Function at 0x10019430
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10076370
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x10094128]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x100a1ba3], 0
je 0x100195a7
cmp dword [0x5b8de0], 0x226
jne 0x100194db
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x5b8de0
push eax
lea ecx, [ebp - 0x18]
call fcn.1000b390
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x30], 4
mov esi, dword [eax]
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x34], esi
call edi
test eax, eax
setne byte [ebp - 0x28]
mov dword [esi], 0xfa0
cmp byte [ebp - 0x28], 0
je 0x100194e8
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x34]
call edi
jmp 0x100194e8
push str.Extra_objects_directory_limit_was_not_increased._n
call fcn.10015060
add esp, 4
call fcn.100504c0
cmp eax, 0x3e9
mov byte [ebp - 0x12], 1
mov edx, str.66_FF_04_45_50_9A_96_00
mov ecx, 0x43de6c
setne byte [ebp - 0x11]
call fcn.1000e2b0
test al, al
je 0x1001955e
mov edx, str.66_FF_04_45_50_9A_96_00
mov ecx, 0x43df5b
call fcn.1000e2b0
test al, al
je 0x1001955e
cmp byte [ebp - 0x11], 0
mov eax, 0x1561634
mov ecx, 0x43d6a4
mov edx, str.8D_04_45_50_9A_96_00
cmovne ecx, eax
call fcn.1000e2b0
test al, al
je 0x1001955e
cmp byte [ebp - 0x11], 0
mov eax, 0x1564c2b
mov ecx, 0x43d6cb
mov edx, str.66_8B_04_55_50_9A_96_00
cmovne ecx, eax
call fcn.1000e2b0
test al, al
jne 0x10019562
mov byte [ebp - 0x12], 0
cmp byte [ebp - 0x11], 0
mov ecx, 0x43d6e0
je 0x100197c5
mov edx, str.E9_1B_C2_12_01
call fcn.1000e2b0
test al, al
jne 0x100197d7
xor ecx, ecx
call fcn.10012990
test al, al
mov edx, str.FLA_is_NOT_loaded.
mov ecx, str.FLA_is_loaded.
cmove ecx, edx
push ecx
push str.Count_of_killable_model_IDs_was_not_increased.__s_n
call fcn.10015060
add esp, 8
sub esp, 0x18
mov esi, esp
mov dword [esi], 0
push 0x20
mov ecx, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [ebp - 4], 0xffffffff
call fcn.1000caa0
mov dword [esi + 0x10], 0x16
mov edx, 0x1001cb90
mov dword [esi + 0x14], 0x1f
movups xmm0, xmmword [str.CEntity::SetModelIndex]
push 0
movups xmmword [eax], xmm0
mov ecx, dword [0x100879f0]
mov dword [eax + 0x10], ecx
movzx ecx, word [0x100879f4]
mov word [eax + 0x14], cx
mov ecx, 0x5e4890
mov byte [eax + 0x16], 0
mov dword [esi], eax
call fcn.1000eb10
add esp, 4
mov esi, esp
mov dword [esi], 0
push 0x20
mov ecx, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [ebp - 4], 0xffffffff
call fcn.1000caa0
mov dword [esi + 0x10], 0x16
mov edx, 0x1001cd30
mov dword [esi + 0x14], 0x1f
movups xmm0, xmmword [str.CEntity::UpdateRpHAnim]
push 0
movups xmmword [eax], xmm0
mov ecx, dword [0x10087a08]
mov dword [eax + 0x10], ecx
movzx ecx, word [0x10087a0c]
mov word [eax + 0x14], cx
mov ecx, 0x5e49ef
mov byte [eax + 0x16], 0
mov dword [esi], eax
call fcn.1000eb10
add esp, 4
mov esi, esp
mov dword [esi], 0
push 0x30
mov ecx, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [ebp - 4], 0xffffffff
call fcn.1000caa0
mov dword [esi + 0x10], 0x23
mov edx, eax
mov dword [esi + 0x14], 0x2f
movups xmm0, xmmword [str.CAEPedSpeechAudioEntity::Initialise]
push 0
movups xmmword [edx], xmm0
movups xmm0, xmmword [0x10087a20]
movups xmmword [edx + 0x10], xmm0
movzx ecx, word [0x10087a30]
mov word [edx + 0x20], cx
mov ecx, 0x5ddbb8
mov al, byte [0x10087a32]
mov byte [edx + 0x22], al
mov byte [edx + 0x23], 0
mov dword [esi], edx
mov edx, 0x1001cda0
call fcn.1000eb10
add esp, 4
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x23
push str.CAEPedSpeechAudioEntity::Initialise
mov dword [ebp - 4], 0xffffffff
call fcn.1000c850
push 0
mov edx, 0x1001d020
mov ecx, 0x5ddd24
call fcn.1000eb10
add esp, 4
mov ecx, esp
mov dword [ecx], 0
push 0x23
push str.CAEPedSpeechAudioEntity::Initialise
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov dword [ebp - 4], 0xffffffff
call fcn.1000c850
push 0
mov edx, 0x1001d2a0
mov ecx, 0x5de388
call fcn.1000eb10
add esp, 4
mov ecx, esp
mov dword [ecx], 0
push 0x14
push str.CPhysical::CPhysical
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov dword [ebp - 4], 0xffffffff
call fcn.1000c850
push 0
mov edx, 0x1001d520
mov ecx, 0x5e8052
call fcn.1000eb10
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov edx, str.8B_4C_24_04_56
call fcn.1000e2b0
test al, al
je 0x10019583
cmp byte [ebp - 0x12], 0
je 0x10019583
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10097750]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100bfe14]
mov dword [ebp - 0x18], ecx
cmp eax, dword [ecx + 4]
jle 0x10019830
push 0x100bfe14
call fcn.10053309
add esp, 4
cmp dword [0x100bfe14], 0xffffffff
jne 0x10019830
push 0x10078ee0
call fcn.1005374a
add esp, 4
push 0x100bfe14
call fcn.100532bf
add esp, 4
push 1
call fcn.100533df
mov ecx, dword [0x100bfd64]
add esp, 4
mov dword [0x100bfd64], eax
test ecx, ecx
je 0x10019854
push 1
push ecx
call fcn.10053414
add esp, 8
mov edi, dword [0x100bfd50]
test edi, edi
jne 0x10019879
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x43de74
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000b390
mov edi, dword [eax]
mov dword [0x100bfd50], edi
mov esi, dword [0x100bfd68]
test esi, esi
jne 0x1001989e
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 0x43de6c
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000b390
mov esi, dword [eax]
mov dword [0x100bfd68], esi
push ecx
mov eax, esp
push ecx
mov dword [eax], edi
mov eax, esp
mov dword [eax], esi
call fcn.100154b0
add esp, 4
mov eax, esp
push ecx
mov dword [eax], 0x1001f4e0
lea ecx, [ebp - 0x1c]
mov eax, esp
mov dword [eax], esi
call fcn.1000e200
mov ecx, dword [ebp - 0x18]
add esp, 8
mov eax, dword [0x100bfe10]
cmp eax, dword [ecx + 4]
jle 0x10019908
push 0x100bfe10
call fcn.10053309
add esp, 4
cmp dword [0x100bfe10], 0xffffffff
jne 0x10019908
push 0x10078ec0
call fcn.1005374a
add esp, 4
push 0x100bfe10
call fcn.100532bf
add esp, 4
push 1
call fcn.100533df
mov ecx, dword [0x100bfd8c]
add esp, 4
mov dword [0x100bfd8c], eax
test ecx, ecx
je 0x1001992c
push 1
push ecx
call fcn.10053414
add esp, 8
mov edi, dword [0x100bfd84]
test edi, edi
jne 0x10019951
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 0x43df63
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000b390
mov edi, dword [eax]
mov dword [0x100bfd84], edi
mov esi, dword [0x100bfd70]
test esi, esi
jne 0x10019976
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x43df5b
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000b390
mov esi, dword [eax]
mov dword [0x100bfd70], esi
push ecx
mov eax, esp
push ecx
mov dword [eax], edi
mov eax, esp
mov dword [eax], esi
call fcn.100154b0
add esp, 4
mov eax, esp
push ecx
mov dword [eax], 0x1001f4e0
lea ecx, [ebp - 0x1c]
mov eax, esp
mov dword [eax], esi
call fcn.1000e200
mov eax, dword [ebp - 0x18]
add esp, 8
cmp byte [ebp - 0x11], 0
mov eax, dword [eax + 4]
je 0x10019b50
cmp dword [0x100bfe18], eax
jle 0x100199eb
push 0x100bfe18
call fcn.10053309
add esp, 4
cmp dword [0x100bfe18], 0xffffffff
jne 0x100199eb
push 0x10078ea0
call fcn.1005374a
add esp, 4
push 0x100bfe18
call fcn.100532bf
add esp, 4
push 1
call fcn.100533df
mov ecx, dword [0x100bfd58]
add esp, 4
mov dword [0x100bfd58], eax
test ecx, ecx
je 0x10019a0f
push 1
push ecx
call fcn.10053414
add esp, 8
mov edi, dword [0x100bfd78]
test edi, edi
jne 0x10019a34
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 0x156163b
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000b390
mov edi, dword [eax]
mov dword [0x100bfd78], edi
mov esi, dword [0x100bfd54]
test esi, esi
jne 0x10019a59
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x1561634
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000b390
mov esi, dword [eax]
mov dword [0x100bfd54], esi
push ecx
mov eax, esp
push ecx
mov dword [eax], edi
mov eax, esp
mov dword [eax], esi
call fcn.100154b0
add esp, 4
mov eax, esp
push ecx
mov dword [eax], 0x1001f510
lea ecx, [ebp - 0x1c]
mov eax, esp
mov dword [eax], esi
call fcn.1000e200
mov ecx, dword [ebp - 0x18]
add esp, 8
mov eax, dword [0x100bfe24]
cmp eax, dword [ecx + 4]
jle 0x10019ac3
push 0x100bfe24
call fcn.10053309
add esp, 4
cmp dword [0x100bfe24], 0xffffffff
jne 0x10019ac3
push 0x10078e80
call fcn.1005374a
add esp, 4
push 0x100bfe24
call fcn.100532bf
add esp, 4
push 1
call fcn.100533df
mov ecx, dword [0x100bfd80]
add esp, 4
mov dword [0x100bfd80], eax
test ecx, ecx
je 0x10019ae7
push 1
push ecx
call fcn.10053414
add esp, 8
mov edi, dword [0x100bfd74]
test edi, edi
jne 0x10019b0c
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 0x1564c33
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000b390
mov edi, dword [eax]
mov dword [0x100bfd74], edi
mov esi, dword [0x100bfd4c]
test esi, esi
jne 0x10019b31
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x1564c2b
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000b390
mov esi, dword [eax]
mov dword [0x100bfd4c], esi
push ecx
mov eax, esp
push ecx
mov dword [eax], edi
mov eax, esp
mov dword [eax], esi
call fcn.100154b0
add esp, 4
mov eax, esp
mov dword [eax], 0x1001f530
jmp 0x10019ce8
cmp dword [0x100bfe1c], eax
jle 0x10019b88
push 0x100bfe1c
call fcn.10053309
add esp, 4
cmp dword [0x100bfe1c], 0xffffffff
jne 0x10019b88
push 0x10078e60
call fcn.1005374a
add esp, 4
push 0x100bfe1c
call fcn.100532bf
add esp, 4
push 1
call fcn.100533df
mov ecx, dword [0x100bfd5c]
add esp, 4
mov dword [0x100bfd5c], eax
test ecx, ecx
je 0x10019bac
push 1
push ecx
call fcn.10053414
add esp, 8
mov edi, dword [0x100bfd90]
test edi, edi
jne 0x10019bd1
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 0x43d6ab
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000b390
mov edi, dword [eax]
mov dword [0x100bfd90], edi
mov esi, dword [0x100bfd9c]
test esi, esi
jne 0x10019bf6
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x43d6a4
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000b390
mov esi, dword [eax]
mov dword [0x100bfd9c], esi
push ecx
mov eax, esp
push ecx
mov dword [eax], edi
mov eax, esp
mov dword [eax], esi
call fcn.100154b0
add esp, 4
mov eax, esp
push ecx
mov dword [eax], 0x1001f510
lea ecx, [ebp - 0x1c]
mov eax, esp
mov dword [eax], esi
call fcn.1000e200
mov ecx, dword [ebp - 0x18]
add esp, 8
mov eax, dword [0x100bfe20]
cmp eax, dword [ecx + 4]
jle 0x10019c60
push 0x100bfe20
call fcn.10053309
add esp, 4
cmp dword [0x100bfe20], 0xffffffff
jne 0x10019c60
push 0x10078e40
call fcn.1005374a
add esp, 4
push 0x100bfe20
call fcn.100532bf
add esp, 4
push 1
call fcn.100533df
mov ecx, dword [0x100bfd60]
add esp, 4
mov dword [0x100bfd60], eax
test ecx, ecx
je 0x10019c84
push 1
push ecx
call fcn.10053414
add esp, 8
mov edi, dword [0x100bfd88]
test edi, edi
jne 0x10019ca9
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 0x43d6d3
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000b390
mov edi, dword [eax]
mov dword [0x100bfd88], edi
mov esi, dword [0x100bfd6c]
test esi, esi
jne 0x10019cce
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x43d6cb
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000b390
mov esi, dword [eax]
mov dword [0x100bfd6c], esi
push ecx
mov eax, esp
push ecx
mov dword [eax], edi
mov eax, esp
mov dword [eax], esi
call fcn.100154b0
add esp, 4
mov eax, esp
mov dword [eax], 0x1001f530
push ecx
mov eax, esp
lea ecx, [ebp - 0x1c]
mov dword [eax], esi
call fcn.1000e200
add esp, 8
mov dword [ebp - 0x1c], 0x43d6e0
push ecx
mov eax, esp
push ecx
mov esi, esp
lea ecx, [ebp - 0x1c]
mov dword [eax], 0x100193b0
lea eax, [ebp - 0x24]
push eax
call fcn.1000b390
lea ecx, [ebp - 0x20]
mov eax, dword [eax]
mov dword [esi], eax
call fcn.1000e150
mov dword [0x100a1bc8], 0x4e20
jmp 0x100195a4