Function at 0x10041630
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005cdb5
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x10071040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x10076f62], 0
je 0x10041a5a
push 0xf
xor edx, edx
mov ecx, str.Weapon
call fcn.1000c400
mov eax, dword [0x10076fbc]
add esp, 4
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
push dword [ebp - 0x24]
mov eax, dword [eax + 0x34]
push dword [ebp - 0x28]
push dword [0x10076ea4]
mov eax, dword [eax + 0x10]
mov dword [0x10076eb4], eax
mov al, byte [0x10076f46]
push eax
push ecx
mov ecx, str.SHOW_WEAPON
call fcn.10056ea0
add esp, 0x14
test al, al
je 0x1004170b
cmp byte [0x10076f46], 0
mov edi, dword [0x10077038]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
sete al
mov byte [ebp - 0x19], al
add edi, 0x68
mov byte [0x10076f46], al
lea eax, [ebp - 0x18]
push eax
push 0x40
push 1
push edi
call esi
mov al, byte [ebp - 0x19]
mov byte [edi], al
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 1
push edi
call esi
mov al, byte [0x10076f53]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push dword [ebp - 0x28]
push dword [0x10076ea4]
push eax
push ecx
mov ecx, str.INFINITE_AMMO
call fcn.10056ea0
add esp, 0x14
test al, al
je 0x10041762
cmp byte [0x10076f53], 0
sete al
mov byte [0x10076f53], al
mov byte [ebp - 0x18], al
mov eax, dword [0x10076fc8]
add eax, 0x3a9d20
mov dword [ebp - 0x20], eax
push dword [ebp - 0x18]
call dword [ebp - 0x20]
mov al, byte [0x10076f42]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push dword [ebp - 0x28]
push dword [0x10076ea4]
push eax
push ecx
mov ecx, str.NPC_AIMING
call fcn.10056ea0
add esp, 0x14
test al, al
je 0x100417b4
cmp byte [0x10076f42], 0
sete al
mov byte [0x10076f42], al
movzx ecx, al
mov eax, dword [0x1007701c]
xor ecx, 1
mov dword [eax + 0x3a9], ecx
push ecx
mov edx, 0x10077084
mov ecx, str.KILL_ENEMIES
call fcn.10057cf0
add esp, 4
test al, al
je 0x100417db
mov eax, dword [0x10076fc8]
add eax, 0x3acea0
mov dword [ebp - 0x20], eax
call dword [ebp - 0x20]
push ecx
mov edx, 0x10077084
mov ecx, str.SET_WEAPON
call fcn.10057cf0
add esp, 4
test al, al
je 0x100418a6
mov eax, dword [0x10076fbc]
lea ecx, [ebp - 0x28]
mov esi, dword [0x10076fc4]
push ecx
mov dword [ebp - 0x24], 0
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [0x10076f30]
shl eax, 2
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
push eax
push ecx
lea ecx, [ebp - 0x38]
call fcn.100457e0
mov edi, dword [ebp - 0x34]
xor ecx, ecx
mov edx, dword [ebp - 0x38]
sub edi, edx
sar edi, 2
test edi, edi
je 0x1004184c
nop
mov eax, dword [edx + ecx*4]
inc ecx
add eax, dword [esi]
mov esi, eax
cmp ecx, edi
jb 0x10041840
test edx, edx
je 0x10041889
mov eax, dword [ebp - 0x30]
sub eax, edx
sar eax, 2
lea ecx, [eax*4]
mov eax, edx
cmp ecx, 0x1000
jb 0x1004187f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1004187f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1005b378
add esp, 8
add dword [ebp - 0x20], 0xcd0
mov dword [ebp - 0x18], esi
mov byte [ebp - 0x19], 1
mov dl, byte [ebp - 0x19]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call dword [0x10076ff0]
movss xmm1, dword [0x1006a784]
xorps xmm0, xmm0
call fcn.10010190
mov edi, dword [0x10076f30]
lea ecx, [ebp - 0x38]
push 0x100770ec
call fcn.100455f0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
cmp esi, ecx
je 0x10041902
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x10041902
lea eax, [edi + edi*2]
cmp dword [esi + eax*8 + 0x14], 0xf
lea edx, [esi + eax*8]
jbe 0x10041907
mov edx, dword [edx]
jmp 0x10041907
mov edx, 0x10066510
push 0x24
mov ecx, str.Weapons
call fcn.10029e50
add esp, 4
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.100458b0
cmp byte [ebp - 0x19], 0
je 0x1004194f
sub esp, 0xc
mov ecx, esp
push 0x100770ec
call fcn.100455f0
mov ecx, 0x10076f30
call fcn.10056dc0
add esp, 0xc
call fcn.10011290
push ecx
mov edx, 0x10077084
mov ecx, str.EXPLOSION
call fcn.10057cf0
add esp, 4
test al, al
je 0x100419ac
mov eax, dword [0x10076fc0]
mov dword [ebp - 0x18], 0
mov ecx, dword [eax + 0x24]
mov eax, dword [0x10076f14]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x10076eb4]
add eax, 0x1d0
mov dword [ebp - 0x20], eax
mov eax, dword [0x10076fd8]
add eax, 0x3fbef0
mov dword [ebp - 0x24], eax
mov esi, dword [0x10077020]
mov edi, dword [ebp - 0x20]
push dword [ebp - 0x18]
push dword [ebp - 0x3c]
call dword [ebp - 0x24]
movss xmm1, dword [0x1006a784]
xorps xmm0, xmm0
call fcn.10010190
mov esi, dword [0x10076f14]
lea ecx, [ebp - 0x50]
push 0x100770f8
call fcn.100455f0
mov dword [ebp - 4], 1
mov edi, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
cmp edi, ecx
je 0x10041a08
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jae 0x10041a08
lea eax, [esi + esi*2]
cmp dword [edi + eax*8 + 0x14], 0xf
lea edx, [edi + eax*8]
jbe 0x10041a0d
mov edx, dword [edx]
jmp 0x10041a0d
mov edx, 0x10066510
push 0x24
mov ecx, str.Explosions
call fcn.10029e50
add esp, 4
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.100458b0
cmp byte [ebp - 0x19], 0
je 0x10041a55
sub esp, 0xc
mov ecx, esp
push 0x100770f8
call fcn.100455f0
mov ecx, 0x10076f14
call fcn.10056dc0
add esp, 0xc
call fcn.10011290
call fcn.1000ed00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005ae5b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret