Function at 0x10036b70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10115475
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10138018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [0x10324a1c]
call fcn.1001a0b0
mov ecx, dword [0x10324a1c]
call fcn.10052c70
push dword [0x10324a1c]
call fcn.10045fb0
push 2
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push 0x1012a560
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.100102b0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push dword [0x10324a1c]
lea ecx, [ebp - 0x48]
call fcn.1000d740
sub esp, 8
mov byte [ebp - 4], 1
mov ecx, eax
call fcn.100373d0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x10036c41
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10036c37
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003732f
push edx
push ecx
call fcn.100858b9
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp edx, 0x10
jb 0x10036c8e
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10036c84
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003732f
push edx
push ecx
call fcn.100858b9
add esp, 8
push 2
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push 0x1012a560
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.100102b0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 2
push eax
push dword [0x10324a1c]
lea ecx, [ebp - 0x48]
call fcn.1000d740
sub esp, 8
mov byte [ebp - 4], 3
mov ecx, eax
call fcn.10037610
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x10036d15
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10036d0b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10037334
push edx
push ecx
call fcn.100858b9
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp edx, 0x10
jb 0x10036d62
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10036d58
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10037334
push edx
push ecx
call fcn.100858b9
add esp, 8
push 2
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push 0x1012a560
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.100102b0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 4
push eax
push dword [0x10324a1c]
lea ecx, [ebp - 0x48]
call fcn.1000d740
push 0x100352a0
push str.CheckModelById
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.10010630
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x10036df0
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10036de6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10037339
push edx
push ecx
call fcn.100858b9
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp edx, 0x10
jb 0x10036e3d
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10036e33
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10037339
push edx
push ecx
call fcn.100858b9
add esp, 8
push str.Data__Local__General__Lua__CharacterSystem__CharacterHelper.lua
mov ecx, 0x10324a18
call fcn.10041da0
push 0x1012a6e8
push str.LoadHelpers
push 0x10324a18
call fcn.10041f60
push 0x10034510
push 0x4d7348
push 0xe8
call fcn.1007e590
push 0x10034510
push 0x4d7a98
push 0xe8
call fcn.1007e590
push 0x10034510
push 0x4d9a65
push 0xe8
call fcn.1007e590
push 0x10034670
push 0x4d6ea5
push 0xe8
call fcn.1007e590
push 0x10034670
push 0x4d7787
push 0xe8
call fcn.1007e590
add esp, 0x48
push 0x10034670
push 0x4d9568
push 0xe8
call fcn.1007e590
push 0x100356a0
push 0x8363d9
push 0xe9
call fcn.1007e590
push 0x100357e0
push 0x835e80
push 0xe9
call fcn.1007e590
push 0x10035840
push 0x4d72eb
push 0xe9
call fcn.1007e590
push 0x10035890
push 0x534c65
push 0xe8
call fcn.1007e590
push 0x10035960
push 0x54eac8
push 0xe9
call fcn.1007e590
add esp, 0x48
push 0x10035a10
push 0x54ed55
push 0xe9
call fcn.1007e590
push 0x10035a60
push 0x54ec8f
push 0xe9
call fcn.1007e590
push 0x10035ab0
push 0x54ed43
push 0xe9
call fcn.1007e590
push 0x10035b00
push 0x54f8ea
push 0xe9
call fcn.1007e590
push 0x10035b50
push 0x54fc7d
push 0xe9
call fcn.1007e590
push 0x10035ba0
push 0x550706
push 0xe9
call fcn.1007e590
add esp, 0x48
push 0x10035bf0
push 0x54fe28
push 0xe9
call fcn.1007e590
push 0x10035c60
push 0x54fcd8
push 0xe9
call fcn.1007e590
push 0x10035cb0
push 0x5506c2
push 0xe9
call fcn.1007e590
push 0x10035d00
push 0x5a383a
push 0xe9
call fcn.1007e590
push 0x10035da0
push 0x5517a4
push 0xe9
call fcn.1007e590
push 0x10035e00
push 0x551916
push 0xe9
call fcn.1007e590
add esp, 0x48
push 0x10035e50
push 0x551b3f
push 0xe9
call fcn.1007e590
push 0x10035ec0
push 0x551b09
push 0xe9
call fcn.1007e590
push 0x10035f50
push 0x55273e
push 0xe9
call fcn.1007e590
push 0x10035fc0
push 0x552995
push 0xe9
call fcn.1007e590
push 0x10036010
push 0x5528de
push 0xe9
call fcn.1007e590
push 0x10036090
push 0x552777
push 0xe9
call fcn.1007e590
add esp, 0x48
push 0x100360e0
push 0x564c9c
push 0xe9
call fcn.1007e590
push 0x10036140
push 0x564ba2
push 0xe9
call fcn.1007e590
push 0x10036190
push 0x564c1c
push 0xe9
call fcn.1007e590
push 0x100361e0
push 0x564e6e
push 0xe9
call fcn.1007e590
push 0x10036230
push 0x56f688
push 0xe9
call fcn.1007e590
push 0x100362a0
push 0x57e108
push 0xe9
call fcn.1007e590
add esp, 0x48
push 0x100362f0
push 0x5b53ff
push 0xe9
call fcn.1007e590
push 0x10036390
push 0x59b656
push 0xe9
call fcn.1007e590
push 0x10036430
push 0x5a3817
push 0xe9
call fcn.1007e590
push 0x100364d0
push 0x63edc8
push 0xe9
call fcn.1007e590
push 0x10036520
push 0x640a89
push 0xe9
call fcn.1007e590
push 0x10036570
push 0x640dcf
push 0xe9
call fcn.1007e590
add esp, 0x48
cmp byte [0x10146435], 0
jne 0x100371dd
push 0x100365c0
push 0x813f5a
push 0xe9
call fcn.1007e590
push 0x10036660
push 0x5b5411
push 0xe9
call fcn.1007e590
add esp, 0x18
push 0x10036700
push 0x54fd0e
push 0xe9
call fcn.1007e590
push 0x100367b0
push 0x644520
push 0xe9
call fcn.1007e590
push 0x10036880
push 0x648daf
push 0xe9
call fcn.1007e590
push 0x100368d0
push 0x648dd3
push 0xe9
call fcn.1007e590
push 0x10036970
push 0x5ae1e0
push 0xe9
call fcn.1007e590
push 0x100369c0
push 0x5ae201
push 0xe9
call fcn.1007e590
add esp, 0x48
push 0x10036a60
push 0x54ed07
push 0xe9
call fcn.1007e590
push 0x10036a80
push 0x5af273
push 0xe9
call fcn.1007e590
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
add esp, 0x18
push eax
push 0x40
push 6
push 0x8140cf
call esi
mov eax, 0x8140cf
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 6
push 0x8140cf
call esi
push 0x10036ad0
push 0x8140cf
push 0xe9
call fcn.1007e590
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push 0x59c7e5
call esi
mov eax, 0x59c7e5
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 6
push 0x59c7e5
call esi
push 0x10036b20
push 0x59c7e5
push 0xe9
call fcn.1007e590
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008550c
mov esp, ebp
pop ebp
ret
call fcn.100e88be
call fcn.100e88be
call fcn.100e88be
int3