Function at 0x4fa220
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6b1eec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebp
mov dword [esi], 0x6c4254
mov dword [esp + 0x1c], ebp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x34], ebp
mov dword [esi + 0x38], ebp
lea ebx, [esi + 0x3c]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00527000
lea ecx, [esi + 0x614]
mov byte [esp + 0x1c], 2
call fcn.00527000
push fcn.00527170
push fcn.00527000
push 9
push 0x5d8
lea eax, [esi + 0xbfc]
push eax
mov byte [esp + 0x30], 3
call fcn.005ce6bb
push fcn.00527170
push fcn.00527000
push 0xa
push 0x5d8
lea ecx, [esi + 0x4094]
push ecx
mov byte [esp + 0x30], 4
call fcn.005ce6bb
push fcn.00527170
push fcn.00527000
push 9
push 0x5d8
lea edx, [esi + 0x7b04]
push edx
mov byte [esp + 0x30], 5
call fcn.005ce6bb
push fcn.00527170
push fcn.00527000
push 2
push 0x5d8
lea eax, [esi + 0xaf9c]
push eax
mov byte [esp + 0x30], 6
call fcn.005ce6bb
push fcn.00527170
push fcn.00527000
push 0x10
push 0x5d8
lea ecx, [esi + 0xbb4c]
push ecx
mov byte [esp + 0x30], 7
call fcn.005ce6bb
mov byte [esp + 0x1c], 8
push fcn.0052b980
push fcn.0052b880
push 4
push 0x125c
lea edx, [esi + 0x118cc]
push edx
call fcn.005ce6bb
push fcn.0052b980
push fcn.0052b880
push 3
push 0x125c
lea eax, [esi + 0x1623c]
push eax
mov byte [esp + 0x30], 9
call fcn.005ce6bb
push fcn.0052b980
push fcn.0052b880
push 1
push 0x125c
lea ecx, [esi + 0x19950]
push ecx
mov byte [esp + 0x30], 0xa
call fcn.005ce6bb
push fcn.0041ff00
push 0x41fef0
push 5
push 0x10
lea edx, [esi + 0x1abac]
push edx
mov byte [esp + 0x30], 0xb
call fcn.005ce6bb
mov edx, dword [esi]
mov dword [esi + 0x20], ebp
mov eax, dword [0x70859c]
add eax, 0xfffffeec
mov ecx, esi
mov byte [esp + 0x1c], 0xc
mov dword [esi + 4], eax
mov dword [esi + 8], ebp
mov dword [esi + 0xc], 0xfa
mov dword [esi + 0x10], 0x1ce
call dword [edx + 0xc]
mov ecx, esi
call fcn.00526820
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push 0x3f800000
push ebp
push 0x3f400000
push 0x3f000000
push 0x3f800000
push ebp
push 0x3f000000
push 0x3e800000
push 0x3f800000
push ebp
push 0x3e800000
push ebp
push 1
xor eax, eax
mov ecx, 0x40
mov edi, 0x2201ef8
rep stosd dword es:[edi], eax
push 0x20
mov ecx, 0x40
mov edi, 0x2201df0
push 0x80
rep stosd dword es:[edi], eax
mov dword [0x2201ef0], ebp
mov dword [0x2201ff8], 0xffffffff
push str.talk1_close_button.tga
fld dword [0x70aab0]
push ebp
push 0x16
push 0x16
push 0x20
push 0x20
call fcn.005cd414
fld dword [0x70aaac]
push eax
call fcn.005cd414
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 8]
push eax
push ecx
mov ecx, ebx
call fcn.00528830
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push 0x3f800000
push ebp
push 0x3f400000
push 0x3f000000
push 0x3f800000
push ebp
push 0x3f000000
push 0x3e800000
push 0x3f800000
push ebp
push 0x3e800000
push ebp
push 1
push 0x20
push 0x80
push str.talk1_close_button.tga
push ebp
push 0x16
push 0x16
push 0x20
push 0x20
push ebp
push ebp
push ebp
push ebp
lea ecx, [esi + 0x614]
call fcn.00528830
cmp dword [0x708598], 2
jne 0x4fa5c4
mov eax, 0x11
mov dword [0x70a4f0], 0x1e
mov dword [0x70a4f4], eax
mov dword [0x70a4f8], 0x10
mov dword [0x70a4fc], 0x13
mov dword [0x70a500], 0x2d
mov dword [0x70a504], 0x20
mov dword [0x70a508], 0x1f
mov dword [0x70a50c], 0x12
mov dword [0x70a510], eax
mov dword [0x70a514], 0x39
mov dword [0x70a518], 0x2e
mov dword [0x70a51c], 0x25
mov dword [0x70a520], 0x16
mov dword [0x70a524], 0x30
mov dword [0x70a528], 0x2f
mov dword [0x70a52c], 0x17
mov dword [0x70a530], 0x24
mov dword [0x70a534], 0x22
mov dword [0x70a538], 0x32
mov dword [0x70a53c], 1
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret