Function at 0x425ae0
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x69845d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
xor eax, eax
mov dword [esi], 0x6a9d70
push edi
lea edi, [esi + 0xc]
mov dword [esp + 0x10], esi
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
push fcn.00516950
push fcn.005167e0
push 2
push 0x4d4
lea ebx, [esi + 0x1c]
push ebx
mov dword [esp + 0x30], eax
call fcn.005b9dbb
push fcn.00516950
push fcn.005167e0
push 2
push 0x4d4
lea ebp, [esi + 0x9c4]
push ebp
mov byte [esp + 0x30], 1
call fcn.005b9dbb
lea ecx, [esi + 0x136c]
mov byte [esp + 0x1c], 2
call fcn.005167e0
mov eax, dword [esp + 0x24]
cmp eax, 0xa
mov byte [esp + 0x1c], 3
mov dword [esi + 0x1840], eax
jle 0x425b86
mov dword [esi + 0x1844], 0xa
jmp 0x425b8c
mov dword [esi + 0x1844], eax
push 0x80
push pe_nt_image_headers32
push str.change_item.tga
push str.data_interface
mov ecx, edi
call fcn.00538940
mov eax, dword [0x706454]
add eax, 0xffffffae
mov dword [esi + 4], eax
mov ecx, dword [0x706458]
add ecx, 0xffffffce
xor edi, edi
cmp eax, edi
mov dword [esi + 8], ecx
jge 0x425bc9
mov dword [esi + 4], edi
jmp 0x425be0
lea edx, [eax + 0xa4]
mov eax, dword [0x6f355c]
cmp edx, eax
jle 0x425be0
add eax, 0xffffff5c
mov dword [esi + 4], eax
mov eax, dword [esi + 8]
cmp eax, edi
jge 0x425bec
mov dword [esi + 8], edi
jmp 0x425bfe
lea ecx, [eax + 0x64]
mov eax, dword [0x6f3560]
cmp ecx, eax
jle 0x425bfe
add eax, 0xffffff9c
mov dword [esi + 8], eax
push 0x3f000000
push edi
push 0x3f800000
push 0x3f400000
push edi
push edi
push edi
push edi
push 0x3f000000
push edi
push 0x3f400000
push 0x3f000000
push 0x3f000000
push edi
push 0x3f000000
push 0x3e800000
push 0x3f000000
push edi
push 0x3e800000
push edi
mov edx, dword [esi + 8]
push 1
mov eax, dword [esi + 4]
push 0x40
push pe_nt_image_headers32
push str.stats_on_button.tga
push edi
push 0x14
push 0x2e
push 0x20
push 0x40
push 0x45
push 0x1d
push edx
push eax
mov ecx, ebx
call fcn.00517f80
push 0x3f800000
push 0x3f000000
push 0x3f800000
push 0x3f400000
push edi
push edi
push edi
push edi
push 0x3f800000
push 0x3f000000
push 0x3f400000
push 0x3f000000
push 0x3f800000
push 0x3f000000
push 0x3f000000
push 0x3e800000
push 0x3f800000
push 0x3f000000
push 0x3e800000
push edi
mov ecx, dword [esi + 8]
push 1
mov edx, dword [esi + 4]
push 0x40
push pe_nt_image_headers32
push str.stats_on_button.tga
push edi
push 0x14
push 0x2e
push 0x20
push 0x40
push 0x45
push 0x58
push ecx
push edx
lea ecx, [esi + 0x4f0]
call fcn.00517f80
push 0x3f000000
push edi
push 0x3f800000
push 0x3f400000
push edi
push edi
push edi
push edi
push 0x3f000000
push edi
push 0x3f400000
push 0x3f000000
push 0x3f000000
push edi
push 0x3f000000
push 0x3e800000
push 0x3f000000
push edi
push 0x3e800000
push edi
mov eax, dword [esi + 8]
push 1
mov ecx, dword [esi + 4]
push 0x40
push 0x80
push str.stats_on_select_button.tga
push edi
push 0x16
push 0x16
push 0x20
push 0x20
push 0x1f
push 0x6c
push eax
push ecx
mov ecx, ebp
call fcn.00517f80
push 0x3f800000
push 0x3f000000
push 0x3f800000
push 0x3f400000
push edi
push edi
push edi
push edi
push 0x3f800000
push 0x3f000000
push 0x3f400000
push 0x3f000000
push 0x3f800000
push 0x3f000000
push 0x3f000000
push 0x3e800000
push 0x3f800000
push 0x3f000000
push 0x3e800000
push edi
mov edx, dword [esi + 8]
push 1
mov eax, dword [esi + 4]
push 0x40
push 0x80
push str.stats_on_select_button.tga
push edi
push 0x16
push 0x16
push 0x20
push 0x20
push 0x1f
push 0x81
push edx
push eax
lea ecx, [esi + 0xe98]
call fcn.00517f80
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x3f800000
push edi
push 0x3f400000
push 0x3f000000
push 0x3f800000
push edi
push 0x3f000000
push 0x3e800000
push 0x3f800000
push edi
push 0x3e800000
push edi
mov ecx, dword [esi + 8]
push 1
mov edx, dword [esi + 4]
push 0x20
push 0x80
push str.talk1_close_button.tga
push edi
push 0x16
push 0x16
push 0x20
push 0x20
push 1
push 0x8a
push ecx
push edx
lea ecx, [esi + 0x136c]
call fcn.00517f80
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x1848], edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4