Function at 0x4028b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ecx, str.onProjectileCollision
push edi
call fcn.004021e0
push 0xa
mov dword [ebp - 0x98], eax
mov dword [esi + 0x20], 0xa
call fcn.00406c21
xor edx, edx
mov dword [esi + 0xc], eax
add esp, 4
lea ecx, [edx + 1]
call fcn.004012c0
mov bl, byte [0x40c388]
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x1c], 0x46cfc5
test bl, bl
je 0x402921
push eax
push 0x46cfc5
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x40293c
push 0
push eax
push ecx
push 0x46cfc5
push dword [0x40c38c]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov bl, byte [0x40c388]
mov edx, dword [esi + 0x18]
mov al, byte [esi + 0x18]
sub al, byte [esi + 0x1c]
mov edi, dword [esi + 0x1c]
sub al, 5
sub edx, edi
mov byte [ebp - 0x17], al
mov byte [ebp - 0x18], 0xe9
mov dword [ebp - 0x13], 0x90909090
mov byte [ebp - 0xf], 0x90
lea ecx, [edx - 5]
mov eax, ecx
sar ecx, 0x10
sar eax, 8
mov byte [ebp - 0x16], al
lea eax, [edx - 5]
shr eax, 0x18
test bl, bl
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [ebp - 0x15], cl
mov byte [ebp - 0x14], al
je 0x4029b4
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 2
push eax
push 0x40
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movq xmm0, qword [ebp - 0x18]
movq qword [edi], xmm0
mov ax, word [ebp - 0x10]
mov word [edi + 8], ax
jmp 0x4029c5
push 0
push 0xa
lea eax, [ebp - 0x18]
push eax
push edi
push dword [0x40c38c]
call ebx
mov eax, dword [ebp - 0x98]
mov ecx, eax
mov edi, dword [esi + 0x18]
sar ecx, 8
mov byte [ebp - 0x82], al
mov dword [ebp - 0x9c], ecx
mov byte [ebp - 0x81], cl
mov ecx, eax
shr eax, 0x18
mov dword [ebp - 0xa4], eax
mov byte [ebp - 0x7f], al
mov al, 0x3b
sub al, byte [esi + 0x18]
sar ecx, 0x10
mov dword [ebp - 0xa0], ecx
mov byte [ebp - 0x80], cl
mov ecx, 0x46d03b
mov byte [ebp - 0x73], al
sub ecx, edi
mov eax, ecx
mov dword [ebp - 0x8c], 0x2e85560
sar eax, 8
mov byte [ebp - 0x72], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0x71], al
mov al, 0xad
sub al, byte [esi + 0x18]
shr ecx, 0x18
mov byte [ebp - 0x70], cl
mov ecx, 0x46cfad
sub ecx, edi
mov byte [ebp - 0x6e], al
mov eax, ecx
mov dword [ebp - 0x88], 0xeb000000
sar eax, 8
mov byte [ebp - 0x6d], al
mov eax, ecx
sar eax, 0x10
shr ecx, 0x18
cmp byte [0x40c388], 0
mov word [ebp - 0x84], 0x6806
mov dword [ebp - 0x7e], 0x4c483c3
mov dword [ebp - 0x7a], 0x6100f883
mov word [ebp - 0x76], 0xf55
mov byte [ebp - 0x74], 0x84
mov dword [ebp - 0x90], edi
mov byte [ebp - 0x6f], 0xe9
mov byte [ebp - 0x6c], al
mov byte [ebp - 0x6b], cl
je 0x402ad4
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 2
push eax
push 0x40
push 0x400
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
movups xmm0, xmmword [ebp - 0x8c]
mov ecx, dword [ebp - 0x90]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [ebp - 0x7c]
movups xmmword [ecx + 0x10], xmm0
mov ax, word [ebp - 0x6c]
mov word [ecx + 0x20], ax
jmp 0x402aee
push 0
push 0x22
lea eax, [ebp - 0x8c]
push eax
push edi
push dword [0x40c38c]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0xa
mov dword [esi + 0x2c], 0xa
call fcn.00406c21
mov ecx, eax
mov dword [esi + 0x28], 0x46d63e
mov eax, dword [esi + 0x18]
add esp, 4
add eax, 0x40
mov dword [esi + 0x10], ecx
cmp byte [0x40c388], 0
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x2c]
je 0x402b31
push eax
push 0x46d63e
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x402b46
push 0
push eax
push ecx
push 0x46d63e
push dword [0x40c38c]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov al, byte [esi + 0x24]
sub al, byte [esi + 0x28]
mov edx, dword [esi + 0x24]
sub al, 5
mov byte [ebp - 0x23], al
mov eax, dword [esi + 0x28]
sub edx, eax
mov dword [ebp - 0x94], eax
mov byte [ebp - 0x24], 0xe9
mov dword [ebp - 0x1f], 0x90909090
lea ecx, [edx - 5]
mov byte [ebp - 0x1b], 0x90
mov eax, ecx
sar ecx, 0x10
sar eax, 8
mov byte [ebp - 0x22], al
lea eax, [edx - 5]
shr eax, 0x18
cmp byte [0x40c388], 0
mov byte [ebp - 0x21], cl
mov byte [ebp - 0x20], al
je 0x402bca
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], 2
push eax
push 0x40
push 0x400
push dword [ebp - 0x94]
call edi
mov ecx, dword [ebp - 0x94]
movq xmm0, qword [ebp - 0x24]
movq qword [ecx], xmm0
mov ax, word [ebp - 0x1c]
mov word [ecx + 8], ax
jmp 0x402be0
push 0
push 0xa
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x94]
push dword [0x40c38c]
call ebx
mov eax, dword [ebp - 0x98]
mov ecx, 0x46d63a
mov edi, dword [esi + 0x24]
sub ecx, edi
mov byte [ebp - 0x5e], al
mov eax, dword [ebp - 0x9c]
mov byte [ebp - 0x5d], al
mov eax, dword [ebp - 0xa0]
mov byte [ebp - 0x5c], al
mov eax, dword [ebp - 0xa4]
mov byte [ebp - 0x5b], al
mov al, 0x3a
sub al, byte [esi + 0x24]
mov byte [ebp - 0x50], al
mov eax, ecx
sar eax, 8
mov byte [ebp - 0x4f], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0x4e], al
mov al, 0x27
sub al, byte [esi + 0x24]
shr ecx, 0x18
mov byte [ebp - 0x4d], cl
mov ecx, 0x46d627
sub ecx, edi
mov byte [ebp - 0x4b], al
mov eax, ecx
mov dword [ebp - 0x68], 0x2e85560
sar eax, 8
mov byte [ebp - 0x4a], al
mov eax, ecx
sar eax, 0x10
shr ecx, 0x18
cmp byte [0x40c388], 0
mov dword [ebp - 0x64], 0xeb000000
mov word [ebp - 0x60], 0x6806
mov dword [ebp - 0x5a], 0x4c483c3
mov dword [ebp - 0x56], 0x6100f883
mov word [ebp - 0x52], 0x850f
mov byte [ebp - 0x4c], 0xe9
mov byte [ebp - 0x49], al
mov byte [ebp - 0x48], cl
je 0x402cbc
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], 2
push eax
push 0x40
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movups xmm0, xmmword [ebp - 0x68]
movups xmmword [edi], xmm0
movups xmm0, xmmword [ebp - 0x58]
movups xmmword [edi + 0x10], xmm0
mov al, byte [ebp - 0x48]
mov byte [edi + 0x20], al
jmp 0x402ccd
push 0
push 0x21
lea eax, [ebp - 0x68]
push eax
push edi
push dword [0x40c38c]
call ebx
push 7
mov dword [esi + 0x38], 7
call fcn.00406c21
mov ecx, eax
mov dword [esi + 0x34], 0x46cb5d
mov eax, dword [esi + 0x24]
add esp, 4
add eax, 0x40
mov dword [esi + 0x14], ecx
cmp byte [0x40c388], 0
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x38]
je 0x402d10
push eax
push 0x46cb5d
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x402d25
push 0
push eax
push ecx
push 0x46cb5d
push dword [0x40c38c]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [esi + 0x30]
mov al, byte [esi + 0x30]
sub al, byte [esi + 0x34]
mov edi, dword [esi + 0x34]
sub al, 5
sub edx, edi
mov byte [ebp - 0xb], al
mov byte [ebp - 0xc], 0xe9
mov word [ebp - 7], 0x9090
lea ecx, [edx - 5]
mov eax, ecx
sar ecx, 0x10
sar eax, 8
mov byte [ebp - 0xa], al
lea eax, [edx - 5]
shr eax, 0x18
cmp byte [0x40c388], 0
mov byte [ebp - 9], cl
mov byte [ebp - 8], al
je 0x402d99
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], 2
push eax
push 0x40
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov ax, word [ebp - 8]
mov word [edi + 4], ax
mov al, byte [ebp - 6]
mov byte [edi + 6], al
jmp 0x402daa
push 0
push 7
lea eax, [ebp - 0xc]
push eax
push edi
push dword [0x40c38c]
call ebx
mov eax, dword [ebp - 0x98]
mov ecx, 0x46cb46
mov edi, dword [esi + 0x30]
sub ecx, edi
mov byte [ebp - 0x3a], al
mov eax, dword [ebp - 0x9c]
mov byte [ebp - 0x39], al
mov eax, dword [ebp - 0xa0]
mov byte [ebp - 0x38], al
mov eax, dword [ebp - 0xa4]
mov byte [ebp - 0x37], al
mov al, 0x46
sub al, byte [esi + 0x30]
mov byte [ebp - 0x2a], al
mov eax, ecx
sar eax, 8
mov byte [ebp - 0x29], al
mov eax, ecx
sar eax, 0x10
shr ecx, 0x18
cmp byte [0x40c388], 0
mov dword [ebp - 0x44], 0x2e85560
mov dword [ebp - 0x40], 0xeb000000
mov word [ebp - 0x3c], 0x6806
mov dword [ebp - 0x36], 0x4c483c3
mov dword [ebp - 0x32], 0x6101f883
mov dword [ebp - 0x2e], 0xe91c7e8b
mov byte [ebp - 0x28], al
mov byte [ebp - 0x27], cl
je 0x402e79
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], 2
push eax
push 0x40
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movups xmm0, xmmword [ebp - 0x44]
mov eax, esi
movups xmmword [edi], xmm0
movq xmm0, qword [ebp - 0x34]
movq qword [edi + 0x10], xmm0
mov ecx, dword [ebp - 0x2c]
mov dword [edi + 0x18], ecx
mov cx, word [ebp - 0x28]
mov word [edi + 0x1c], cx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406bb2
mov esp, ebp
pop ebp
ret
push 0
push 0x1e
lea eax, [ebp - 0x44]
push eax
push edi
push dword [0x40c38c]
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406bb2
mov esp, ebp
pop ebp
ret