Function at 0x100325a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10127f95
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
mov eax, dword [0x10149040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [0x10316184]
call fcn.10044cf0
mov ecx, dword [0x10316184]
call fcn.1005ad20
push dword [0x10316184]
call fcn.1004cdc0
push 2
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
push 0x1013a208
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
call fcn.10008710
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
push dword [0x10316184]
lea ecx, [ebp - 0x4c]
call fcn.10008f70
sub esp, 8
mov byte [ebp - 4], 1
mov ecx, eax
call fcn.10033030
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x10032681
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10032677
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10032ee4
push ecx
push edx
call fcn.100811f1
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
cmp ecx, 0xf
jbe 0x100326ce
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100326c4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10032ee4
push ecx
push edx
call fcn.100811f1
add esp, 8
push 2
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
push 0x1013a208
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
call fcn.10008710
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 2
push eax
push dword [0x10316184]
lea ecx, [ebp - 0x4c]
call fcn.10008f70
push 0x10030a00
push str.SetEffectHelper
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.10025950
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x10032758
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003274e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10032ee9
push ecx
push edx
call fcn.100811f1
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
cmp ecx, 0xf
jbe 0x100327a5
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003279b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10032ee9
push ecx
push edx
call fcn.100811f1
add esp, 8
push 2
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
push 0x1013a208
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
call fcn.10008710
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 4
push eax
push dword [0x10316184]
lea ecx, [ebp - 0x4c]
call fcn.10008f70
push 0x10030a00
push str.SetEffectHelperMiniature
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.10025950
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x1003282f
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10032825
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10032eee
push ecx
push edx
call fcn.100811f1
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
cmp ecx, 0xf
jbe 0x1003287c
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10032872
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10032eee
push ecx
push edx
call fcn.100811f1
add esp, 8
push 2
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
push 0x1013a208
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
call fcn.10008710
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 6
push eax
push dword [0x10316184]
lea ecx, [ebp - 0x4c]
call fcn.10008f70
push 0x10030b90
push str.CheckModelById
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.1000bd90
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x10032906
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100328fc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10032ef3
push ecx
push edx
call fcn.100811f1
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
cmp ecx, 0xf
jbe 0x10032953
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10032949
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10032ef3
push ecx
push edx
call fcn.100811f1
add esp, 8
push str.Data__Files__Lua__CharacterSystem__CharacterHelper.lua
mov ecx, 0x10316180
call fcn.10043810
push 0x1013a378
push str.LoadHelpers
push 0x10316180
call fcn.100439d0
add esp, 0xc
push 0x1002fd00
push 0x4d7348
push 0xe8
call fcn.1007e2f0
add esp, 0xc
push 0x1002fd00
push 0x4d7a98
push 0xe8
call fcn.1007e2f0
add esp, 0xc
push 0x1002fd00
push 0x4d9a65
push 0xe8
call fcn.1007e2f0
add esp, 0xc
push 0x1002fe60
push 0x4d6ea5
push 0xe8
call fcn.1007e2f0
add esp, 0xc
push 0x1002fe60
push 0x4d7787
push 0xe8
call fcn.1007e2f0
add esp, 0xc
push 0x1002fe60
push 0x4d9568
push 0xe8
call fcn.1007e2f0
add esp, 0xc
mov byte [0x103161ae], 0
push 0x10030f20
push 0x8363d9
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031080
push 0x835e80
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x100310e0
push 0x7dfe51
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031170
push 0x4d72eb
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x100311c0
push 0x534c65
push 0xe8
call fcn.1007e2f0
add esp, 0xc
push 0x10031300
push 0x54eac8
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x100313b0
push 0x54ed55
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031400
push 0x54ec8f
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031450
push 0x54ed43
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x100314a0
push 0x54f8ea
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x100314f0
push 0x54fc7d
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031540
push 0x550706
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031590
push 0x54fe28
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031600
push 0x54fcd8
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031650
push 0x5506c2
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x100316a0
push 0x5a383a
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031740
push 0x5517a4
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x100317a0
push 0x551916
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x100317f0
push 0x551b3f
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031860
push 0x551b09
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031970
push 0x55273e
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x100319e0
push 0x552995
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031a30
push 0x5528de
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031ab0
push 0x552777
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031b00
push 0x564c9c
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031b60
push 0x564ba2
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031bb0
push 0x564c1c
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031c00
push 0x564e6e
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031c50
push 0x56f688
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031cc0
push 0x57e108
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031d10
push 0x5b53ff
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031db0
push 0x59b656
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031e50
push 0x5a3817
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031ef0
push 0x63edc8
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031f40
push 0x640a89
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10031f90
push 0x640dcf
push 0xe9
call fcn.1007e2f0
add esp, 0xc
cmp byte [0x10158225], 0
jne 0x10032d7d
push 0x10031ff0
push 0x813f5a
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10032090
push 0x5b5411
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10032130
push 0x54fd0e
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x100321e0
push 0x644520
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x100322b0
push 0x648daf
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10032300
push 0x648dd3
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x100323a0
push 0x5ae1e0
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x100323f0
push 0x5ae201
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x10032490
push 0x54ed07
push 0xe9
call fcn.1007e2f0
add esp, 0xc
push 0x100324b0
push 0x5af273
push 0xe9
call fcn.1007e2f0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
add esp, 0xc
push eax
push 0x40
push 6
push 0x8140cf
call esi
mov eax, 0x8140cf
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 6
push 0x8140cf
call esi
push 0x10032500
push 0x8140cf
push 0xe9
call fcn.1007e2f0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push 0x40
push 6
push 0x59c7e5
call esi
mov eax, 0x59c7e5
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 6
push 0x59c7e5
call esi
push 0x10032550
push 0x59c7e5
push 0xe9
call fcn.1007e2f0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10080ec9
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100fb34d
call fcn.100fb34d
call fcn.100fb34d
call fcn.100fb34d
int3