Function at 0x11028a40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp byte [0x110c6683], 0
push esi
push edi
je 0x11028a66
test byte [0x110c66ec], 1
je 0x11028a66
push 1
mov edx, 1
mov ecx, str.Checking_for_changed_skilldex_images.
call fcn.11011060
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x11028ae2
lea ecx, [esp + 8]
push ecx
push str.Lockpick
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11028ae2
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x11028aab
mov ecx, dword [ecx]
call fcn.11011f90
mov edi, eax
cmp edi, 0x125
je 0x11028ae2
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x518d54
call esi
lea eax, [esp + 8]
mov dword [0x518d54], edi
push eax
push dword [esp + 0xc]
push 4
push 0x518d54
call esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11028b58
lea ecx, [esp + 8]
push ecx
push str.Steal
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11028b58
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x11028b21
mov ecx, dword [ecx]
call fcn.11011f90
mov edi, eax
cmp edi, 0x125
je 0x11028b58
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x518d58
call esi
lea eax, [esp + 8]
mov dword [0x518d58], edi
push eax
push dword [esp + 0xc]
push 4
push 0x518d58
call esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11028bce
lea ecx, [esp + 8]
push ecx
push str.Traps
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11028bce
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x11028b97
mov ecx, dword [ecx]
call fcn.11011f90
mov edi, eax
cmp edi, 0x125
je 0x11028bce
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x518d5c
call esi
lea eax, [esp + 8]
mov dword [0x518d5c], edi
push eax
push dword [esp + 0xc]
push 4
push 0x518d5c
call esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11028c44
lea ecx, [esp + 8]
push ecx
push str.FirstAid
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11028c44
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x11028c0d
mov ecx, dword [ecx]
call fcn.11011f90
mov edi, eax
cmp edi, 0x125
je 0x11028c44
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x518d4c
call esi
lea eax, [esp + 8]
mov dword [0x518d4c], edi
push eax
push dword [esp + 0xc]
push 4
push 0x518d4c
call esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11028cba
lea ecx, [esp + 8]
push ecx
push str.Doctor
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11028cba
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x11028c83
mov ecx, dword [ecx]
call fcn.11011f90
mov edi, eax
cmp edi, 0x125
je 0x11028cba
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x518d50
call esi
lea eax, [esp + 8]
mov dword [0x518d50], edi
push eax
push dword [esp + 0xc]
push 4
push 0x518d50
call esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11028d30
lea ecx, [esp + 8]
push ecx
push str.Science
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11028d30
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x11028cf9
mov ecx, dword [ecx]
call fcn.11011f90
mov edi, eax
cmp edi, 0x125
je 0x11028d30
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x518d60
call esi
lea eax, [esp + 8]
mov dword [0x518d60], edi
push eax
push dword [esp + 0xc]
push 4
push 0x518d60
call esi
call fcn.1100a210
add eax, 4
push eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11028da6
lea ecx, [esp + 8]
push ecx
push str.Repair
push str.Misc
mov ecx, eax
call fcn.11003200
test al, al
je 0x11028da6
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x11028d6f
mov ecx, dword [ecx]
call fcn.11011f90
mov edi, eax
cmp edi, 0x125
je 0x11028da6
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x518d64
call esi
lea eax, [esp + 8]
mov dword [0x518d64], edi
push eax
push dword [esp + 0xc]
push 4
push 0x518d64
call esi
pop edi
pop esi
pop ecx
ret