Function at 0x49e4b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6afa8e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
xor ebx, ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi], 0x6c17f8
mov dword [esp + 0x24], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
lea ecx, [esi + 0x60]
mov byte [esp + 0x24], 3
call fcn.00527000
lea ecx, [esi + 0x638]
mov byte [esp + 0x24], 4
call fcn.0052b880
lea edi, [esi + 0x1894]
mov ecx, edi
mov byte [esp + 0x24], 5
call fcn.0052b880
lea ebp, [esi + 0x2af0]
mov ecx, ebp
mov byte [esp + 0x24], 6
call fcn.0052b880
lea ecx, [esi + 0x3d50]
mov byte [esp + 0x24], 7
call fcn.00527000
lea ecx, [esi + 0x4328]
mov byte [esp + 0x24], 8
call fcn.00527000
lea ecx, [esi + 0x4900]
mov byte [esp + 0x24], 9
call fcn.00527000
lea ecx, [esi + 0x4ed8]
mov byte [esp + 0x24], 0xa
call fcn.00527000
lea ecx, [esi + 0x54b0]
mov byte [esp + 0x24], 0xb
call fcn.00527000
lea ecx, [esi + 0x5a88]
mov byte [esp + 0x24], 0xc
call fcn.00527000
lea ecx, [esi + 0x6060]
mov byte [esp + 0x24], 0xd
call fcn.0052d480
mov dword [esi + 0x6100], ebx
mov dword [esi + 0x60fc], ebx
mov dword [esi + 0x6104], ebx
mov dword [esi + 0x6108], ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push ebx
push 0x3f400000
push 0x3f000000
push 0x3f800000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f800000
push ebx
push 0x3e800000
mov dword [esi + 0x5c], 3
mov eax, dword [0x70859c]
cdq
sub eax, edx
push ebx
sar eax, 1
push 1
sub eax, 0x125
mov dword [esi + 4], eax
mov eax, dword [0x7085a0]
push 0x20
push 0x80
cdq
push str.talk1_close_button.tga
push ebx
sub eax, edx
push 0x16
sar eax, 1
sub eax, 0xfa
push 0x16
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x24a
mov dword [esi + 0x10], 0x200
mov dword [esi + 0x60d0], ebx
mov dword [esi + 0x60d4], ebx
mov byte [esi + 0x60d8], bl
mov byte [esi + 0x60fa], bl
mov dword [esi + 0x3d4c], ebx
mov dword [esi + 0x610c], ebx
push 0x20
fld dword [0x70993c]
mov byte [esp + 0x98], 0xf
push 0x20
call fcn.005cd414
push eax
fld dword [0x709938]
call fcn.005cd414
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 8]
push eax
push ecx
lea ecx, [esi + 0x60]
call fcn.00528830
push 1
push 0x40800000
push 0x40800000
push 0x3f000000
push ebx
push 0x3f200000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3ec00000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3ec00000
push 0x3f800000
push 0x3f000000
push 0x3ec00000
push 0x3e800000
push 0x3f800000
push 0x3f000000
push 0x3e800000
push 0x3e000000
push 0x3f800000
push 0x3f000000
push 0x3e000000
push ebx
push 0x3f000000
push ebx
push 0x3ec00000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3e800000
push 0x3e000000
push 0x3f000000
push ebx
push 0x3e000000
push ebx
push 0x40
push 0x80
push str.scrollbar.tga
push 0x43010000
push 0x41500000
mov edx, dword [esi + 8]
push 0x41980000
mov eax, dword [esi + 4]
push ebx
push 1
push 0x13
push 0xd
push 0x20
push 0x10
push 0xa7
push 0xd
push 0x5c
push 0xe5
push edx
push eax
mov ecx, edi
call fcn.0052c430
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push 0x42f00000
push ebx
push 0xa9
push 0xe1
add ecx, 0x5b
push ecx
add edx, 0xf
push edx
mov ecx, edi
call fcn.0052af30
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0xff
push 0xff
push 0xff
push 0xa
push 0xc8
push 0x66
push 0x1a
push eax
push ecx
lea ecx, [esi + 0x6060]
call fcn.0052cf20
fild dword [esi + 0x6088]
sub esp, 8
mov ecx, edi
fstp dword [esp + 4]
fild dword [esi + 0x60c4]
fstp dword [esp]
call fcn.0052ad90
push 1
fld dword [0x709948]
push 0x40800000
fsub dword [0x6bc87c]
push 0x40800000
push 0x3f000000
push ebx
push 0x3f200000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3ec00000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3ec00000
push 0x3f800000
push 0x3f000000
push 0x3ec00000
push 0x3e800000
push 0x3f800000
push 0x3f000000
push 0x3e800000
push 0x3e000000
push 0x3f800000
push 0x3f000000
push 0x3e000000
push ebx
push 0x3f000000
push ebx
push 0x3ec00000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3e800000
push 0x3e000000
push 0x3f000000
push ebx
push 0x3e000000
push ebx
push 0x40
push 0x80
push str.scrollbar.tga
push ecx
fstp dword [esp]
push 0x41500000
fld dword [0x709948]
push 0x41980000
push ebx
push 1
push 0x13
push 0xd
push 0x20
push 0x10
call fcn.005cd414
fld dword [0x709944]
push eax
push 0xd
call fcn.005cd414
fld dword [0x709940]
push eax
call fcn.005cd414
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push edx
push eax
mov ecx, ebp
call fcn.0052c430
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push 0x42f00000
push ebx
push 0x160
add ecx, 0x50
push 0x130
push ecx
add edx, 0x10f
push edx
mov ecx, ebp
call fcn.0052af30
push 0x40e00000
push ebx
mov ecx, ebp
call fcn.0052ad90
mov ecx, esi
call fcn.0049cb70
mov eax, dword [0x85cfbc]
mov ecx, dword [eax + 0x2d4]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
mov dword [esp + 0x14], ecx
push eax
mov ecx, 0x22012ec
call fcn.00564240
mov eax, dword [esp + 0x14]
cmp eax, dword [0x22012f0]
je 0x49e9a1
mov eax, dword [eax + 0x10]
cmp eax, ebx
je 0x49e9a1
mov cl, byte [eax + 0x73]
mov byte [esi + 0x60d8], cl
call fcn.0059c790
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret