000
mov dword [eax], edi
cmp dword [esp + 0x4c], 0x10
mov dword [esp + 0x2d8], 0xffffffff
jb 0x40b093
mov edx, dword [esp + 0x38]
push edx
call fcn.00435091
add esp, 4
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
call fcn.00415fa0
mov ecx, dword [esp + 0x2d0]
pop edi
pop esi
mov dword [eax + 0x5910], 1
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x2c0]
pop ebx
call fcn.00435083
add esp, 0x2cc
ret
push esi
mov esi, ecx
call fcn.00415fa0
mov dword [eax + 0x5f4c], 1
call fcn.00415fa0
lea ecx, [eax + 0x6160]
call fcn.004056c0
test eax, eax
je 0x40c0be
mov ecx, esi
pop esi
jmp 0x409e80
call fcn.00415fa0
lea ecx, [eax + 0x6160]
call fcn.004056d0
test eax, eax
mov ecx, esi
je 0x40c0da
pop esi
jmp 0x40a7f0
call fcn.004092e0
call fcn.00415fa0
lea ecx, [eax + 0x51f0]
call fcn.0040f1c0
call fcn.00415fa0
mov esi, eax
call fcn.00415fa0
add esi, 0x5f50
add eax, 0xbcf7
push esi
push eax
call fcn.0041c0f0
add esp, 8
pop esi
ret