Function at 0x100489f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push fcn.100789f0
push 0x968180
push 0xe9
call fcn.100d5c50
push 0x10008f60
push 0x4fcb58
push 0xe9
mov dword [0x102c3234], 0
mov dword [0x102c3238], 0
mov dword [0x102c323c], 0
mov dword [0x102c3244], 0
mov dword [0x102c3240], 0
call fcn.100d5c50
push 0x10008f80
push 0x4fd0b9
push 0xe9
call fcn.100d5c50
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x24
cmp dword [0x101f679c], 1
jne 0x10048b02
push 0x100b5440
push 0x853950
push 0xe9
call fcn.100d5c50
push 0x100b5820
push 0x8533a0
push 0xe9
call fcn.100d5c50
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x85375b
call edi
mov eax, 0x85375b
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x85375b
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x85374b
call edi
mov eax, 0x85374b
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x85374b
call edi
push 0x100489a0
push 0x8350e9
push 0xe8
call fcn.100d5c50
add esp, 0xc
cmp dword [0x101f67a4], 1
jne 0x10048b4d
push 0x1000d6a0
push 0x5bafab
push 0xe8
call fcn.100d5c50
push 0x1000d600
push 0x7c5db0
push 0xe8
call fcn.100d5c50
add esp, 0x18
cmp dword [0x101f67a0], 1
jne 0x10048b7c
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x81c03fa
call edi
lea eax, [ebp - 4]
mov byte [0x81c03fa], 1
push eax
push dword [ebp - 4]
push 1
push 0x81c03fa
call edi
mov dword [0x102f1340], 0x42f6e9df
mov eax, 0x51eb851f
imul dword [0xe61e58]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
movd xmm0, eax
mov eax, 0x1b4e81b5
cvtdq2ps xmm0, xmm0
movss dword [0x102f1344], xmm0
imul dword [0xe61e5c]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [0x101f67b4], 1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [0x102f1348], xmm0
jne 0x10048c60
mov byte [0x102c32a8], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x10038740
sub eax, 0x1388
mov byte [0x102c32b0], 0
push 0x7d2bc0
push 0xe9
mov dword [0x102c32ac], eax
call fcn.100d5c50
push fcn.10039410
push 0x80b8e0
push 0xe9
call fcn.100d5c50
push 0x10039420
push 0x7d26b5
push 0xe9
call fcn.100d5c50
push 0x100395c0
push 0x7d2751
push 0xe9
call fcn.100d5c50
push 0x10039760
push 0x7d27fc
push 0xe9
call fcn.100d5c50
add esp, 0x3c
mov eax, dword [0x101f67bc]
sub eax, 1
je 0x10048e17
sub eax, 1
je 0x10048d44
sub eax, 1
jne 0x10048f0d
push 0x100c2920
push 0x848cb6
push 0xe8
mov dword [0x102cc2e0], eax
call fcn.100d5c50
push 0x100c2a00
push 0x8491ae
push 0xe8
call fcn.100d5c50
push 0x100c2ce0
push 0x8491b6
push 0xe8
call fcn.100d5c50
push 0x100c3520
push 0x8491be
push 0xe8
call fcn.100d5c50
push 0x100c4a70
push 0x849087
push 0xe8
call fcn.100d5c50
push 0x100c49f0
push 0x848f07
push 0xe8
call fcn.100d5c50
add esp, 0x48
push 0x100c4970
push 0x848e5d
push 0xe8
call fcn.100d5c50
push 0x100c49b0
push 0x848eb2
push 0xe8
call fcn.100d5c50
push 0x100c4a30
push 0x848f4b
push 0xe8
call fcn.100d5c50
add esp, 0x24
jmp 0x10048f0d
push 0x1000e950
push 0x848cb6
push 0xe8
call fcn.100d5c50
push 0x1000ea10
push 0x8491ae
push 0xe8
call fcn.100d5c50
push 0x1000ebc0
push 0x8491b6
push 0xe8
call fcn.100d5c50
push 0x1000f060
push 0x8491be
push 0xe8
call fcn.100d5c50
push 0x10010600
push 0x849087
push 0xe8
call fcn.100d5c50
push 0x100105d0
push 0x848f07
push 0xe8
call fcn.100d5c50
add esp, 0x48
push 0x10010570
push 0x848e5d
push 0xe8
call fcn.100d5c50
push 0x100105a0
push 0x848eb2
push 0xe8
call fcn.100d5c50
push 0x10010600
push 0x848f4b
push 0xe8
call fcn.100d5c50
push 0x10010610
push 0x8490f5
push 0xe8
call fcn.100d5c50
add esp, 0x30
jmp 0x10048f0d
push 0x10056240
push 0x848cb6
push 0xe8
call fcn.100d5c50
push 0x10056300
push 0x8491ae
push 0xe8
call fcn.100d5c50
push 0x100565c0
push 0x8491b6
push 0xe8
call fcn.100d5c50
push 0x100569c0
push 0x8491be
push 0xe8
call fcn.100d5c50
push 0x10059540
push 0x849087
push 0xe8
call fcn.100d5c50
push 0x100594e0
push 0x848f07
push 0xe8
call fcn.100d5c50
add esp, 0x48
push 0x10059480
push 0x848e5d
push 0xe8
call fcn.100d5c50
push 0x100594b0
push 0x848eb2
push 0xe8
call fcn.100d5c50
push 0x10059510
push 0x848f4b
push 0xe8
call fcn.100d5c50
push 0x10059570
push 0x8490f5
push 0xe8
call fcn.100d5c50
push 0x100595d0
push 0x772960
push 0xe8
call fcn.100d5c50
push 0x100595f0
push 0x7729b3
push 0xe8
call fcn.100d5c50
add esp, 0x48
mov eax, dword [0x101f67c8]
sub eax, 1
je 0x10048f23
sub eax, 1
jne 0x10048f28
call fcn.100e28e0
jmp 0x10048f28
call fcn.1003a810
mov eax, dword [0x101f67f8]
push esi
sub eax, 1
je 0x10048fd7
sub eax, 1
je 0x10048f4f
sub eax, 2
jne 0x10049044
call fcn.10041460
jmp 0x10049044
push 0x10072d50
push 0x4d7eb1
push 0xe8
call fcn.100d5c50
push 0x10072b20
push 0x4d76fb
push 0xe8
call fcn.100d5c50
push 0x10072b20
push 0x4d79c3
push 0xe8
call fcn.100d5c50
mov esi, dword [0x101f67fc]
lea eax, [ebp - 4]
add esp, 0x24
mov dword [ebp - 4], 0
push eax
push 0x40
push 4
push 0x4d75f0
call edi
test eax, eax
je 0x10048fcf
lea eax, [ebp - 8]
mov dword [0x4d75f0], esi
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 4
push 0x4d75f0
call edi
test eax, eax
jne 0x10049044
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10049044
push 0x10015790
push 0x4d76fb
push 0xe8
call fcn.100d5c50
push 0x10015790
push 0x4d79c3
push 0xe8
call fcn.100d5c50
mov esi, dword [0x101f67fc]
lea eax, [ebp - 4]
add esp, 0x18
push eax
push 0x40
push 4
push 0x4d75f0
call edi
lea eax, [ebp - 4]
mov dword [0x4d75f0], esi
push eax
push dword [ebp - 4]
push 4
push 0x4d75f0
call edi
push 0x10015860
push 0x5edda9
push 0xe8
call fcn.100d5c50
add esp, 0xc
mov eax, dword [0x101f6800]
pop esi
sub eax, 1
je 0x1004906c
sub eax, 1
je 0x10049065
sub eax, 2
jne 0x10049071
call fcn.10041460
call fcn.10042cf0
jmp 0x10049071
call fcn.100721b0
jmp 0x10049071
call fcn.10015cf0
mov eax, dword [0x101f67d0]
cmp eax, 1
jne 0x100491d3
push 0x1003a410
push 0x789099
push 0xe9
call fcn.100d5c50
push 0x1003a3c0
push 0x7890e2
push 0xe9
call fcn.100d5c50
push 0x10039f00
push 0x78b0cf
push 0xe8
call fcn.100d5c50
push 0x10039ca0
push 0x78b09a
push 0xe8
call fcn.100d5c50
push 0x100399f0
push 0x787620
push 0xe8
call fcn.100d5c50
push fcn.10039410
push 0x787628
push 0xe8
call fcn.100d5c50
add esp, 0x48
push 0x10039bf0
push 0x787748
push 0xe8
call fcn.100d5c50
push 0x7867b3
push 0x7867a5
push 0xe9
call fcn.100d5c50
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x787c7d
call edi
mov eax, 0x787c7d
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x787c7d
call edi
push 0x10039910
push 0x7864b3
push 0xe8
call fcn.100d5c50
push 0x10039910
push 0x78641e
push 0xe8
call fcn.100d5c50
push 0x10039910
push 0x7863a8
push 0xe8
call fcn.100d5c50
push 0x10039910
push 0x786347
push 0xe8
call fcn.100d5c50
push 0x10039910
push 0x7862e2
push 0xe8
call fcn.100d5c50
push 0x10010600
push 0x78628e
push 0xe8
call fcn.100d5c50
mov eax, dword [0x101f67d0]
add esp, 0x48
cmp eax, 2
jne 0x10049359
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x785b44
call edi
mov eax, 0x785b44
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x785b44
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x787630
call edi
mov eax, 0x787630
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x787630
call edi
push 0x10032af0
push 0x78adcc
push 0xe8
call fcn.100d5c50
push 0x10032af0
push 0x78ae15
push 0xe8
call fcn.100d5c50
push 0x10032af0
push 0x78ae5e
push 0xe8
call fcn.100d5c50
push 0x100318d0
push 0x78b09a
push 0xe8
call fcn.100d5c50
push 0x10031b20
push 0x78b0cf
push 0xe8
call fcn.100d5c50
push 0x10032630
push 0x787620
push 0xe8
call fcn.100d5c50
add esp, 0x48
push 0x10031cc0
push 0x787628
push 0xe8
call fcn.100d5c50
push 0x10032aa0
push 0x787748
push 0xe8
call fcn.100d5c50
push 0x10032990
push 0x7864b3
push 0xe8
call fcn.100d5c50
push 0x10032990
push 0x78641e
push 0xe8
call fcn.100d5c50
push 0x10032990
push 0x7863a8
push 0xe8
call fcn.100d5c50
push 0x10032990
push 0x786347
push 0xe8
call fcn.100d5c50
add esp, 0x48
push 0x10032990
push 0x7862e2
push 0xe8
call fcn.100d5c50
push 0x10032990
push 0x78628e
push 0xe8
call fcn.100d5c50
add esp, 0x18
cmp dword [0x101f6818], 2
jne 0x1004938d
push 0x100e4d50
push 0x7e020c
push 0xe8
call fcn.100d5c50
push 0x100e4d50
push 0x7e0298
push 0xe8
call fcn.100d5c50
add esp, 0x18
call fcn.1003ceb0
call fcn.100e2690
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push 0x556cc6
call edi
mov eax, 0x556cc6
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 6
push 0x556cc6
call edi
push 0x100c2900
push 0x556cc6
push 0xe9
call fcn.100d5c50
add esp, 0xc
mov ecx, 0x101f6320
push str.Data__KGData__Lua__CharacterSystem__SkillCroma.lua
call fcn.100bc3f0
push dword [0x101f6324]
call fcn.100a0950
call fcn.100bf010
cmp byte [0x101f68ac], 1
jne 0x10049430
push 0x100ba890
push 0x842ac7
push 0xe8
call fcn.100d5c50
push 0x100ba890
push 0x842b8d
push 0xe8
call fcn.100d5c50
add esp, 0x18
cmp dword [0x101f6790], 1
jne 0x100494a4
mov dword [0x1054b8c4], 0
call fcn.10071b60
cmp dword [0x101f6790], 1
jne 0x100494a4
push 0x100708f0
push 0x40b5a9
push 0xe8
call fcn.100d5c50
push 0x10070280
push 0x40b400
push 0xe8
call fcn.100d5c50
push 0x10070280
push 0x40b44f
push 0xe8
call fcn.100d5c50
push 0x10071af0
push 0x483711
push 0xe8
call fcn.100d5c50
add esp, 0x30
cmp byte [0x101f68b0], 1
jne 0x100495d0
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x40c98c
call edi
lea eax, [ebp - 4]
mov dword [0x40c98c], 2
push eax
push dword [ebp - 4]
push 4
push 0x40c98c
call edi
push 0x100bc0c0
push 0x4d7602
push 0xe8
call fcn.100d5c50
push 0x100bbee0
push 0x40b331
push 0xe8
call fcn.100d5c50
push 0x100bbd20
push 0x40ada2
push 0xe8
call fcn.100d5c50
push 0x100bbde0
push 0x40b2e2
push 0xe8
call fcn.100d5c50
push 0x100bbfe0
push 0x40c3af
push 0xe8
call fcn.100d5c50
push 0x100bbfe0
push 0x40c40b
push 0xe8
call fcn.100d5c50
add esp, 0x48
push 0x100bbfe0
push 0x40c45f
push 0xe8
call fcn.100d5c50
push 0x100bbfa0
push 0x40b422
push 0xe8
call fcn.100d5c50
push 0x100bbfa0
push 0x40b47c
push 0xe8
call fcn.100d5c50
push 0x100bbf00
push 0x40b3f1
push 0xe8
call fcn.100d5c50
push 0x100bbf80
push 0x40b515
push 0xe8
call fcn.100d5c50
push 0x100bc0a0
push 0x40ab50
push 0xe8
call fcn.100d5c50
add esp, 0x48
call fcn.100b7530
pop edi
mov esp, ebp
pop ebp
ret