Function at 0x1008e220
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, 0x861110
call eax
fild dword [0xe61e58]
fdiv dword [0xe7c3d4]
fld qword [0x1013f510]
fmul st(1), st(0)
fxch st(1)
fsub qword [0x1013f958]
fstp dword [ebp - 0xc]
fild dword [0xe61e5c]
fdiv dword [0xe7c3d8]
fmulp st(1)
fsub qword [0x1013f950]
fsub qword [0x1013f948]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fadd qword [0x1013f980]
call fcn.1012e5b0
fld dword [ebp - 0xc]
fadd qword [0x1013f998]
push 0xf
push 0xf
push eax
mov dword [ebp - 0x10], eax
call fcn.1012e5b0
push eax
mov ecx, 0x790b10
call ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x10
test al, al
je 0x1008e37b
cmp byte [0x8793386], 0
je 0x1008e37b
call ebx
mov edx, dword [0x116de56c]
add edx, 0xc8
cmp eax, edx
jb 0x1008e37b
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x116de56c], eax
xor eax, eax
cmp dword [0x108c77c0], eax
sete al
mov dword [0x108c77c0], eax
test eax, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x59af55
je 0x1008e33a
call esi
lea ecx, [ebp - 8]
push ecx
mov byte [0x59af55], 0
mov edx, dword [ebp - 8]
push edx
push 1
push 0x59af55
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x59b24a
call esi
lea ecx, [ebp - 8]
push ecx
mov byte [0x59b24a], 0
mov edx, dword [ebp - 8]
push edx
push 1
push 0x59b24a
jmp 0x1008e352
call esi
lea ecx, [ebp - 8]
push ecx
mov byte [0x59af55], 1
mov edx, dword [ebp - 8]
push edx
push 1
push 0x59af55
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x59b24a
call esi
lea ecx, [ebp - 8]
push ecx
mov byte [0x59b24a], 1
mov edx, dword [ebp - 8]
push edx
push 1
push 0x59b24a
call esi
fld dword [ebp - 0xc]
push edi
fadd qword [0x1013f590]
call fcn.1012e5b0
fld dword [ebp - 4]
fadd qword [0x1013f9a0]
push 0xf
push 0xf
mov edi, eax
call fcn.1012e5b0
push eax
push edi
mov eax, 0x790b10
call eax
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 0x10
test al, al
je 0x1008e407
cmp byte [0x8793386], 0
je 0x1008e407
call ebx
mov ecx, dword [0x116de56c]
add ecx, 0xc8
cmp eax, ecx
jb 0x1008e407
call ebx
mov dword [0x116de56c], eax
xor eax, eax
cmp dword [0x108c7864], eax
push str.._Settings.ini
sete al
mov dword [0x108c7864], eax
test eax, eax
je 0x1008e3f6
push 0x10135fac
jmp 0x1008e3fb
push 0x10135fa8
push str.HPMonster
push str.Setting
call esi
fld dword [ebp - 4]
push 0xf
fadd qword [0x1013f990]
push 0xf
call fcn.1012e5b0
push eax
push edi
mov edx, 0x790b10
call edx
add esp, 0x10
test al, al
je 0x1008e47c
cmp byte [0x8793386], 0
je 0x1008e47c
call ebx
mov ecx, dword [0x116de56c]
add ecx, 0xc8
cmp eax, ecx
jb 0x1008e47c
call ebx
mov dword [0x116de56c], eax
xor eax, eax
cmp dword [0x108c7870], eax
push str.._Settings.ini
sete al
mov dword [0x108c7870], eax
test eax, eax
je 0x1008e46b
push 0x10135fac
jmp 0x1008e470
push 0x10135fa8
push str.TimerBar
push str.Setting
call esi
fld dword [ebp - 4]
push 0xf
fadd qword [0x1013f988]
push 0xf
call fcn.1012e5b0
push eax
push edi
mov edx, 0x790b10
call edx
add esp, 0x10
test al, al
je 0x1008e4f1
cmp byte [0x8793386], 0
je 0x1008e4f1
call ebx
mov ecx, dword [0x116de56c]
add ecx, 0xc8
cmp eax, ecx
jb 0x1008e4f1
call ebx
mov dword [0x116de56c], eax
xor eax, eax
cmp dword [0x108c7874], eax
push str.._Settings.ini
sete al
mov dword [0x108c7874], eax
test eax, eax
je 0x1008e4e0
push 0x10135fac
jmp 0x1008e4e5
push 0x10135fa8
push str.MiniMap
push str.Setting
call esi
mov edx, dword [ebp - 0x10]
push 0xf
push 0xf
push edx
push edi
mov eax, 0x790b10
call eax
add esp, 0x10
pop edi
test al, al
je 0x1008e56c
cmp byte [0x8793386], 0
je 0x1008e56c
call ebx
mov ecx, dword [0x116de56c]
add ecx, 0xc8
cmp eax, ecx
jb 0x1008e56c
call ebx
mov dword [0x116de56c], eax
xor eax, eax
cmp dword [0x108c77c8], eax
push str.._Settings.ini
sete al
mov dword [0x108c77c8], eax
test eax, eax
je 0x1008e55b
push 0x10135fa8
push str.Menuquest
push str.Setting
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10135fac
push str.Menuquest
push str.Setting
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret