Function at 0x480020
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51aaac
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x56858c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov dword [edi], vtable.ModeSoundScene::CModeSound.0
mov dword [ebp - 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
lea esi, [edi + 0x48]
mov dword [edi + 0x14], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], 0xffffffff
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], 0xff
mov dword [edi + 0x40], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x5c], ebx
mov ecx, 0x56a4b4
mov byte [ebp - 4], 3
call fcn.00416a20
mov ecx, dword [0x5699f0]
mov eax, dword [ecx + 0x18]
cmp eax, ebx
jne 0x4800c0
xor ecx, ecx
jmp 0x4800d6
mov edx, dword [ecx + 0x20]
cmp edx, ebx
je 0x4800cc
mov edx, dword [edx + 0xc]
jmp 0x4800ce
xor edx, edx
mov ecx, dword [ecx + 0x1c]
imul ecx, edx
add ecx, eax
push str.bg_black.bgd
push esi
call fcn.004324d0
test al, al
je 0x4804c2
mov ecx, 0x56a4b4
call fcn.00416a20
mov eax, dword [0x5699f0]
mov edx, dword [eax + 0x30]
cmp edx, ebx
jne 0x480103
xor ecx, ecx
jmp 0x480119
mov ecx, dword [eax + 0x38]
cmp ecx, ebx
je 0x48010f
mov esi, dword [ecx + 0xc]
jmp 0x480111
xor esi, esi
mov ecx, dword [eax + 0x34]
imul ecx, esi
add ecx, edx
push 2
call fcn.00466420
push 0x78
call fcn.00503a77
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 4
cmp eax, ebx
je 0x48013e
mov ecx, eax
call fcn.0047fd00
jmp 0x480140
xor eax, eax
push eax
lea ecx, [edi + 8]
mov byte [ebp - 4], 3
call fcn.004740f0
mov ecx, 0x56a4b4
call fcn.00416a20
mov ecx, dword [0x5699f0]
mov eax, dword [ecx + 0x18]
cmp eax, ebx
jne 0x480168
xor ecx, ecx
jmp 0x48017e
mov edx, dword [ecx + 0x20]
cmp edx, ebx
je 0x480174
mov edx, dword [edx + 0xc]
jmp 0x480176
xor edx, edx
mov ecx, dword [ecx + 0x1c]
imul ecx, edx
add ecx, eax
lea eax, [ebp - 0x20]
push eax
call fcn.004753f0
push eax
lea ecx, [edi + 0x54]
mov byte [ebp - 4], 5
call fcn.0043d940
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x4801c4
dec dword [eax + 4]
mov ecx, eax
cmp dword [eax + 4], ebx
jne 0x4801c4
cmp byte [ecx + 8], bl
je 0x4801b4
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x4801c4
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
mov ecx, 0x56a451
call fcn.004074f0
mov ecx, dword [0x5699e4]
push ebx
call fcn.00474c40
mov ecx, 0x56a451
call fcn.004074f0
mov ecx, dword [0x5699e4]
call fcn.00474cb0
mov ecx, 0x56a4b4
call fcn.00416a20
mov eax, dword [0x5699f0]
mov ecx, dword [eax + 0x30]
cmp ecx, ebx
jne 0x480209
xor eax, eax
jmp 0x48021f
mov edx, dword [eax + 0x38]
cmp edx, ebx
je 0x480215
mov edx, dword [edx + 0xc]
jmp 0x480217
xor edx, edx
mov eax, dword [eax + 0x34]
imul eax, edx
add eax, ecx
push ebx
lea ecx, [eax + 0x1c]
push 0x52791c
call fcn.004049b0
mov ecx, 0x56a4bc
call fcn.00416ad0
mov esi, dword [0x5699f4]
mov ecx, dword [esi + 0x34]
sub ecx, dword [esi + 0x30]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 2
jbe 0x480282
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
je 0x480282
mov edx, dword [eax + 0x20]
cmp edx, ebx
je 0x480276
mov eax, dword [eax + 0x1c]
mov edx, dword [edx + 0xc]
imul eax, edx
add eax, ecx
jmp 0x480284
mov eax, dword [eax + 0x1c]
xor edx, edx
imul eax, edx
add eax, ecx
jmp 0x480284
xor eax, eax
mov ecx, 0x56a4bc
mov dword [eax + 4], ebx
call fcn.00416ad0
mov esi, dword [0x5699f4]
mov ecx, dword [esi + 0x34]
sub ecx, dword [esi + 0x30]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jbe 0x4802dc
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
je 0x4802dc
mov edx, dword [eax + 0x20]
cmp edx, ebx
je 0x4802d0
mov eax, dword [eax + 0x1c]
mov edx, dword [edx + 0xc]
imul eax, edx
add eax, ecx
jmp 0x4802de
mov eax, dword [eax + 0x1c]
xor edx, edx
imul eax, edx
add eax, ecx
jmp 0x4802de
xor eax, eax
mov ecx, 0x56a4bc
mov byte [eax + 9], bl
call fcn.00416ad0
mov esi, dword [0x5699f4]
mov ecx, dword [esi + 0x34]
sub ecx, dword [esi + 0x30]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 2
jbe 0x480336
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
je 0x480336
mov edx, dword [eax + 0x20]
cmp edx, ebx
je 0x48032a
mov eax, dword [eax + 0x1c]
mov edx, dword [edx + 0xc]
imul eax, edx
add eax, ecx
jmp 0x480338
mov eax, dword [eax + 0x1c]
xor edx, edx
imul eax, edx
add eax, ecx
jmp 0x480338
xor eax, eax
mov ecx, 0x56a4bc
mov byte [eax + 0x24], 1
call fcn.00416ad0
mov esi, dword [0x5699f4]
mov ecx, dword [esi + 0x34]
sub ecx, dword [esi + 0x30]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jbe 0x480391
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
je 0x480391
mov edx, dword [eax + 0x20]
cmp edx, ebx
je 0x480385
mov eax, dword [eax + 0x1c]
mov edx, dword [edx + 0xc]
imul eax, edx
add eax, ecx
jmp 0x480393
mov eax, dword [eax + 0x1c]
xor edx, edx
imul eax, edx
add eax, ecx
jmp 0x480393
xor eax, eax
mov ecx, 0x56a4bc
mov byte [eax + 0x25], 1
call fcn.00416ad0
mov esi, dword [0x5699f4]
mov ecx, dword [esi + 0x34]
sub ecx, dword [esi + 0x30]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 2
jbe 0x4803ec
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
je 0x4803ec
mov edx, dword [eax + 0x20]
cmp edx, ebx
je 0x4803e0
mov eax, dword [eax + 0x1c]
mov edx, dword [edx + 0xc]
imul eax, edx
add eax, ecx
jmp 0x4803ee
mov eax, dword [eax + 0x1c]
xor edx, edx
imul eax, edx
add eax, ecx
jmp 0x4803ee
xor eax, eax
mov ecx, 0x56a4bc
mov byte [eax + 0x26], bl
call fcn.00416ad0
mov esi, dword [0x5699f4]
mov ecx, dword [esi + 0x34]
sub ecx, dword [esi + 0x30]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jbe 0x480453
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
jne 0x48042d
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x480456
mov edx, dword [eax + 0x20]
cmp edx, ebx
je 0x480444
mov eax, dword [eax + 0x1c]
mov edx, dword [edx + 0xc]
imul eax, edx
add eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x480456
mov eax, dword [eax + 0x1c]
xor edx, edx
imul eax, edx
add eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x480456
mov dword [ebp - 0x10], ebx
mov ecx, 0x56a4b4
call fcn.00416a20
mov eax, dword [0x5699f0]
mov edx, dword [eax + 0x24]
cmp edx, ebx
jne 0x480470
xor ecx, ecx
jmp 0x480486
mov ecx, dword [eax + 0x2c]
cmp ecx, ebx
je 0x48047c
mov esi, dword [ecx + 0xc]
jmp 0x48047e
xor esi, esi
mov ecx, dword [eax + 0x28]
imul ecx, esi
add ecx, edx
mov edx, dword [ebp - 0x10]
add edx, 0x2c
push edx
call fcn.004756f0
mov ecx, 0x56a4b4
mov dword [edi + 4], ebx
call fcn.00416a20
mov eax, dword [0x5699f0]
mov ecx, 0x56a4b4
mov byte [eax + 0x214], 1
call fcn.00416a20
mov ecx, dword [0x5699f0]
mov byte [ecx + 0x215], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret