Function at 0x6c8e50
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x734fc6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd0
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x40]
call fcn.005b3190
lea ecx, [esp + 0x2c]
mov dword [esp + 0xe4], 0
call fcn.005b3190
lea ecx, [esp + 0x58]
mov byte [esp + 0xe4], 1
call fcn.005b3190
push 0x748e98
lea ecx, [esp + 0x1c]
mov byte [esp + 0xe8], 2
call fcn.005e5a90
mov edi, dword [ebp + 8]
push 0
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
mov byte [esp + 0xec], 3
call fcn.005e5eb0
lea ecx, [esp + 0x18]
mov ebx, eax
mov byte [esp + 0xe4], 2
call fcn.005e5c20
push ebx
lea ecx, [esp + 0x3c]
push ecx
mov ecx, edi
call fcn.005e5f70
mov ecx, eax
mov byte [esp + 0xe4], 4
call fcn.005e5630
lea ecx, [esp + 0x38]
mov dword [esi + 0x1c8], eax
mov byte [esp + 0xe4], 2
call fcn.005e5c20
mov ecx, edi
call fcn.005e5790
mov edx, 0xfffffffd
sub edx, ebx
add eax, edx
push eax
lea eax, [esp + 0x3c]
push eax
mov ecx, edi
call fcn.005e6170
push eax
lea ecx, [esi + 0x1e0]
mov byte [esp + 0xe8], 5
call fcn.005e5c50
lea ecx, [esp + 0x38]
mov byte [esp + 0xe4], 2
call fcn.005e5c20
push str.SAVES:
lea ecx, [esp + 0x4c]
call fcn.005e5a90
push edi
lea ecx, [esp + 0x3c]
push ecx
mov bl, 6
mov ecx, eax
mov byte [esp + 0xec], bl
call fcn.005e5d10
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xe8], 7
call fcn.005e5c50
lea ecx, [esp + 0x38]
mov byte [esp + 0xe4], bl
call fcn.005e5c20
lea ecx, [esp + 0x48]
mov byte [esp + 0xe4], 2
call fcn.005e5c20
mov ecx, dword [0x7a39e8]
lea edx, [esp + 0x2c]
push edx
call fcn.00408800
push str.CORRUPT
lea ecx, [esp + 0x6c]
call fcn.005e5a90
push 0x73d8f4
lea ecx, [esp + 0x64]
mov byte [esp + 0xe8], 8
call fcn.005e5a90
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x8c]
push ecx
lea ecx, [esp + 0x34]
mov byte [esp + 0xec], 9
call fcn.005e5d10
lea edx, [esp + 0x68]
push edx
lea ecx, [esp + 0x84]
push ecx
mov ecx, eax
mov byte [esp + 0xec], 0xa
call fcn.005e5d10
push 0
push eax
mov eax, dword [0x7a39e0]
mov ecx, dword [eax + 0xc]
lea edx, [esp + 0x58]
push edx
mov byte [esp + 0xf0], 0xb
call fcn.005e68a0
lea ecx, [esp + 0x80]
mov byte [esp + 0xe4], 0x10
call fcn.005e5c20
lea ecx, [esp + 0x88]
mov byte [esp + 0xe4], 0xf
call fcn.005e5c20
lea ecx, [esp + 0x60]
mov byte [esp + 0xe4], 0xe
call fcn.005e5c20
lea ecx, [esp + 0x68]
mov byte [esp + 0xe4], 0xd
call fcn.005e5c20
push 0x73d5b0
lea ecx, [esp + 0x3c]
call fcn.005e5a90
push str.CORRUPT
lea ecx, [esp + 0x4c]
mov byte [esp + 0xe8], 0x11
call fcn.005e5a90
push 0x73d8f4
lea ecx, [esp + 0x74]
mov byte [esp + 0xe8], 0x12
call fcn.005e5a90
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x94]
push edx
lea ecx, [esp + 0x34]
mov byte [esp + 0xec], 0x13
call fcn.005e5d10
mov byte [esp + 0xe4], 0x14
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x7c]
push edx
mov ecx, eax
call fcn.005e5d10
lea ecx, [esp + 0x38]
push ecx
push 0
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0xf0], 0x15
call fcn.005e68d0
lea ecx, [esp + 0x78]
mov byte [esp + 0xe4], 0x1b
call fcn.005e5c20
lea ecx, [esp + 0x90]
mov byte [esp + 0xe4], 0x1a
call fcn.005e5c20
lea ecx, [esp + 0x70]
mov byte [esp + 0xe4], 0x19
call fcn.005e5c20
lea ecx, [esp + 0x48]
mov byte [esp + 0xe4], 0x18
call fcn.005e5c20
mov bl, 0x17
lea ecx, [esp + 0x38]
mov byte [esp + 0xe4], bl
call fcn.005e5c20
lea ecx, [esp + 0x34]
call fcn.005e6a10
test eax, eax
je 0x6c919b
mov ecx, dword [esi + 0x1c4]
or ecx, 3
lea edx, [esp + 0x2c]
mov dword [esi + 0x1c4], ecx
mov ecx, dword [0x7a39e8]
push edx
call fcn.004088d0
jmp 0x6c96ad
push 0xa0
call fcn.006fa7e6
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
test edi, edi
mov byte [esp + 0xe4], 0x1c
je 0x6c91e5
push str.savenfo
lea ecx, [esp + 0x9c]
call fcn.00406d80
lea eax, [esp + 0x98]
push eax
push str.NFO
push 0
mov ecx, edi
call fcn.00410630
mov edi, eax
jmp 0x6c91e7
xor edi, edi
lea ecx, [esp + 0xc]
push ecx
mov ecx, edi
mov byte [esp + 0xe8], bl
call fcn.00411240
push 0x73d71c
lea ecx, [esp + 0x1c]
call fcn.005e5a90
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push str.AREANAME
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x34]
push edx
mov ecx, edi
mov byte [esp + 0xf8], 0x1d
call fcn.00411ec0
push eax
lea ecx, [esi + 0x1e8]
mov byte [esp + 0xe8], 0x1e
call fcn.005e5c50
lea ecx, [esp + 0x24]
mov byte [esp + 0xe4], 0x1d
call fcn.005e5c20
lea ecx, [esp + 0x18]
mov byte [esp + 0xe4], bl
call fcn.005e5c20
push 0x73d71c
lea ecx, [esp + 0x1c]
call fcn.005e5a90
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
push str.LASTMODULE
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, edi
mov byte [esp + 0xf8], 0x1f
call fcn.00411ec0
push eax
lea ecx, [esi + 0x1f0]
mov byte [esp + 0xe8], 0x20
call fcn.005e5c50
lea ecx, [esp + 0x24]
mov byte [esp + 0xe4], 0x1f
call fcn.005e5c20
lea ecx, [esp + 0x18]
mov byte [esp + 0xe4], bl
call fcn.005e5c20
push 0
lea ecx, [esp + 0x14]
push ecx
push str.TIMEPLAYED
lea edx, [esp + 0x18]
push edx
mov ecx, edi
call fcn.00411c20
push 0x73d71c
lea ecx, [esp + 0x1c]
mov dword [esi + 0x1cc], eax
call fcn.005e5a90
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
push str.SAVEGAMENAME
lea edx, [esp + 0x18]
mov byte [esp + 0xf0], 0x21
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, edi
call fcn.00411ec0
lea ecx, [esi + 0x1d8]
push eax
mov byte [esp + 0xe8], 0x22
call fcn.005e5c50
lea ecx, [esp + 0x24]
mov byte [esp + 0xe4], 0x21
call fcn.005e5c20
lea ecx, [esp + 0x18]
mov byte [esp + 0xe4], bl
call fcn.005e5c20
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x6c9393
push str.Old_Save_Game
lea ecx, [esp + 0x1c]
call fcn.005e5a90
push eax
lea ecx, [esi + 0x1d8]
mov byte [esp + 0xe8], 0x23
call fcn.005e5c50
lea ecx, [esp + 0x18]
mov byte [esp + 0xe4], bl
call fcn.005e5c20
push 0
lea ecx, [esp + 0x14]
push ecx
push str.CHEATUSED
lea edx, [esp + 0x18]
push edx
mov ecx, edi
call fcn.00411a60
mov ecx, dword [esi + 0x1c4]
movzx eax, al
shl eax, 7
xor eax, ecx
and eax, 0x80
xor ecx, eax
mov dword [esi + 0x1c4], ecx
push 0
lea ecx, [esp + 0x14]
push ecx
push str.REBOOTAUTOSAVE
lea edx, [esp + 0x18]
push edx
mov ecx, edi
call fcn.00411a60
mov ecx, dword [esi + 0x1c4]
movzx eax, al
shl eax, 3
xor eax, ecx
and eax, 8
xor ecx, eax
mov dword [esi + 0x1c4], ecx
push 0
lea ecx, [esp + 0x14]
push ecx
push str.PCAUTOSAVE
lea edx, [esp + 0x18]
push edx
mov ecx, edi
call fcn.00411a60
mov ecx, dword [esi + 0x1c4]
movzx eax, al
shl eax, 4
xor eax, ecx
and eax, 0x10
xor ecx, eax
mov dword [esi + 0x1c4], ecx
push 0x73d71c
lea ecx, [esp + 0x1c]
call fcn.005e5a90
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push str.SCREENSHOT
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, edi
mov byte [esp + 0xf8], 0x24
call fcn.00411ec0
push eax
lea ecx, [esi + 0x208]
mov byte [esp + 0xe8], 0x25
call fcn.005e5c50
lea ecx, [esp + 0x24]
mov byte [esp + 0xe4], 0x24
call fcn.005e5c20
lea ecx, [esp + 0x18]
mov byte [esp + 0xe4], bl
call fcn.005e5c20
mov dl, byte [esi + 0x1d4]
mov byte [esp + 0x14], dl
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push str.GAMEPLAYHINT
lea edx, [esp + 0x18]
push edx
mov ecx, edi
call fcn.00411a60
mov byte [esi + 0x1d4], al
mov al, byte [esi + 0x1d5]
mov byte [esp + 0x14], al
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push str.STORYHINT
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.00411a60
push 0
lea ecx, [esp + 0x14]
push ecx
push str.LIVECONTENT
lea edx, [esp + 0x18]
push edx
mov ecx, edi
mov byte [esi + 0x1d5], al
call fcn.00411a60
test al, al
mov byte [esp + 0x23], al
je 0x6c95e8
lea ecx, [esp + 0x24]
call fcn.005b3190
cmp byte [0x73ecd2], 1
mov byte [esp + 0xe4], 0x26
mov dword [esp + 0x14], 1
jbe 0x6c95d8
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push str.LIVE_d
push ecx
call fcn.005e5680
add esp, 0xc
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
call fcn.005e5670
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x28]
push edx
mov ecx, edi
call fcn.00411ec0
mov ecx, dword [0x7a39e0]
mov ecx, dword [ecx + 0xc]
push 0
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0xec], 0x27
call fcn.005e6890
mov ecx, eax
call fcn.005e5790
test eax, eax
jne 0x6c95af
mov ecx, dword [esp + 0x14]
mov al, byte [esp + 0x23]
dec ecx
mov edx, 1
shl edx, cl
test al, dl
jne 0x6c971c
lea ecx, [esp + 0x18]
mov byte [esp + 0xe4], 0x26
call fcn.005e5c20
mov eax, dword [esp + 0x14]
movzx ecx, byte [0x73ecd2]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x6c9533
lea ecx, [esp + 0x24]
mov byte [esp + 0xe4], bl
call fcn.005e5c20
lea edx, [esi + 0x218]
xor ebx, ebx
mov dword [esp + 0x14], edx
push ebx
push str.PORTRAIT
lea eax, [esp + 0x48]
push 0x73edd0
push eax
call fcn.005e5680
add esp, 0x10
push 0x73d71c
lea ecx, [esp + 0xac]
call fcn.00406d80
lea ecx, [esp + 0xa8]
push ecx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x48]
call fcn.005e5670
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xc8]
push ecx
mov ecx, edi
call fcn.00411e10
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0xcc]
push edx
call fcn.00406120
mov ecx, dword [esp + 0x14]
inc ebx
add ecx, 0x10
cmp ebx, 3
mov dword [esp + 0x14], ecx
jl 0x6c95f4
test edi, edi
je 0x6c9677
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [0x7a39e8]
call fcn.004088d0
mov edx, dword [esi + 0x1c4]
and edx, 0xffffffdd
push 0x73d71c
lea ecx, [esi + 0x210]
mov dword [esi + 0x1c4], edx
call fcn.005e5140
or dword [esi + 0x1c4], 1
lea ecx, [esp + 0x34]
mov byte [esp + 0xe4], 0xd
call fcn.005e69e0
lea ecx, [esp + 0x50]
mov byte [esp + 0xe4], 2
call fcn.005e5c20
lea ecx, [esp + 0x58]
mov byte [esp + 0xe4], 1
call fcn.005e5c20
lea ecx, [esp + 0x2c]
mov byte [esp + 0xe4], 0
call fcn.005e5c20
lea ecx, [esp + 0x40]
mov dword [esp + 0xe4], 0xffffffff
call fcn.005e5c20
mov ecx, dword [esp + 0xdc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
or dword [esi + 0x1c4], 0x21
lea edx, [esp + 0x18]
push edx
lea ecx, [esi + 0x210]
call fcn.005e5c50
test edi, edi
je 0x6c973f
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [0x7a39e8]
call fcn.004088d0
lea ecx, [esp + 0x18]
mov byte [esp + 0xe4], 0x26
call fcn.005e5c20
lea ecx, [esp + 0x24]
mov byte [esp + 0xe4], bl
call fcn.005e5c20
jmp 0x6c96ad