Function at 0x426040
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x69a3bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
xor eax, eax
mov dword [esi], 0x6aae58
push edi
lea edi, [esi + 0xc]
mov dword [esp + 0x10], esi
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
push fcn.005113d0
push fcn.00511260
push 2
push 0x4d4
lea ebx, [esi + 0x1c]
push ebx
mov dword [esp + 0x30], eax
call fcn.005bbc4b
push fcn.005113d0
push fcn.00511260
push 2
push 0x4d4
lea ebp, [esi + 0x9c4]
push ebp
mov byte [esp + 0x30], 1
call fcn.005bbc4b
lea ecx, [esi + 0x136c]
mov byte [esp + 0x1c], 2
call fcn.00511260
mov eax, dword [esp + 0x24]
cmp eax, 0xa
mov byte [esp + 0x1c], 3
mov dword [esi + 0x1840], eax
jle 0x4260e6
mov dword [esi + 0x1844], 0xa
jmp 0x4260ec
mov dword [esi + 0x1844], eax
push 0x80
push pe_nt_image_headers32
push str.change_item.tga
push str.data_interface
mov ecx, edi
call fcn.00533680
mov eax, dword [0x708794]
add eax, 0xffffffae
mov dword [esi + 4], eax
mov ecx, dword [0x708798]
add ecx, 0xffffffce
xor edi, edi
cmp eax, edi
mov dword [esi + 8], ecx
jge 0x426129
mov dword [esi + 4], edi
jmp 0x426140
lea edx, [eax + 0xa4]
mov eax, dword [0x6f355c]
cmp edx, eax
jle 0x426140
add eax, 0xffffff5c
mov dword [esi + 4], eax
mov eax, dword [esi + 8]
cmp eax, edi
jge 0x42614c
mov dword [esi + 8], edi
jmp 0x42615e
lea ecx, [eax + 0x64]
mov eax, dword [0x6f3560]
cmp ecx, eax
jle 0x42615e
add eax, 0xffffff9c
mov dword [esi + 8], eax
push 0x3f000000
push edi
push 0x3f800000
push 0x3f400000
push edi
push edi
push edi
push edi
push 0x3f000000
push edi
push 0x3f400000
push 0x3f000000
push 0x3f000000
push edi
push 0x3f000000
push 0x3e800000
push 0x3f000000
push edi
push 0x3e800000
push edi
mov edx, dword [esi + 8]
push 1
mov eax, dword [esi + 4]
push 0x40
push pe_nt_image_headers32
push str.stats_on_button.tga
push edi
push 0x14
push 0x2e
push 0x20
push 0x40
push 0x45
push 0x1d
push edx
push eax
mov ecx, ebx
call fcn.00512a00
push 0x3f800000
push 0x3f000000
push 0x3f800000
push 0x3f400000
push edi
push edi
push edi
push edi
push 0x3f800000
push 0x3f000000
push 0x3f400000
push 0x3f000000
push 0x3f800000
push 0x3f000000
push 0x3f000000
push 0x3e800000
push 0x3f800000
push 0x3f000000
push 0x3e800000
push edi
mov ecx, dword [esi + 8]
push 1
mov edx, dword [esi + 4]
push 0x40
push pe_nt_image_headers32
push str.stats_on_button.tga
push edi
push 0x14
push 0x2e
push 0x20
push 0x40
push 0x45
push 0x58
push ecx
push edx
lea ecx, [esi + 0x4f0]
call fcn.00512a00
push 0x3f000000
push edi
push 0x3f800000
push 0x3f400000
push edi
push edi
push edi
push edi
push 0x3f000000
push edi
push 0x3f400000
push 0x3f000000
push 0x3f000000
push edi
push 0x3f000000
push 0x3e800000
push 0x3f000000
push edi
push 0x3e800000
push edi
mov eax, dword [esi + 8]
push 1
mov ecx, dword [esi + 4]
push 0x40
push 0x80
push str.stats_on_select_button.tga
push edi
push 0x16
push 0x16
push 0x20
push 0x20
push 0x1f
push 0x6c
push eax
push ecx
mov ecx, ebp
call fcn.00512a00
push 0x3f800000
push 0x3f000000
push 0x3f800000
push 0x3f400000
push edi
push edi
push edi
push edi
push 0x3f800000
push 0x3f000000
push 0x3f400000
push 0x3f000000
push 0x3f800000
push 0x3f000000
push 0x3f000000
push 0x3e800000
push 0x3f800000
push 0x3f000000
push 0x3e800000
push edi
mov edx, dword [esi + 8]
push 1
mov eax, dword [esi + 4]
push 0x40
push 0x80
push str.stats_on_select_button.tga
push edi
push 0x16
push 0x16
push 0x20
push 0x20
push 0x1f
push 0x81
push edx
push eax
lea ecx, [esi + 0xe98]
call fcn.00512a00
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x3f800000
push edi
push 0x3f400000
push 0x3f000000
push 0x3f800000
push edi
push 0x3f000000
push 0x3e800000
push 0x3f800000
push edi
push 0x3e800000
push edi
mov ecx, dword [esi + 8]
push 1
mov edx, dword [esi + 4]
push 0x20
push 0x80
push str.talk1_close_button.tga
push edi
push 0x16
push 0x16
push 0x20
push 0x20
push 1
push 0x8a
push ecx
push edx
lea ecx, [esi + 0x136c]
call fcn.00512a00
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x1848], edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4