Function at 0x48a200
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51b3df
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x56858c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x68], esi
xor ebx, ebx
mov dword [esi], vtable.TextDispScene::CTextDisp.0
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], 0xff
mov dword [esi + 0x38], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov ecx, 0x56a451
mov byte [ebp - 4], 4
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
call fcn.004074f0
mov ecx, dword [0x5699e4]
lea eax, [ebp - 0x18]
push eax
call fcn.00430a30
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push 0x24
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
call fcn.00503a77
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
cmp eax, ebx
je 0x48a2e9
mov ecx, eax
call fcn.004116f0
jmp 0x48a2eb
xor eax, eax
push eax
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 4
call fcn.0040ced0
mov eax, dword [esi + 0x74]
cmp eax, ebx
jne 0x48a303
xor ecx, ecx
jmp 0x48a319
mov ecx, dword [esi + 0x7c]
cmp ecx, ebx
je 0x48a30f
mov edx, dword [ecx + 0xc]
jmp 0x48a311
xor edx, edx
mov ecx, dword [esi + 0x78]
imul ecx, edx
add ecx, eax
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
push 1
push 1
push eax
push edx
call fcn.0040fc70
test al, al
jne 0x48a343
push 0x5455d8
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 1
call fcn.005036c5
mov ecx, 0x56a4bc
call fcn.00416ad0
mov edi, dword [0x5699f4]
mov ecx, dword [edi + 0x34]
sub ecx, dword [edi + 0x30]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
je 0x48a3a1
mov eax, dword [edi + 0x30]
mov ecx, dword [eax]
cmp ecx, ebx
jne 0x48a37b
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x48a3a4
mov edx, dword [eax + 8]
cmp edx, ebx
je 0x48a392
mov eax, dword [eax + 4]
mov edx, dword [edx + 0xc]
imul eax, edx
add eax, ecx
mov dword [ebp - 0x34], eax
jmp 0x48a3a4
mov eax, dword [eax + 4]
xor edx, edx
imul eax, edx
add eax, ecx
mov dword [ebp - 0x34], eax
jmp 0x48a3a4
mov dword [ebp - 0x34], ebx
mov ecx, 0x56a4b4
call fcn.00416a20
mov ecx, dword [ebp - 0x34]
mov edi, dword [0x5699f0]
push str.text_context
call fcn.00471170
push eax
mov ecx, edi
call fcn.0044dfe0
mov ecx, eax
call fcn.004a0350
push eax
mov ecx, esi
call fcn.00474f30
test al, al
jne 0x48a3f1
push 0x5455d8
lea edx, [ebp - 0x34]
push edx
mov dword [ebp - 0x34], 1
call fcn.005036c5
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 6
call fcn.00405500
mov ecx, 0x56a4bc
call fcn.00416ad0
mov edi, dword [0x5699f4]
mov ecx, 0x56a4b4
call fcn.00416a20
mov eax, dword [0x5699f0]
push str.text_string
push ebx
mov ecx, edi
mov dword [ebp - 0x34], eax
call fcn.00404910
mov ecx, eax
call fcn.00471170
mov ecx, dword [ebp - 0x34]
push eax
call fcn.0044dfe0
mov ecx, eax
call fcn.004a0350
mov ecx, 0x56a4b4
mov edi, eax
call fcn.00416a20
mov eax, dword [0x5699f0]
mov ecx, dword [eax]
cmp ecx, ebx
jne 0x48a479
xor eax, eax
jmp 0x48a48f
mov edx, dword [eax + 8]
cmp edx, ebx
je 0x48a485
mov edx, dword [edx + 0xc]
jmp 0x48a487
xor edx, edx
mov eax, dword [eax + 4]
imul eax, edx
add eax, ecx
mov edx, dword [eax + 0x18]
cmp edx, ebx
jne 0x48a49a
xor eax, eax
jmp 0x48a4b0
mov ecx, dword [eax + 0x20]
cmp ecx, ebx
je 0x48a4a6
mov ecx, dword [ecx + 0xc]
jmp 0x48a4a8
xor ecx, ecx
mov eax, dword [eax + 0x1c]
imul eax, ecx
add eax, edx
mov edx, dword [eax + 4]
cmp edx, ebx
jne 0x48a4bb
xor eax, eax
jmp 0x48a4d1
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
je 0x48a4c7
mov ecx, dword [ecx + 0xc]
jmp 0x48a4c9
xor ecx, ecx
mov eax, dword [eax + 8]
imul eax, ecx
add eax, edx
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
fcomp dword [0x528240]
mov ecx, 0x56a4b4
fnstsw ax
test ah, 1
jne 0x48a5dd
call fcn.00416a20
mov eax, dword [0x5699f0]
mov ecx, dword [eax]
cmp ecx, ebx
jne 0x48a504
xor eax, eax
jmp 0x48a51a
mov edx, dword [eax + 8]
cmp edx, ebx
je 0x48a510
mov edx, dword [edx + 0xc]
jmp 0x48a512
xor edx, edx
mov eax, dword [eax + 4]
imul eax, edx
add eax, ecx
mov edx, dword [eax + 0x18]
cmp edx, ebx
jne 0x48a525
xor eax, eax
jmp 0x48a53b
mov ecx, dword [eax + 0x20]
cmp ecx, ebx
je 0x48a531
mov ecx, dword [ecx + 0xc]
jmp 0x48a533
xor ecx, ecx
mov eax, dword [eax + 0x1c]
imul eax, ecx
add eax, edx
lea ecx, [ebp - 0x64]
push ecx
push edi
mov ecx, eax
call fcn.004875d0
test eax, eax
jns 0x48a560
mov dword [ebp - 0x34], 2
push 0x5455d8
lea edx, [ebp - 0x34]
push edx
call fcn.005036c5
cmp dword [ebp - 0x4c], ebx
jne 0x48a57a
push 0x5455d8
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 2
call fcn.005036c5
lea ecx, [ebp - 0x4c]
call fcn.00406d00
mov edx, dword [eax]
mov edx, dword [edx + 4]
lea ecx, [ebp - 0x34]
push ecx
mov ecx, eax
call edx
mov edi, dword [eax]
mov ecx, 0x56a451
mov byte [ebp - 4], 7
call fcn.004074f0
mov ecx, dword [0x5699e4]
push ebx
push ebx
push edi
call fcn.0040f660
test al, al
lea ecx, [ebp - 0x34]
sete byte [ebp - 0x39]
mov byte [ebp - 4], 6
call fcn.00403500
cmp byte [ebp - 0x39], bl
je 0x48a6b7
push 0x5455d8
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 3
call fcn.005036c5
call fcn.00416a20
mov eax, dword [0x5699f0]
mov ecx, dword [eax]
cmp ecx, ebx
jne 0x48a5f1
xor eax, eax
jmp 0x48a607
mov edx, dword [eax + 8]
cmp edx, ebx
je 0x48a5fd
mov edx, dword [edx + 0xc]
jmp 0x48a5ff
xor edx, edx
mov eax, dword [eax + 4]
imul eax, edx
add eax, ecx
mov edx, dword [eax + 0x18]
cmp edx, ebx
jne 0x48a612
xor eax, eax
jmp 0x48a628
mov ecx, dword [eax + 0x20]
cmp ecx, ebx
je 0x48a61e
mov ecx, dword [ecx + 0xc]
jmp 0x48a620
xor ecx, ecx
mov eax, dword [eax + 0x1c]
imul eax, ecx
add eax, edx
push ebx
push ebx
lea ecx, [ebp - 0x64]
push ecx
push edi
mov ecx, eax
call fcn.00422460
test eax, eax
js 0x48a54b
cmp dword [ebp - 0x64], ebx
jne 0x48a658
push 0x5455d8
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 2
push eax
jmp 0x48a55b
lea ecx, [ebp - 0x64]
call fcn.00406d00
mov edx, dword [eax]
mov edx, dword [edx + 4]
lea ecx, [ebp - 0x34]
push ecx
mov ecx, eax
call edx
mov edi, dword [eax]
mov ecx, 0x56a451
mov byte [ebp - 4], 8
call fcn.004074f0
mov ecx, dword [0x5699e4]
push ebx
push ebx
push edi
call fcn.0040f660
test al, al
lea ecx, [ebp - 0x34]
sete byte [ebp - 0x39]
mov byte [ebp - 4], 6
call fcn.00403500
cmp byte [ebp - 0x39], bl
je 0x48a6b7
push 0x5455d8
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 3
push eax
jmp 0x48a55b
mov ecx, 0x56a4bc
call fcn.00416ad0
mov edi, dword [0x5699f4]
mov ecx, 0x56a4b4
call fcn.00416a20
mov ecx, dword [0x5699f0]
push str.text_pos_x
mov dword [ebp - 0x34], ecx
push ebx
mov ecx, edi
call fcn.00404910
mov ecx, eax
call fcn.00471170
mov ecx, dword [ebp - 0x34]
push eax
call fcn.0044dfe0
mov ecx, eax
call fcn.004a0350
mov ecx, 0x56a4bc
mov dword [ebp - 0x34], eax
call fcn.00416ad0
mov edi, dword [0x5699f4]
mov ecx, 0x56a4b4
call fcn.00416a20
mov edx, dword [0x5699f0]
push str.text_pos_y
push ebx
mov ecx, edi
mov dword [ebp - 0x40], edx
call fcn.00404910
mov ecx, eax
call fcn.00471170
mov ecx, dword [ebp - 0x40]
push eax
call fcn.0044dfe0
mov ecx, eax
call fcn.004a0350
mov ecx, 0x56a4bc
mov dword [ebp - 0x40], eax
call fcn.00416ad0
mov edi, dword [0x5699f4]
mov ecx, 0x56a4b4
call fcn.00416a20
mov eax, dword [0x5699f0]
push str.text_pos_center
push ebx
mov ecx, edi
mov dword [ebp - 0x14], eax
call fcn.00404910
mov ecx, eax
call fcn.00471170
mov ecx, dword [ebp - 0x14]
push eax
call fcn.0044dfe0
mov ecx, eax
call fcn.004a0350
cmp eax, ebx
je 0x48a7d0
lea ecx, [ebp - 0x30]
push ecx
call fcn.0040bfa0
mov ecx, eax
call fcn.0040f750
push eax
lea edx, [ebp - 0x20]
push edx
call dword [0x526390]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
cdq
sub eax, edx
sar eax, 1
neg eax
add dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
neg eax
add dword [ebp - 0x40], eax
mov ecx, 0x56a451
call fcn.004074f0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x34]
push eax
push ecx
mov ecx, dword [0x5699e4]
call fcn.0040f5e0
lea ecx, [esi + 0x74]
call fcn.00406d00
mov edi, dword [eax + 4]
mov ecx, 0x56a451
call fcn.004074f0
mov ecx, dword [0x5699e4]
push ebx
push edi
call fcn.00430b40
test al, al
jne 0x48a827
mov dword [ebp - 0x14], 3
push 0x5455d8
lea edx, [ebp - 0x14]
jmp 0x48a55a
push str.text_effect
push ebx
mov byte [esi + 0x6d], bl
call fcn.004174d0
mov ecx, eax
call fcn.00404910
mov ecx, eax
call fcn.00471170
push eax
call fcn.004174c0
mov ecx, eax
call fcn.0044dfe0
mov ecx, eax
call fcn.004a0350
mov byte [esi + 0x58], bl
cmp eax, 0xfffffffe
jne 0x48a865
mov byte [esi + 0x58], 1
jmp 0x48a8cb
cmp eax, ebx
jl 0x48a8cb
push eax
call fcn.004088b0
lea ecx, [eax + 0x10]
call fcn.00406d00
mov ecx, eax
call fcn.00431350
push eax
lea ecx, [ebp - 0x34]
call fcn.0040e800
mov eax, dword [ebp - 0x34]
push eax
lea eax, [esi + 0x5c]
push eax
mov byte [ebp - 4], 9
call fcn.004174c0
mov ecx, eax
call fcn.004068a0
mov ecx, eax
call fcn.004672f0
test al, al
jne 0x48a8bf
push 0x5455d8
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push ecx
jmp 0x48a55b
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 6
call fcn.00403500
push 2
call fcn.004174d0
mov ecx, eax
call fcn.00404910
mov edx, dword [eax + 4]
push 2
mov dword [esi + 8], edx
call fcn.004174d0
mov ecx, eax
call fcn.00404910
mov dword [eax + 4], ebx
push 5
mov byte [esi + 0x6c], 1
mov dword [esi + 4], ebx
mov dword [esi + 0x70], ebx
call fcn.004174d0
mov ecx, eax
call fcn.00404910
mov ecx, eax
call fcn.0045b7c0
test al, al
jne 0x48a956
push 2
call fcn.004174d0
mov ecx, eax
call fcn.00404910
test byte [eax + 0x18], 2
je 0x48a956
call fcn.0040bfa0
mov ecx, eax
call fcn.0040f6e0
mov edi, eax
cmp edi, 0x1e
jge 0x48a93f
mov edi, 0x1e
push 1
call fcn.004174d0
mov ecx, eax
call fcn.00404910
mov eax, dword [eax + 0x40]
imul eax, edi
mov dword [esi + 0x70], eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.0043ba60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00503edb
mov esp, ebp
pop ebp
ret