Function at 0x4f1118
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4f13b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 7
mov eax, esi
call fcn.004299f8
mov eax, dword [edi + 0x98]
mov edx, ebx
call fcn.004f19d0
mov ebx, eax
mov eax, esi
call fcn.004289e8
mov eax, dword [eax + 0xc]
mov dl, byte [ebx + 0x14]
call fcn.00423724
mov eax, esi
call fcn.004289e8
mov eax, dword [eax + 0xc]
mov dl, byte [ebx + 0x24]
call fcn.004236f0
mov eax, esi
call fcn.004289e8
mov eax, dword [eax + 0xc]
mov dl, byte [ebx + 0x1c]
call fcn.00423754
mov eax, esi
call fcn.004289e8
mov eax, dword [eax + 0xc]
mov edx, dword [ebx + 0x20]
call fcn.0042364c
mov eax, esi
call fcn.004289e8
mov eax, dword [eax + 0xc]
xor edx, edx
call fcn.00423424
lea eax, [ebp - 0x14]
mov dx, word [ebx + 0xc]
call fcn.00405358
mov eax, esi
call fcn.004289e8
mov eax, dword [eax + 0xc]
push eax
fild dword [ebp + 0xc]
fmul qword [ebx + 0x30]
call fcn.00402fb0
mov edx, eax
pop eax
call fcn.0042360c
push 0
lea edx, [ebp - 0x4c]
mov eax, esi
call fcn.00528fb4
lea edx, [ebp - 0x4c]
mov ecx, 0xffffff
mov eax, esi
call fcn.004e3888
push 0
lea eax, [ebp - 0x2c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00528f90
push 0xf00
lea eax, [ebp - 0x2c]
push eax
push 1
mov eax, dword [ebp - 0x14]
call fcn.004053b4
push eax
mov eax, esi
call fcn.004289e8
call fcn.0042451c
push eax
call sub.user32.dll_DrawTextW
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
push eax
lea eax, [ebp - 0x2c]
xor edx, edx
call fcn.00529134
pop edx
sub edx, eax
sar edx, 1
jns 0x4f1243
adc edx, 0
mov dword [ebp - 0x3c], edx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
lea eax, [ebp - 0x2c]
xor edx, edx
call fcn.00529148
pop edx
sub edx, eax
sar edx, 1
jns 0x4f1262
adc edx, 0
mov dword [ebp - 0x38], edx
lea eax, [ebp - 0x2c]
xor edx, edx
call fcn.00529134
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2c]
xor edx, edx
call fcn.00529148
add eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
cmp dword [ebp + 8], 0
je 0x4f12a3
fild dword [ebp + 8]
fmul qword [ebx + 0x30]
call fcn.00402fb0
lea edx, [ebp - 0x3c]
mov ecx, eax
xor eax, eax
xchg edx, eax
call fcn.00407028
push 0xb04
lea eax, [ebp - 0x3c]
push eax
push 1
mov eax, dword [ebp - 0x14]
call fcn.004053b4
push eax
mov eax, esi
call fcn.004289e8
call fcn.0042451c
push eax
call sub.user32.dll_DrawTextW
cmp dword [edi + 0x80], 0x1fffffff
je 0x4f12ec
mov eax, dword [edi + 0x80]
xor edx, edx
call fcn.004f528c
call fcn.004e3860
mov dword [ebp - 0x18], eax
jmp 0x4f130f
mov edi, dword [ebx + 0x18]
cmp edi, 0x1fffffff
je 0x4f130a
mov eax, edi
xor edx, edx
call fcn.004f528c
call fcn.004e3860
mov dword [ebp - 0x18], eax
jmp 0x4f130f
xor eax, eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 4]
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004ccc70
test al, al
je 0x4f1391
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
dec eax
test eax, eax
jl 0x4f1391
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
imul dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4f1389
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x10]
lea ecx, [eax + edi*4]
xor eax, eax
mov al, byte [ecx + 2]
xor edx, edx
mov dl, byte [ecx + 1]
add eax, edx
xor edx, edx
mov dl, byte [ecx]
add eax, edx
push ecx
mov ecx, 3
xor edx, edx
div ecx
pop ecx
push eax
mov al, 0xff
pop edx
sub al, dl
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov byte [ecx + 3], al
inc edi
dec ebx
jne 0x4f1354
inc dword [ebp - 8]
dec dword [ebp - 0x1c]
jne 0x4f1337
mov eax, esi
call fcn.004289e8
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x18]
call fcn.00423424
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f13c0
lea eax, [ebp - 0x14]
call fcn.00405248
ret