Function at 0x4b1980
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50f02c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x551644]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov dword [edi], vtable.ModeSoundScene::CModeSound.0
mov dword [ebp - 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
lea esi, [edi + 0x48]
mov dword [edi + 0x14], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], 0xffffffff
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], 0xff
mov dword [edi + 0x40], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x5c], ebx
mov ecx, 0x55380c
mov byte [ebp - 4], 3
call fcn.004174f0
mov ecx, dword [0x552af0]
mov eax, dword [ecx + 0x18]
cmp eax, ebx
jne 0x4b1a20
xor ecx, ecx
jmp 0x4b1a36
mov edx, dword [ecx + 0x20]
cmp edx, ebx
je 0x4b1a2c
mov edx, dword [edx + 0xc]
jmp 0x4b1a2e
xor edx, edx
mov ecx, dword [ecx + 0x1c]
imul ecx, edx
add ecx, eax
push str.bg_black.bgd
push esi
call fcn.0043d890
test al, al
je 0x4b1df8
mov ecx, 0x55380c
call fcn.004174f0
mov eax, dword [0x552af0]
mov edx, dword [eax + 0x30]
cmp edx, ebx
jne 0x4b1a63
xor ecx, ecx
jmp 0x4b1a79
mov ecx, dword [eax + 0x38]
cmp ecx, ebx
je 0x4b1a6f
mov esi, dword [ecx + 0xc]
jmp 0x4b1a71
xor esi, esi
mov ecx, dword [eax + 0x34]
imul ecx, esi
add ecx, edx
push 2
call fcn.0048c260
push 0x9c
call fcn.004f4b27
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 4
cmp eax, ebx
je 0x4b1aa1
mov ecx, eax
call fcn.004b0fc0
jmp 0x4b1aa3
xor eax, eax
push eax
lea ecx, [edi + 8]
mov byte [ebp - 4], 3
call fcn.0049c620
mov ecx, 0x55380c
call fcn.004174f0
mov ecx, dword [0x552af0]
mov eax, dword [ecx + 0x18]
cmp eax, ebx
jne 0x4b1acb
xor ecx, ecx
jmp 0x4b1ae1
mov edx, dword [ecx + 0x20]
cmp edx, ebx
je 0x4b1ad7
mov edx, dword [edx + 0xc]
jmp 0x4b1ad9
xor edx, edx
mov ecx, dword [ecx + 0x1c]
imul ecx, edx
add ecx, eax
lea eax, [ebp - 0x20]
push eax
call fcn.0043d750
push eax
lea ecx, [edi + 0x54]
mov byte [ebp - 4], 5
call fcn.00404fd0
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x4b1b27
dec dword [eax + 4]
mov ecx, eax
cmp dword [eax + 4], ebx
jne 0x4b1b27
cmp byte [ecx + 8], bl
je 0x4b1b17
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x4b1b27
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
mov ecx, 0x5537a9
call fcn.004047e0
mov ecx, dword [0x552adc]
push ebx
call fcn.0049d970
mov ecx, 0x5537a9
call fcn.004047e0
mov ecx, dword [0x552adc]
call fcn.0049d9e0
mov ecx, 0x55380c
call fcn.004174f0
mov eax, dword [0x552af0]
mov ecx, dword [eax + 0x30]
cmp ecx, ebx
jne 0x4b1b6c
xor eax, eax
jmp 0x4b1b82
mov edx, dword [eax + 0x38]
cmp edx, ebx
je 0x4b1b78
mov edx, dword [edx + 0xc]
jmp 0x4b1b7a
xor edx, edx
mov eax, dword [eax + 0x34]
imul eax, edx
add eax, ecx
push ebx
push 0x517abc
lea ecx, [eax + 0x1c]
call fcn.004048b0
mov ecx, 0x553818
call fcn.004175a0
mov esi, dword [0x552af4]
mov ecx, dword [esi + 0x30]
sub ecx, dword [esi + 0x2c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 2
jbe 0x4b1be5
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
je 0x4b1be5
mov edx, dword [eax + 0x20]
cmp edx, ebx
je 0x4b1bd9
mov eax, dword [eax + 0x1c]
mov edx, dword [edx + 0xc]
imul eax, edx
add eax, ecx
jmp 0x4b1be7
mov eax, dword [eax + 0x1c]
xor edx, edx
imul eax, edx
add eax, ecx
jmp 0x4b1be7
xor eax, eax
mov ecx, 0x553818
mov dword [eax + 4], ebx
call fcn.004175a0
mov esi, dword [0x552af4]
mov ecx, dword [esi + 0x30]
sub ecx, dword [esi + 0x2c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jbe 0x4b1c3f
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
je 0x4b1c3f
mov edx, dword [eax + 0x20]
cmp edx, ebx
je 0x4b1c33
mov eax, dword [eax + 0x1c]
mov edx, dword [edx + 0xc]
imul eax, edx
add eax, ecx
jmp 0x4b1c41
mov eax, dword [eax + 0x1c]
xor edx, edx
imul eax, edx
add eax, ecx
jmp 0x4b1c41
xor eax, eax
mov ecx, 0x553818
mov byte [eax + 9], bl
call fcn.004175a0
mov esi, dword [0x552af4]
mov ecx, dword [esi + 0x30]
sub ecx, dword [esi + 0x2c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 2
jbe 0x4b1c99
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
je 0x4b1c99
mov edx, dword [eax + 0x20]
cmp edx, ebx
je 0x4b1c8d
mov eax, dword [eax + 0x1c]
mov edx, dword [edx + 0xc]
imul eax, edx
add eax, ecx
jmp 0x4b1c9b
mov eax, dword [eax + 0x1c]
xor edx, edx
imul eax, edx
add eax, ecx
jmp 0x4b1c9b
xor eax, eax
mov ecx, 0x553818
mov byte [eax + 0x24], 1
call fcn.004175a0
mov esi, dword [0x552af4]
mov ecx, dword [esi + 0x30]
sub ecx, dword [esi + 0x2c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jbe 0x4b1cf4
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
je 0x4b1cf4
mov edx, dword [eax + 0x20]
cmp edx, ebx
je 0x4b1ce8
mov eax, dword [eax + 0x1c]
mov edx, dword [edx + 0xc]
imul eax, edx
add eax, ecx
jmp 0x4b1cf6
mov eax, dword [eax + 0x1c]
xor edx, edx
imul eax, edx
add eax, ecx
jmp 0x4b1cf6
xor eax, eax
mov ecx, 0x553818
mov byte [eax + 0x25], 1
call fcn.004175a0
mov esi, dword [0x552af4]
mov ecx, dword [esi + 0x30]
sub ecx, dword [esi + 0x2c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 2
jbe 0x4b1d4f
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
je 0x4b1d4f
mov edx, dword [eax + 0x20]
cmp edx, ebx
je 0x4b1d43
mov eax, dword [eax + 0x1c]
mov edx, dword [edx + 0xc]
imul eax, edx
add eax, ecx
jmp 0x4b1d51
mov eax, dword [eax + 0x1c]
xor edx, edx
imul eax, edx
add eax, ecx
jmp 0x4b1d51
xor eax, eax
mov ecx, 0x553818
mov byte [eax + 0x26], bl
call fcn.004175a0
mov esi, dword [0x552af4]
mov ecx, dword [esi + 0x30]
sub ecx, dword [esi + 0x2c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jbe 0x4b1db6
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + 0x18]
cmp ecx, ebx
jne 0x4b1d90
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4b1db9
mov edx, dword [eax + 0x20]
cmp edx, ebx
je 0x4b1da7
mov eax, dword [eax + 0x1c]
mov edx, dword [edx + 0xc]
imul eax, edx
add eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x4b1db9
mov eax, dword [eax + 0x1c]
xor edx, edx
imul eax, edx
add eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x4b1db9
mov dword [ebp - 0x10], ebx
mov ecx, 0x55380c
call fcn.004174f0
mov eax, dword [0x552af0]
mov edx, dword [eax + 0x24]
cmp edx, ebx
jne 0x4b1dd3
xor ecx, ecx
jmp 0x4b1de9
mov ecx, dword [eax + 0x2c]
cmp ecx, ebx
je 0x4b1ddf
mov esi, dword [ecx + 0xc]
jmp 0x4b1de1
xor esi, esi
mov ecx, dword [eax + 0x28]
imul ecx, esi
add ecx, edx
mov edx, dword [ebp - 0x10]
add edx, 0x2c
push edx
call fcn.004a0670
mov dword [edi + 4], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret