Function at 0x4217a0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x699f1a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6a999c
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
lea ebp, [esi + 0x5c]
mov ecx, ebp
mov byte [esp + 0x1c], 3
call fcn.00511260
push fcn.00515fc0
push fcn.00514f30
push 2
push 0xf50
lea eax, [esi + 0x53c]
push eax
mov byte [esp + 0x30], 4
call fcn.005bbc4b
push fcn.005113d0
push fcn.00511260
push 2
push 0x4d4
lea ecx, [esi + 0x23e0]
push ecx
mov byte [esp + 0x30], 5
call fcn.005bbc4b
lea ecx, [esi + 0x2d88]
mov byte [esp + 0x1c], 6
call fcn.00511260
lea ecx, [esi + 0x325c]
mov byte [esp + 0x1c], 7
call fcn.00511260
lea ecx, [esi + 0x3730]
mov byte [esp + 0x1c], 8
call fcn.00511260
lea ecx, [esi + 0x3c04]
mov byte [esp + 0x1c], 9
call fcn.00511260
lea ecx, [esi + 0x40d8]
mov byte [esp + 0x1c], 0xa
call fcn.00511260
push fcn.005113d0
push fcn.00511260
mov byte [esp + 0x24], 0xb
push 5
push 0x4d4
lea edx, [esi + 0x45ac]
push edx
call fcn.005bbc4b
push fcn.005113d0
push fcn.00511260
push 3
push 0x4d4
lea eax, [esi + 0x5dd0]
push eax
mov byte [esp + 0x30], 0xc
call fcn.005bbc4b
lea ecx, [esi + 0x6c4c]
mov byte [esp + 0x1c], 0xd
call fcn.00511260
lea ecx, [esi + 0x7120]
mov byte [esp + 0x1c], 0xe
call fcn.00511260
lea ecx, [esi + 0x75f4]
mov byte [esp + 0x1c], 0xf
call fcn.00511260
lea ecx, [esi + 0x7ac8]
mov byte [esp + 0x1c], 0x10
call fcn.00511260
lea ecx, [esi + 0x7f9c]
mov byte [esp + 0x1c], 0x11
call fcn.00511260
lea ecx, [esi + 0x8470]
mov byte [esp + 0x1c], 0x12
call fcn.00511260
lea ecx, [esi + 0x8944]
mov byte [esp + 0x1c], 0x13
call fcn.00511260
mov dword [esi + 0x8e88], ebx
mov dword [esi + 0x8e84], ebx
mov dword [esi + 0x8e8c], ebx
mov dword [esi + 0x8e90], ebx
mov dword [esi + 0x8e98], ebx
mov dword [esi + 0x8e94], ebx
mov dword [esi + 0x8e9c], ebx
mov dword [esi + 0x8ea0], ebx
lea ecx, [esi + 0x8ea8]
mov byte [esp + 0x1c], 0x16
call fcn.00511260
lea ecx, [esi + 0x937c]
mov byte [esp + 0x1c], 0x17
call fcn.00511260
lea ecx, [esi + 0x9850]
mov byte [esp + 0x1c], 0x18
call fcn.00511260
lea ecx, [esi + 0x9d24]
mov byte [esp + 0x1c], 0x19
call fcn.00511260
lea ecx, [esi + 0xa1f8]
mov byte [esp + 0x1c], 0x1a
call fcn.00511260
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], ebx
mov ecx, dword [0x6f355c]
add ecx, 0xfffffea2
mov byte [esp + 0x1c], 0x1b
mov dword [esi + 4], ecx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], 0x14a
mov dword [esi + 0x10], 0x200
mov byte [esi + 0x530], bl
mov dword [esi + 0x538], ebx
mov dword [esi + 0x534], ebx
mov dword [esi + 0x8e18], ebx
mov dword [esi + 0x8e1c], ebx
mov dword [esi + 0x8e20], 0xffffffff
mov dword [esi + 0x23dc], ebx
mov dword [esi + 0x8e7c], ebx
mov dword [esi + 0x8e80], ebx
xor edx, edx
lea eax, [esi + 0x8e24]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov byte [eax + 0x14], dl
xor eax, eax
mov ecx, 0xc
lea edi, [esi + 0x8e39]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, esi
mov dword [esi + 0x8e6c], ebx
mov dword [esi + 0x8e70], ebx
mov dword [esi + 0x8e74], ebx
mov dword [esi + 0x8e78], ebx
call fcn.004dbfe0
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push ebx
push 0x3f400000
push 0x3f000000
push 0x3f800000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f800000
push ebx
push 0x3e800000
push ebx
mov ecx, dword [esi + 8]
push 1
mov edx, dword [esi + 4]
push 0x20
push 0x80
push str.talk1_close_button.tga
push ebx
push 0x16
push 0x16
push 0x20
push 0x20
push 2
push 0x12f
push ecx
push edx
mov ecx, ebp
call fcn.00512a00
mov ecx, dword [esp + 0x14]
pop edi
mov byte [esi + 0x8ea4], 1
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret