Function at 0x4a8950
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Check os version
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c7c9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x51eea4]
xor eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x2c], eax
lea eax, [esi + 0x14]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
lea eax, [esi + 0x28]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
push edi
lea edi, [esi + 0x34]
mov dword [eax + 4], edx
mov dword [esp + 0x10], esi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
lea eax, [esi + 0x54]
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [esi + 0x64], edx
lea ebp, [esi + 0x70]
mov dword [esi + 0x68], edx
mov dword [esp + 0x3c], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
lea eax, [esi + 0xa0]
mov dword [eax], ecx
mov byte [esp + 0x3c], 1
mov dword [eax + 4], ecx
call fcn.00437070
cmp dword [eax + 8], 0xfffffffe
jne 0x4a89e2
mov dword [esp + 0x78], 0x41200000
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x84]
mov ecx, dword [esp + 0x6c]
mov dword [esi + 0xc], eax
mov al, byte [esp + 0x68]
mov dword [esi + 8], edx
mov edx, dword [esp + 0x70]
mov byte [esi + 0x11], al
mov byte [esi + 0x1c], al
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0x44]
mov dword [esi + 0x18], edx
mov edx, dword [esp + 0x48]
lea eax, [esi + 0x20]
mov dword [eax], ecx
mov ecx, dword [esp + 0x4c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x50]
mov dword [eax + 8], ecx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov byte [esi + 0x10], bl
mov dword [eax + 0xc], edx
mov dword [esi + 0x30], 1
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x4a8a48
push eax
call fcn.004ade5d
add esp, 4
push 0xa
mov ecx, edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
call fcn.004a75b0
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x7c]
mov dword [esi + 0x58], ecx
push 0xa
mov ecx, ebp
mov dword [esi + 0x44], 0x41200000
mov dword [esi + 0x48], 0x41f00000
mov dword [esi + 0x4c], 0x41a00000
mov dword [esi + 0x50], 1
mov dword [esi + 0x54], eax
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x60], bl
mov byte [esi + 0x6c], bl
call fcn.004a76a0
mov ecx, ebp
call fcn.004a68f0
cmp dword [esi + 0x20], 2
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], 1
jne 0x4a8b6e
mov eax, dword [esp + 0x48]
cmp eax, 1
mov dword [esi + 0x4c], 0x43020000
jne 0x4a8af2
mov dword [esi + 0x30], 3
mov dword [esi + 0x4c], 0x41f00000
jmp 0x4a8b6e
cmp eax, 2
jne 0x4a8b12
mov eax, 3
mov dword [esi + 0x44], 0x40a00000
mov dword [esi + 0x30], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], 0x42200000
jmp 0x4a8b6e
cmp eax, 3
jne 0x4a8b2e
mov dword [esi + 0x44], 0x40a00000
mov dword [esi + 0x4c], 0x42a00000
mov dword [esi + 0x50], 5
jmp 0x4a8b6e
mov eax, dword [esi + 0x24]
cmp eax, 5
jne 0x4a8b4d
mov dword [esi + 0x30], 1
mov dword [esi + 0x44], 0x40a00000
mov dword [esi + 0x4c], 0x41f00000
jmp 0x4a8b6e
cmp eax, 7
jne 0x4a8b62
mov dword [esi + 0x44], 0x41700000
mov dword [esi + 0x4c], 0x428c0000
jmp 0x4a8b6e
cmp eax, 8
jne 0x4a8b6e
mov dword [esi + 0x4c], 0x41200000
cmp dword [esi + 0x30], ebx
mov dword [esp + 0x84], ebx
jle 0x4a8c60
mov edi, edi
push 0x28
call fcn.004ad909
add esp, 4
cmp eax, ebx
je 0x4a8ba2
xor edx, edx
mov ecx, eax
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x20], ebx
jmp 0x4a8ba4
xor eax, eax
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
mov dword [eax], ecx
mov ecx, dword [esp + 0x60]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x64]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ebx
mov byte [eax + 0x14], bl
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov ecx, dword [eax + 0x20]
cmp ecx, ebx
mov dword [esp + 0x68], eax
mov dword [eax + 0x20], ebx
je 0x4a8bec
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebx
mov dword [ecx + 4], edx
jne 0x4a8bec
mov eax, dword [ecx]
push 1
call dword [eax]
mov edx, dword [edi + 4]
cmp edx, ebx
jne 0x4a8bf7
xor ecx, ecx
jmp 0x4a8bff
mov ecx, dword [edi + 8]
sub ecx, edx
sar ecx, 2
cmp edx, ebx
je 0x4a8c30
mov eax, dword [edi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x4a8c30
mov ecx, dword [esp + 0x68]
mov ebp, dword [edi + 8]
push ecx
push edi
lea edx, [esp + 0x70]
push edx
push 1
push ebp
call fcn.0047b030
add esp, 0x14
add ebp, 4
mov dword [edi + 8], ebp
jmp 0x4a8c46
mov eax, dword [edi + 8]
lea ecx, [esp + 0x68]
push ecx
push 1
push ecx
mov ecx, esp
mov dword [ecx], eax
mov ecx, edi
call fcn.004a6e60
mov eax, dword [esp + 0x84]
mov ecx, dword [esi + 0x30]
inc eax
cmp eax, ecx
mov dword [esp + 0x84], eax
jl 0x4a8b80
cmp dword [esi + 0x20], ebx
jne 0x4a8dc3
call fcn.0043f0a0
mov ecx, eax
call fcn.00481fe0
fld dword [esp + 0x78]
fadd dword [eax + 0xc]
mov eax, dword [esi + 0x38]
fstp dword [esi + 0x44]
mov ecx, dword [eax]
add ecx, 8
call fcn.00465170
fsub dword [0x4f7c34]
fst dword [esp + 0x68]
fcomp dword [0x4fc4b8]
fnstsw ax
test ah, 5
jp 0x4a8cb3
fld dword [0x4f7c34]
fadd st(0), st(0)
fadd dword [esp + 0x68]
fstp dword [esp + 0x68]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
sub esp, 0x10
mov dword [esp + 0x88], esp
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x5c]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x60]
add eax, 8
mov dword [eax], edx
lea edx, [esp + 0x88]
mov dword [eax + 4], ecx
push edx
mov ecx, esi
call fcn.004a79c0
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx]
mov eax, dword [eax]
add edx, 0x20
cmp eax, ebx
mov byte [esp + 0x3c], 2
je 0x4a8d01
inc dword [eax + 4]
mov ecx, dword [edx]
cmp ecx, ebx
mov dword [edx], eax
je 0x4a8d1c
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebx
mov dword [ecx + 4], edx
jne 0x4a8d1c
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esp + 0x78]
cmp eax, ebx
mov byte [esp + 0x3c], 1
je 0x4a8d43
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov dword [esp + 0x84], edx
jne 0x4a8d43
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esi + 0x38]
mov ecx, dword [eax]
cmp dword [ecx + 0x20], ebx
je 0x4a8dc3
mov eax, dword [eax]
mov edx, ecx
mov ecx, dword [edx + 0x20]
mov edx, dword [edx + 4]
push 0xc4164000
push edx
mov edx, dword [eax]
push edx
call fcn.00424870
mov eax, dword [esp + 0x68]
mov ecx, dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x38]
mov eax, dword [eax]
push ecx
add eax, 0x20
mov eax, dword [eax]
cmp eax, ebx
push ecx
mov ecx, esp
mov dword [esp + 0x74], esp
mov dword [ecx], eax
je 0x4a8d88
inc dword [eax + 4]
mov ecx, esi
call fcn.004a6ad0
mov eax, dword [esi + 0x38]
mov eax, dword [eax]
push 1
push 1
add eax, 0x20
mov eax, dword [eax]
cmp eax, ebx
push ecx
mov ecx, esp
mov dword [esp + 0x74], esp
mov dword [ecx], eax
je 0x4a8dad
inc dword [eax + 4]
mov byte [esp + 0x48], 3
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0x48], 1
call dword [edx + 0x10]
cmp dword [esi + 0x20], 2
jne 0x4a913e
mov eax, dword [esi + 0x24]
cmp eax, 8
je 0x4a8ddd
mov byte [esi + 0x11], 1
mov byte [esi + 0x1c], 1
cmp eax, 7
je 0x4a9019
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebx
jle 0x4a8f25
mov eax, dword [esi + 0x20]
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov ecx, dword [esi + 0x24]
mov dword [edx + 4], ecx
mov dword [esp + 0x94], esp
xor eax, eax
lea ecx, [esi + 0x28]
nop
mov edi, dword [ecx]
mov dword [edx + eax*4 + 8], edi
inc eax
add ecx, 4
cmp eax, 2
jl 0x4a8e10
lea edx, [esp + 0x78]
push edx
mov ecx, esi
call fcn.004a79c0
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx + ebp*4]
mov eax, dword [eax]
add edx, 0x20
cmp eax, ebx
mov byte [esp + 0x3c], 4
je 0x4a8e42
inc dword [eax + 4]
mov ecx, dword [edx]
cmp ecx, ebx
mov dword [edx], eax
je 0x4a8e5d
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebx
mov dword [ecx + 4], edx
jne 0x4a8e5d
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esp + 0x68]
cmp eax, ebx
mov byte [esp + 0x3c], 1
je 0x4a8e84
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov dword [esp + 0x84], edx
jne 0x4a8e84
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esi + 0x38]
mov ecx, dword [eax + ebp*4]
cmp dword [ecx + 0x20], ebx
je 0x4a8f19
mov eax, dword [eax + ebp*4]
mov edx, ecx
mov ecx, dword [edx + 0x20]
mov edx, dword [edx + 4]
push 0xc4164000
push edx
mov edx, dword [eax]
push edx
call fcn.00424870
mov edi, dword [esi + 0x38]
mov ecx, dword [edi + ebp*4]
add ecx, 8
call fcn.00465170
fld dword [0x4f7c34]
fmul dword [0x4f2588]
push 1
lea edx, [esp + 0x7c]
push edx
fsubp st(1)
fstp dword [esp + 0x80]
mov eax, dword [edi + ebp*4]
mov ecx, dword [eax + 0x20]
call fcn.00424750
mov eax, dword [esi + 0x38]
mov eax, dword [eax + ebp*4]
push 1
push 1
add eax, 0x20
mov eax, dword [eax]
cmp eax, ebx
push ecx
mov ecx, esp
mov dword [esp + 0x90], esp
mov dword [ecx], eax
je 0x4a8f03
inc dword [eax + 4]
mov byte [esp + 0x48], 5
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0x48], 1
call dword [edx + 0x10]
mov eax, dword [esi + 0x30]
inc ebp
cmp ebp, eax
jl 0x4a8df3
mov eax, dword [esp + 0x48]
cmp eax, 1
je 0x4a8f37
cmp eax, 2
jne 0x4a913e
mov edi, dword [esi + 0x38]
mov ecx, dword [edi + 4]
add ecx, 8
call fcn.00465170
mov eax, dword [edi]
cmp eax, ebx
fadd dword [0x4f7c34]
fstp dword [esp + 0x68]
je 0x4a8fad
fld dword [esp + 0x68]
add eax, 8
fadd dword [0x4f7cf8]
push 1
lea edx, [esp + 0x7c]
push edx
fld st(0)
fcos
fstp dword [eax]
mov eax, dword [esi + 0x38]
fsin
mov eax, dword [eax]
add eax, 0xc
fstp dword [eax]
fld dword [esp + 0x70]
mov eax, dword [esi + 0x38]
fsub dword [0x4f7c34]
fadd dword [0x4f7cf8]
fld dword [0x4f7c34]
fmul dword [0x4f2588]
fsubp st(1)
fstp dword [esp + 0x80]
mov eax, dword [eax]
mov ecx, dword [eax + 0x20]
call fcn.00424750
mov eax, dword [esi + 0x38]
mov ecx, dword [eax + 8]
cmp ecx, ebx
je 0x4a913e
fld dword [esp + 0x68]
mov eax, ecx
fsub dword [0x4f7cf8]
add eax, 8
push 1
lea edx, [esp + 0x6c]
fld st(0)
push edx
fcos
fstp dword [eax]
mov eax, dword [esi + 0x38]
fsin
mov eax, dword [eax + 8]
add eax, 0xc
fstp dword [eax]
fld dword [esp + 0x70]
mov eax, dword [esi + 0x38]
fsub dword [0x4f7c34]
fsub dword [0x4f7cf8]
fld dword [0x4f7c34]
fmul dword [0x4f2588]
fsubp st(1)
fstp dword [esp + 0x70]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x20]
call fcn.00424750
jmp 0x4a913e
mov eax, str._objects_bonus_on_catapult_magic_yellow_tail.xml
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4a9031
sub eax, edi
push eax
push str._objects_bonus_on_catapult_magic_yellow_tail.xml
lea ecx, [esp + 0x1c]
call fcn.00402cd0
push ebx
push ebx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x74]
push ecx
mov byte [esp + 0x4c], 6
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx]
mov eax, dword [eax]
add edx, 0x20
cmp eax, ebx
mov byte [esp + 0x3c], 7
je 0x4a907c
inc dword [eax + 4]
mov ecx, dword [edx]
cmp ecx, ebx
mov dword [edx], eax
je 0x4a9097
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebx
mov dword [ecx + 4], edx
jne 0x4a9097
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x68]
cmp eax, ebx
mov byte [esp + 0x3c], 6
je 0x4a90bd
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov eax, edx
mov dword [esp + 0x78], eax
jne 0x4a90bd
mov edx, dword [ecx]
push 1
call dword [edx]
cmp dword [esp + 0x2c], 0x10
mov byte [esp + 0x3c], 1
jb 0x4a90d6
mov eax, dword [esp + 0x18]
push eax
call fcn.004ade5d
add esp, 4
mov eax, dword [esi + 0x38]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x20]
push 0x3f800000
push 0x40000000
call fcn.004248a0
mov eax, dword [esi + 0x38]
mov edx, dword [eax]
mov eax, dword [esp + 0x80]
mov ecx, dword [edx + 0x20]
mov edx, dword [esp + 0x7c]
push 0xc3af0000
push eax
push edx
call fcn.00424870
mov edi, dword [esi + 0x38]
mov ecx, dword [edi]
add ecx, 8
call fcn.00465170
fstp dword [esp + 0x68]
mov eax, dword [edi]
mov ecx, dword [eax + 0x20]
push 1
lea edx, [esp + 0x6c]
push edx
call fcn.00424750
mov eax, dword [esi + 0x38]
mov eax, dword [eax]
mov ecx, dword [eax + 0x20]
push 1
push ebx
call fcn.0042f400
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x58]
mov dword [esi + 0xa4], eax
mov eax, dword [esi + 0x20]
cmp eax, ebx
mov dword [esi + 0x9c], ecx
mov dword [esi + 0xa0], edx
je 0x4a92d6
cmp eax, 2
jne 0x4a9380
cmp dword [esi + 0x24], 8
je 0x4a92d6
cmp eax, eax
jne 0x4a9380
mov eax, 0x4f130c
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4a91a0
sub eax, edx
push eax
push 0x4f130c
lea ecx, [esp + 0x1c]
call fcn.00402cd0
mov eax, dword [esi + 0x24]
cmp eax, ebx
mov byte [esp + 0x3c], 0xb
jne 0x4a91ed
mov eax, str._sound_shot_shot_fireball.ogg
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4a91d0
sub eax, edx
push eax
push str._sound_shot_shot_fireball.ogg
lea ecx, [esp + 0x1c]
call fcn.00402cd0
jmp 0x4a92a8
cmp eax, 1
jne 0x4a921d
mov eax, str._sound_shot_shot_fireball3.ogg
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4a9200
sub eax, edx
push eax
push str._sound_shot_shot_fireball3.ogg
lea ecx, [esp + 0x1c]
call fcn.00402cd0
jmp 0x4a92a8
cmp eax, 2
jne 0x4a924a
mov eax, str._sound_shot_shot_plasma.ogg
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4a9230
sub eax, edx
push eax
push str._sound_shot_shot_plasma.ogg
lea ecx, [esp + 0x1c]
call fcn.00402cd0
jmp 0x4a92a8
cmp eax, 3
jne 0x4a9271
mov eax, str._sound_shot_shot_salute.ogg
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4a9257
sub eax, edx
push eax
push str._sound_shot_shot_salute.ogg
lea ecx, [esp + 0x1c]
call fcn.00402cd0
jmp 0x4a92a8
cmp eax, 4
jne 0x4a927d
push str._sound_shot_shot_firemagic.ogg
jmp 0x4a929f
cmp eax, 5
jne 0x4a9289
push str._sound_shot_shot_icemagic.ogg
jmp 0x4a929f
cmp eax, 6
jne 0x4a9295
push str._sound_shot_shot_greenmagic.ogg
jmp 0x4a929f
cmp eax, 7
jne 0x4a92a8
push str._sound_shot_shot_yellowmagic.ogg
lea ecx, [esp + 0x18]
call fcn.00403400
lea ecx, [esp + 0x14]
push ecx
call fcn.0040e1a0
mov ecx, eax
call fcn.00435ad0
cmp dword [esp + 0x2c], 0x10
jb 0x4a9380
mov edx, dword [esp + 0x18]
push edx
call fcn.004ade5d
add esp, 4
jmp 0x4a9380
mov edi, 0xf
mov eax, 0x4f7cfc
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4a92f0
sub eax, edx
push eax
push 0x4f7cfc
lea ecx, [esp + 0x1c]
call fcn.00402cd0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x6c]
push ecx
mov byte [esp + 0x44], 8
call fcn.0040e1a0
mov ecx, eax
call fcn.004352d0
cmp dword [esp + 0x2c], 0x10
mov byte [esp + 0x3c], 0xa
jb 0x4a933c
mov edx, dword [esp + 0x18]
push edx
call fcn.004ade5d
add esp, 4
mov ecx, dword [esp + 0x68]
push 1
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.00431ca0
mov ecx, dword [esp + 0x68]
call fcn.00432400
mov eax, dword [esp + 0x68]
cmp eax, ebx
mov byte [esp + 0x3c], 1
je 0x4a9380
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
cmp edx, ebx
mov dword [eax], edi
jne 0x4a9380
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x30]
xor ecx, dword [esp + 0x40]
mov eax, esi
call fcn.004ae650
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0x44