Function at 0x4af5d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69c1b4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi], 0x6ad824
mov dword [esp + 0x68], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
lea ecx, [esi + 0x3c]
mov byte [esp + 0x68], 1
call fcn.005167e0
lea ecx, [esi + 0x510]
mov byte [esp + 0x68], 2
call fcn.005167e0
lea ecx, [esi + 0x9e4]
mov byte [esp + 0x68], 3
call fcn.005167e0
lea ecx, [esi + 0xeb8]
mov byte [esp + 0x68], 4
call fcn.005167e0
lea ebp, [esi + 0x1390]
mov ecx, ebp
mov byte [esp + 0x68], 5
call fcn.0051c930
lea ecx, [esi + 0x1400]
mov byte [esp + 0x68], 6
call fcn.00421bb0
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
add eax, 0x3c
add ecx, 0x23
mov dword [esi + 0x138c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0x16c
mov dword [esi + 0x10], 0x15a
mov eax, dword [0x21ea84c]
cmp eax, edi
mov byte [esp + 0x68], 7
jne 0x4af6c4
xor ecx, ecx
jmp 0x4af6cf
mov ecx, dword [0x21ea850]
sub ecx, eax
sar ecx, 2
mov edx, dword [esp + 0x78]
cmp edx, ecx
jge 0x4af6e3
lea eax, [eax + edx*4]
mov dword [0x21ea858], eax
mov eax, dword [eax]
jmp 0x4af6e5
xor eax, eax
push ebx
mov dword [esi + 0x28], eax
mov edx, 0x60
mov eax, 0x40
mov dword [esp + 0x40], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x3c]
push edx
mov ebx, 0x80
lea eax, [esp + 0x50]
push eax
mov eax, dword [esi + 8]
lea edx, [esp + 0x64]
push edx
push 1
push ebx
push ebx
push str.Letter_Btn_Recv.tga
push edi
push 0x1c
push 0x43
mov ecx, 0x20
push ecx
push ebx
push 0x137
push 0x81
mov dword [esp + 0xa0], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x68], ecx
mov ecx, dword [esi + 4]
push eax
push ecx
lea ecx, [esi + 0x3c]
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], edi
mov dword [esp + 0xa4], ebx
mov dword [esp + 0x8c], edi
mov dword [esp + 0x94], ebx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x84], ebx
mov dword [esp + 0x6c], edi
mov dword [esp + 0x74], ebx
mov dword [esp + 0x5c], edi
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
call fcn.005180c0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esi + 8]
lea edx, [esp + 0x50]
push edx
mov edx, dword [esi + 4]
lea eax, [esp + 0x64]
push eax
push 1
push ebx
push ebx
push str.Letter_Btn_Reply.tga
push edi
push 0x1c
push 0x43
push 0x20
push ebx
push 0x137
push 0xc9
push ecx
push edx
lea ecx, [esi + 0x510]
call fcn.005180c0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x3c]
push edx
mov edx, dword [esi + 8]
lea eax, [esp + 0x50]
push eax
mov eax, dword [esi + 4]
lea ecx, [esp + 0x64]
push ecx
push 1
push ebx
push ebx
push str.Letter_Btn_Del.tga
push edi
push 0x1c
push 0x43
push 0x20
push ebx
push 0x137
push 0x112
push edx
push eax
lea ecx, [esi + 0x9e4]
call fcn.005180c0
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x3f800000
push edi
push 0x3f400000
push 0x3f000000
push 0x3f800000
push edi
push 0x3f000000
push 0x3e800000
push 0x3f800000
push edi
push 0x3e800000
push edi
mov ecx, dword [esi + 8]
push 1
mov edx, dword [esi + 4]
push 0x20
push ebx
push str.talk1_close_button.tga
push edi
push 0x16
push 0x16
push 0x20
push 0x20
push 6
push 0x150
push ecx
push edx
lea ecx, [esi + 0xeb8]
call fcn.00517f80
push 0xff
push 0xff
push 0xff
push 0xffffffffffffffff
push 0x104
push edi
push edi
push edi
push edi
mov ecx, ebp
call fcn.0051c4c0
push 0xf
mov ecx, ebp
call fcn.0051c420
mov ecx, ebp
call fcn.0051c7b0
mov eax, dword [esi + 0x28]
cmp eax, edi
pop ebx
je 0x4af8db
add eax, 4
push eax
mov ecx, ebp
call fcn.0051d080
mov ecx, 0x21ec34c
call fcn.00523c40
push 0x200
push 0x200
push str.Letter_Bg_Recv.tga
push str.data_interface
lea ecx, [esi + 0x2c]
call fcn.00538940
mov eax, dword [esi + 0x28]
cmp eax, edi
je 0x4af926
cmp byte [eax + 0x153], 3
jne 0x4af91c
cmp dword [eax + 0x127], edi
jne 0x4af91c
push edi
jmp 0x4af91e
push 1
lea ecx, [esi + 0x3c]
call fcn.00516a50
mov ecx, dword [esp + 0x60]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x60
ret 0xc