Function at 0x4b7210
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6b03f4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea ebx, [esi + 0x30]
mov dword [esi], 0x6c2048
mov dword [esp + 0x6c], edi
mov dword [ebx + 4], edi
mov dword [ebx], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
lea ecx, [esi + 0x40]
mov byte [esp + 0x6c], 1
call fcn.00527000
lea ecx, [esi + 0x618]
mov byte [esp + 0x6c], 2
call fcn.00527000
lea ecx, [esi + 0xbf0]
mov byte [esp + 0x6c], 3
call fcn.00527000
lea ecx, [esi + 0x11c8]
mov byte [esp + 0x6c], 4
call fcn.00527000
lea ebp, [esi + 0x17a4]
mov ecx, ebp
mov byte [esp + 0x6c], 5
call fcn.0052d480
lea ecx, [esi + 0x1814]
mov byte [esp + 0x6c], 6
call fcn.004230b0
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x78]
add eax, 0x3c
add ecx, 0x23
mov dword [esi + 0x17a0], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0x16c
mov dword [esi + 0x10], 0x15a
mov eax, dword [0x22019b0]
cmp eax, edi
mov byte [esp + 0x6c], 7
jne 0x4b730a
xor ecx, ecx
jmp 0x4b7315
mov ecx, dword [0x22019b4]
sub ecx, eax
sar ecx, 2
mov edx, dword [esp + 0x7c]
cmp edx, ecx
jge 0x4b7329
lea eax, [eax + edx*4]
mov dword [0x22019bc], eax
mov eax, dword [eax]
jmp 0x4b732b
xor eax, eax
mov ecx, 0x80
mov edx, 0x20
mov dword [esp + 0x60], edx
mov dword [esp + 0x48], edx
mov edx, 0x40
mov dword [esi + 0x2c], eax
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x44], edi
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], 0x60
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0x20
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 0x60
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
cmp byte [eax + 0x16d], 3
jne 0x4b7434
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x50]
push eax
mov eax, dword [esi + 8]
lea edx, [esp + 0x64]
push edx
push 1
push ecx
push ecx
push str.Letter_Btn_Payment2.tga
push edi
push 0x1c
push 0x43
push 0x20
push ecx
mov ecx, dword [esi + 4]
push 0x137
push 0x6e
push eax
push ecx
lea ecx, [esi + 0x40]
call fcn.005289a0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esi + 8]
lea edx, [esp + 0x50]
push edx
mov edx, dword [esi + 4]
lea eax, [esp + 0x64]
push eax
push 1
push 0x80
push 0x80
push str.Letter_Btn_return.tga
push edi
push 0x1c
push 0x43
push 0x20
push 0x80
push 0x137
push 0xc9
push ecx
push edx
jmp 0x4b74c0
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x3c]
push eax
lea edx, [esp + 0x50]
push edx
mov edx, dword [esi + 4]
lea eax, [esp + 0x64]
push eax
push 1
push ecx
push ecx
push str.Letter_Btn_Recv.tga
push edi
push 0x1c
push 0x43
push 0x20
push ecx
mov ecx, dword [esi + 8]
push 0x137
push 0x81
push ecx
push edx
lea ecx, [esi + 0x40]
call fcn.005289a0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x3c]
push edx
mov edx, dword [esi + 8]
lea eax, [esp + 0x50]
push eax
mov eax, dword [esi + 4]
lea ecx, [esp + 0x64]
push ecx
push 1
push 0x80
push 0x80
push str.Letter_Btn_Reply.tga
push edi
push 0x1c
push 0x43
push 0x20
push 0x80
push 0x137
push 0xc9
push edx
push eax
lea ecx, [esi + 0x618]
call fcn.005289a0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x3c]
push eax
mov eax, dword [esi + 8]
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esi + 4]
lea edx, [esp + 0x64]
push edx
push 1
push 0x80
push 0x80
push str.Letter_Btn_Del.tga
push edi
push 0x1c
push 0x43
push 0x20
push 0x80
push 0x137
push 0x112
push eax
push ecx
lea ecx, [esi + 0xbf0]
call fcn.005289a0
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x3f800000
push edi
push 0x3f400000
push 0x3f000000
push 0x3f800000
push edi
push 0x3f000000
push 0x3e800000
push 0x3f800000
push edi
push 0x3e800000
push edi
mov edx, dword [esi + 8]
push 1
mov eax, dword [esi + 4]
push 0x20
push 0x80
push str.talk1_close_button.tga
push edi
push 0x16
push 0x16
push 0x20
push 0x20
push 6
push 0x150
push edx
push eax
lea ecx, [esi + 0x11c8]
call fcn.00528830
push 0xff
push 0xff
push 0xff
push 0xffffffffffffffff
push 0x104
push edi
push edi
push edi
push edi
mov ecx, ebp
call fcn.0052cf20
push 0xf
mov ecx, ebp
call fcn.0052ce80
mov ecx, ebp
call fcn.0052d2f0
mov eax, dword [esi + 0x2c]
cmp eax, edi
je 0x4b75c7
add eax, 0x47
push eax
mov ecx, ebp
call fcn.0052dbd0
mov ecx, 0x2203adc
call fcn.005347d0
mov ecx, dword [esi + 0x2c]
cmp byte [ecx + 0x16d], 3
push 0x200
mov ecx, ebx
push 0x200
jne 0x4b75f0
push str.Letter_Bg_Re_Payment.tga
jmp 0x4b75f5
push str.Letter_Bg_Recv.tga
push str.data_interface
call fcn.005497a0
mov ecx, dword [esp + 0x64]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x60
ret 0xc