Function at 0x1003b090
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x10067740
push 0x968180
push 0xe9
call fcn.100b1680
push 0x100077f0
push 0x4fcb58
push 0xe9
mov dword [0x102fba44], 0
mov dword [0x102fba48], 0
mov dword [0x102fba4c], 0
mov dword [0x102fba54], 0
mov dword [0x102fba50], 0
call fcn.100b1680
push 0x10007810
push 0x4fd0b9
push 0xe9
call fcn.100b1680
push 0x1003b040
push 0x8350e9
push 0xe8
mov dword [0x10304728], 0
mov dword [0x1030472c], 0
mov byte [0x10304730], 0
call fcn.100b1680
add esp, 0x30
cmp dword [0x101ee968], 1
jne 0x1003b174
push 0x100099b0
push 0x5bafab
push 0xe8
call fcn.100b1680
push 0x10009910
push 0x7c5db0
push 0xe8
call fcn.100b1680
add esp, 0x18
cmp dword [0x101ee964], 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x1003b1aa
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x81c03fa
call edi
lea eax, [ebp - 8]
mov byte [0x81c03fa], 1
push eax
push dword [ebp - 8]
push 1
push 0x81c03fa
call edi
mov dword [0x103297e8], 0x42f6e9df
mov eax, 0x51eb851f
imul dword [0xe61e58]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
movd xmm0, eax
mov eax, 0x1b4e81b5
cvtdq2ps xmm0, xmm0
movss dword [0x103297ec], xmm0
imul dword [0xe61e5c]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [0x101ee978], 1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [0x103297f0], xmm0
jne 0x1003b20a
call fcn.1002e0e0
mov eax, dword [0x101ee980]
cmp eax, 1
jne 0x1003b21e
call fcn.10045f10
mov eax, dword [0x101ee980]
cmp eax, 2
jne 0x1003b228
call fcn.1000bcc0
mov eax, dword [0x101ee98c]
sub eax, 1
je 0x1003b23e
sub eax, 1
jne 0x1003b243
call fcn.100bdc60
jmp 0x1003b243
call fcn.100300d0
mov eax, dword [0x101ee9bc]
push esi
sub eax, 1
je 0x1003b2f3
sub eax, 1
je 0x1003b26a
sub eax, 2
jne 0x1003b360
call fcn.10035250
jmp 0x1003b360
push 0x10062d50
push 0x4d7eb1
push 0xe8
call fcn.100b1680
push 0x10062b60
push 0x4d76fb
push 0xe8
call fcn.100b1680
push 0x10062b60
push 0x4d79c3
push 0xe8
call fcn.100b1680
mov esi, dword [0x101ee9c0]
lea eax, [ebp - 8]
add esp, 0x24
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4d75f0
call edi
test eax, eax
je 0x1003b2eb
mov eax, 0x4d75f0
mov dword [eax], esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 4
push 0x4d75f0
call edi
test eax, eax
jne 0x1003b360
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1003b360
push 0x100158d0
push 0x4d76fb
push 0xe8
call fcn.100b1680
push 0x100158d0
push 0x4d79c3
push 0xe8
call fcn.100b1680
mov esi, dword [0x101ee9c0]
lea eax, [ebp - 8]
add esp, 0x18
push eax
push 0x40
push 4
push 0x4d75f0
call edi
lea eax, [ebp - 8]
mov dword [0x4d75f0], esi
push eax
push dword [ebp - 8]
push 4
push 0x4d75f0
call edi
push 0x100159b0
push 0x5edda9
push 0xe8
call fcn.100b1680
add esp, 0xc
mov eax, dword [0x101ee9c4]
pop esi
sub eax, 1
je 0x1003b388
sub eax, 1
je 0x1003b381
sub eax, 2
jne 0x1003b38d
call fcn.10035250
call fcn.100365e0
jmp 0x1003b38d
call fcn.10062700
jmp 0x1003b38d
call fcn.10015e40
mov eax, dword [0x101ee994]
cmp eax, 1
jne 0x1003b3a1
call fcn.1002eac0
mov eax, dword [0x101ee994]
cmp eax, 2
jne 0x1003b3ab
call fcn.10027eb0
cmp dword [0x101ee9dc], 2
jne 0x1003b3df
push 0x100bfa60
push 0x7e020c
push 0xe8
call fcn.100b1680
push 0x100bfa60
push 0x7e0298
push 0xe8
call fcn.100b1680
add esp, 0x18
call fcn.100313d0
call fcn.100bda10
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x556cc6
call edi
mov eax, 0x556cc6
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push 0x556cc6
call edi
push 0x100a78b0
push 0x556cc6
push 0xe9
call fcn.100b1680
add esp, 0xc
mov ecx, 0x101ee4dc
push str.Data__KGData__Lua__CharacterSystem__SkillCroma.lua
call fcn.100a4330
push dword [0x101ee4e0]
call fcn.1008c960
call fcn.100a5300
cmp byte [0x101eea70], 1
pop edi
jne 0x1003b483
push 0x100a2af0
push 0x842ac7
push 0xe8
call fcn.100b1680
push 0x100a2af0
push 0x842b8d
push 0xe8
call fcn.100b1680
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d52b0
mov esp, ebp
pop ebp
ret