Function at 0x100475c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1019a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100724c0
push 0x968180
push 0xe9
call fcn.100bfb10
push 0x10007890
push 0x4fcb58
push 0xe9
mov dword [0x1030ea14], 0
mov dword [0x1030ea18], 0
mov dword [0x1030ea1c], 0
mov dword [0x1030ea24], 0
mov dword [0x1030ea20], 0
call fcn.100bfb10
push 0x100078b0
push 0x4fd0b9
push 0xe9
call fcn.100bfb10
push 0x10047570
push 0x8350e9
push 0xe8
mov dword [0x103177f0], 0
mov dword [0x103177f4], 0
mov byte [0x103177f8], 0
call fcn.100bfb10
add esp, 0x30
cmp dword [0x1024201c], 1
jne 0x100476a4
push 0x1000b9b0
push 0x5bafab
push 0xe8
call fcn.100bfb10
push 0x1000b910
push 0x7c5db0
push 0xe8
call fcn.100bfb10
add esp, 0x18
cmp dword [0x10242018], 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x100476da
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x81c03fa
call edi
lea eax, [ebp - 8]
mov byte [0x81c03fa], 1
push eax
push dword [ebp - 8]
push 1
push 0x81c03fa
call edi
mov dword [0x1033c8b0], 0x42f6e9df
mov eax, 0x51eb851f
imul dword [0xe61e58]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
movd xmm0, eax
mov eax, 0x1b4e81b5
cvtdq2ps xmm0, xmm0
movss dword [0x1033c8b4], xmm0
imul dword [0xe61e5c]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [0x1024202c], 1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [0x1033c8b8], xmm0
jne 0x1004773a
call fcn.10038f70
mov eax, dword [0x10242034]
cmp eax, 1
jne 0x1004774e
call fcn.100531c0
mov eax, dword [0x10242034]
cmp eax, 2
jne 0x10047758
call fcn.1000dc80
mov eax, dword [0x10242040]
sub eax, 1
je 0x1004776e
sub eax, 1
jne 0x10047773
call fcn.100cc0b0
jmp 0x10047773
call fcn.1003b240
mov eax, dword [0x10242070]
push esi
sub eax, 1
je 0x10047823
sub eax, 1
je 0x1004779a
sub eax, 2
jne 0x10047890
call fcn.10041b40
jmp 0x10047890
push 0x1006dd30
push 0x4d7eb1
push 0xe8
call fcn.100bfb10
push 0x1006db40
push 0x4d76fb
push 0xe8
call fcn.100bfb10
push 0x1006db40
push 0x4d79c3
push 0xe8
call fcn.100bfb10
mov esi, dword [0x10242074]
lea eax, [ebp - 8]
add esp, 0x24
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4d75f0
call edi
test eax, eax
je 0x1004781b
mov eax, 0x4d75f0
mov dword [eax], esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 4
push 0x4d75f0
call edi
test eax, eax
jne 0x10047890
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10047890
push 0x10017980
push 0x4d76fb
push 0xe8
call fcn.100bfb10
push 0x10017980
push 0x4d79c3
push 0xe8
call fcn.100bfb10
mov esi, dword [0x10242074]
lea eax, [ebp - 8]
add esp, 0x18
push eax
push 0x40
push 4
push 0x4d75f0
call edi
lea eax, [ebp - 8]
mov dword [0x4d75f0], esi
push eax
push dword [ebp - 8]
push 4
push 0x4d75f0
call edi
push 0x10017a60
push 0x5edda9
push 0xe8
call fcn.100bfb10
add esp, 0xc
mov eax, dword [0x10242078]
pop esi
sub eax, 1
je 0x100478b8
sub eax, 1
je 0x100478b1
sub eax, 2
jne 0x100478bd
call fcn.10041b40
call fcn.10042ed0
jmp 0x100478bd
call fcn.1006d6e0
jmp 0x100478bd
call fcn.10017ef0
mov eax, dword [0x10242048]
cmp eax, 1
jne 0x100478d1
call fcn.10039950
mov eax, dword [0x10242048]
cmp eax, 2
jne 0x100478db
call fcn.100328d0
cmp dword [0x10242090], 2
jne 0x1004790f
push 0x100cdeb0
push 0x7e020c
push 0xe8
call fcn.100bfb10
push 0x100cdeb0
push 0x7e0298
push 0xe8
call fcn.100bfb10
add esp, 0x18
call fcn.1003d8c0
call fcn.100cbe60
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x556cc6
call edi
mov eax, 0x556cc6
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push 0x556cc6
call edi
push 0x100b55b0
push 0x556cc6
push 0xe9
call fcn.100bfb10
add esp, 0xc
mov ecx, 0x10241b94
push str.Data__KGData__Lua__CharacterSystem__SkillCroma.lua
call fcn.100aff20
push dword [0x10241b98]
call fcn.10097600
call fcn.100b0ef0
cmp byte [0x10242124], 1
jne 0x100479b2
push 0x100ae690
push 0x842ac7
push 0xe8
call fcn.100bfb10
push 0x100ae690
push 0x842b8d
push 0xe8
call fcn.100bfb10
add esp, 0x18
cmp dword [0x10242008], 1
jne 0x10047a26
mov dword [0x1059826c], 0
call fcn.1006d290
cmp dword [0x10242008], 1
jne 0x10047a26
push 0x1006c040
push 0x40b5a9
push 0xe8
call fcn.100bfb10
push 0x1006ba70
push 0x40b400
push 0xe8
call fcn.100bfb10
push 0x1006ba70
push 0x40b44f
push 0xe8
call fcn.100bfb10
push 0x1006d220
push 0x483711
push 0xe8
call fcn.100bfb10
add esp, 0x30
cmp byte [0x10242128], 1
jne 0x10047b52
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x40c98c
call edi
lea eax, [ebp - 8]
mov dword [0x40c98c], 2
push eax
push dword [ebp - 8]
push 4
push 0x40c98c
call edi
push 0x100afbb0
push 0x4d7602
push 0xe8
call fcn.100bfb10
push 0x100af9d0
push 0x40b331
push 0xe8
call fcn.100bfb10
push 0x100af800
push 0x40ada2
push 0xe8
call fcn.100bfb10
push 0x100af8d0
push 0x40b2e2
push 0xe8
call fcn.100bfb10
push 0x100afad0
push 0x40c3af
push 0xe8
call fcn.100bfb10
push 0x100afad0
push 0x40c40b
push 0xe8
call fcn.100bfb10
add esp, 0x48
push 0x100afad0
push 0x40c45f
push 0xe8
call fcn.100bfb10
push 0x100afa90
push 0x40b422
push 0xe8
call fcn.100bfb10
push 0x100afa90
push 0x40b47c
push 0xe8
call fcn.100bfb10
push 0x100af9f0
push 0x40b3f1
push 0xe8
call fcn.100bfb10
push 0x100afa70
push 0x40b515
push 0xe8
call fcn.100bfb10
push 0x100afb90
push 0x40ab50
push 0xe8
call fcn.100bfb10
add esp, 0x48
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.100e34d0
mov esp, ebp
pop ebp
ret