Function at 0x10040e80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005cd75
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x10071040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x10076f63], 0
je 0x1004160b
push 0xf
xor edx, edx
mov ecx, str.Player
call fcn.1000c400
mov eax, dword [0x10076fbc]
mov edx, 0x10077084
mov ecx, str.HEALTH
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 0x10]
mov dword [0x10076eb4], eax
call fcn.10057cf0
add esp, 4
test al, al
je 0x10040f14
mov eax, dword [0x10076eb4]
movss xmm0, dword [0x10076134]
movss dword [eax + 0x9e0], xmm0
movss xmm1, dword [0x1006a784]
xorps xmm0, xmm0
call fcn.10010190
push 0
push 0
sub esp, 8
mov edx, 8
mov ecx, 0x10069720
push 0x10076134
call fcn.1002bb40
mov eax, dword [0x10076eb4]
add esp, 0x14
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
push dword [ebp - 0x20]
mov al, byte [eax + 0x6e4]
push dword [ebp - 0x24]
shr al, 3
push dword [0x10076ea4]
and al, 1
push eax
push ecx
mov ecx, str.INVISIBILITY
call fcn.10056ea0
mov edx, dword [0x10076eb4]
add esp, 0x14
test al, al
je 0x10040fa1
mov cl, byte [edx + 0x6e4]
mov al, cl
shr al, 3
not al
shl al, 3
xor al, cl
and al, 8
xor al, cl
mov byte [edx + 0x6e4], al
mov eax, dword [edx + 0xc8]
mov dword [ebp - 0x20], 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
mov al, byte [eax + 0x1d9]
push dword [0x10076ea4]
push eax
push ecx
mov ecx, str.GOD_MODE
call fcn.10056ea0
add esp, 0x14
test al, al
je 0x10040ff5
mov eax, dword [0x10076eb4]
mov ecx, dword [eax + 0xc8]
cmp byte [ecx + 0x1d9], 0
sete al
mov byte [ecx + 0x1d9], al
mov al, byte [0x10076f4d]
mov dword [ebp - 0x20], 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
push dword [0x10076ea4]
push eax
push ecx
mov ecx, str.NOCLIP
call fcn.10056ea0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x14
test al, al
je 0x100410f7
mov eax, dword [0x10076fbc]
cmp byte [0x10076f4d], 0
sete ch
mov eax, dword [eax + 0x34]
mov byte [0x10076f4d], ch
mov edx, dword [eax + 0x10]
mov al, ch
shl al, 4
mov cl, byte [edx + 0x1d73]
and cl, 0xef
or cl, al
mov byte [edx + 0x1d73], cl
test ch, ch
je 0x1004108b
mov esi, dword [0x10077014]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 2
push esi
call edi
mov eax, 0x9eb
mov word [esi], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 2
push esi
call edi
cmp byte [0x10076f4d], 0
mov eax, dword [0x10076fbc]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0xc8]
jne 0x100410d7
cmp byte [0x10076f54], 0
setne cl
mov byte [eax + 0x1d9], cl
mov eax, dword [0x10076fbc]
mov eax, dword [eax + 0x6c]
mov eax, dword [eax + 0xc8]
mov byte [eax + 0x32], 0
mov byte [0x10076f4c], 1
mov byte [0x10076f4b], 1
jmp 0x100410f7
mov byte [eax + 0x1d9], 1
mov eax, dword [0x10076fbc]
mov eax, dword [eax + 0x6c]
mov eax, dword [eax + 0xc8]
mov byte [eax + 0x32], 1
mov byte [0x10076f4c], 0
mov eax, dword [0x10076eb4]
mov dword [ebp - 0x20], 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
mov al, byte [eax + 0x1d72]
push dword [0x10076ea4]
shr al, 7
push eax
push ecx
mov ecx, str.COLLISION
call fcn.10056ea0
add esp, 0x14
test al, al
je 0x1004114f
mov edx, dword [0x10076eb4]
mov cl, byte [edx + 0x1d72]
mov al, cl
and cl, 0x7f
not al
and al, 0x80
or al, cl
mov byte [edx + 0x1d72], al
mov al, byte [0x10076f51]
mov dword [ebp - 0x20], 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
push dword [0x10076ea4]
push eax
push ecx
mov ecx, str.FLASHLIGHT
call fcn.10056ea0
add esp, 0x14
test al, al
je 0x100411bb
cmp byte [0x10076f51], 0
mov esi, dword [0x10076fc8]
sete al
add esi, 0xff0a68
mov byte [ebp - 0x19], al
mov byte [0x10076f51], al
lea eax, [ebp - 0x18]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [ebp - 0x19]
mov byte [esi], al
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 1
push esi
call edi
mov al, byte [0x10076f52]
mov dword [ebp - 0x20], 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
push dword [0x10076ea4]
push eax
push ecx
mov ecx, str.HIDE_HAT
call fcn.10056ea0
add esp, 0x14
test al, al
je 0x100412a5
cmp byte [0x10076f52], 0
lea edx, [ebp - 0x40]
mov ecx, dword [0x10076fc8]
sete al
mov dword [ebp - 0x40], 0x10
mov byte [0x10076f52], al
xor al, 1
mov byte [ebp - 0x18], al
lea eax, [ecx + 0x144640]
mov dword [ebp - 0x3c], 0
push ecx
mov dword [ebp - 0x20], eax
lea esi, [ecx + 0x1126508]
lea eax, [ebp - 0x38]
push eax
push edx
lea ecx, [ebp - 0x38]
call fcn.100457e0
mov edi, dword [ebp - 0x34]
xor ecx, ecx
mov edx, dword [ebp - 0x38]
sub edi, edx
sar edi, 2
test edi, edi
je 0x1004125c
nop word [eax + eax]
mov eax, dword [edx + ecx*4]
inc ecx
add eax, dword [esi]
mov esi, eax
cmp ecx, edi
jb 0x10041250
test edx, edx
je 0x10041299
mov eax, dword [ebp - 0x30]
sub eax, edx
sar eax, 2
lea ecx, [eax*4]
mov eax, edx
cmp ecx, 0x1000
jb 0x1004128f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1004128f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1005b378
add esp, 8
mov dword [ebp - 0x3c], esi
push dword [ebp - 0x18]
push dword [ebp - 0x3c]
call dword [ebp - 0x20]
push ecx
mov edx, 0x10077084
mov ecx, str.SET_HAT
call fcn.10057cf0
add esp, 4
test al, al
je 0x100412c1
call fcn.1004c520
movss xmm1, dword [0x1006a784]
xorps xmm0, xmm0
call fcn.10010190
mov edi, dword [0x10076f3c]
lea ecx, [ebp - 0x38]
push 0x100770a4
call fcn.100455f0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
cmp esi, ecx
je 0x1004131d
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x1004131d
lea eax, [edi + edi*2]
cmp dword [esi + eax*8 + 0x14], 0xf
lea edx, [esi + eax*8]
jbe 0x10041322
mov edx, dword [edx]
jmp 0x10041322
mov edx, 0x10066510
push 0x24
mov ecx, str.Hats
call fcn.10029e50
add esp, 4
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.100458b0
cmp byte [ebp - 0x19], 0
je 0x1004136a
sub esp, 0xc
mov ecx, esp
push 0x100770a4
call fcn.100455f0
mov ecx, 0x10076f3c
call fcn.10056dc0
add esp, 0xc
call fcn.10011290
push ecx
mov edx, 0x10077084
mov ecx, str.SET_HEAD
call fcn.10057cf0
add esp, 4
test al, al
je 0x10041386
call fcn.1004d030
movss xmm1, dword [0x1006a784]
xorps xmm0, xmm0
call fcn.10010190
mov edi, dword [0x10076f38]
lea ecx, [ebp - 0x38]
push 0x100770b0
call fcn.100455f0
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
cmp esi, ecx
je 0x100413e2
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x100413e2
lea eax, [edi + edi*2]
cmp dword [esi + eax*8 + 0x14], 0xf
lea edx, [esi + eax*8]
jbe 0x100413e7
mov edx, dword [edx]
jmp 0x100413e7
mov edx, 0x10066510
push 0x24
mov ecx, str.Heads
call fcn.10029e50
add esp, 4
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.100458b0
cmp byte [ebp - 0x19], 0
je 0x1004142f
sub esp, 0xc
mov ecx, esp
push 0x100770b0
call fcn.100455f0
mov ecx, 0x10076f38
call fcn.10056dc0
add esp, 0xc
call fcn.10011290
push ecx
mov edx, 0x10077084
mov ecx, str.SET_OUTFIT
call fcn.10057cf0
add esp, 4
test al, al
je 0x1004144b
call fcn.1004c8e0
movss xmm1, dword [0x1006a784]
xorps xmm0, xmm0
call fcn.10010190
mov edi, dword [0x10076f34]
lea ecx, [ebp - 0x38]
push 0x100770bc
call fcn.100455f0
mov dword [ebp - 4], 2
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
cmp esi, ecx
je 0x100414a7
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x100414a7
lea eax, [edi + edi*2]
cmp dword [esi + eax*8 + 0x14], 0xf
lea edx, [esi + eax*8]
jbe 0x100414ac
mov edx, dword [edx]
jmp 0x100414ac
mov edx, 0x10066510
push 0x24
mov ecx, str.Outfits
call fcn.10029e50
add esp, 4
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.100458b0
cmp byte [ebp - 0x19], 0
je 0x100414f4
sub esp, 0xc
mov ecx, esp
push 0x100770bc
call fcn.100455f0
mov ecx, 0x10076f34
call fcn.10056dc0
add esp, 0xc
call fcn.10011290
push ecx
mov edx, 0x10077084
mov ecx, str.SET_SKELETON
call fcn.10057cf0
add esp, 4
test al, al
je 0x10041521
mov eax, dword [0x10076fbc]
mov dl, byte [0x10076f28]
mov ecx, dword [eax + 0x34]
mov ecx, dword [ecx + 0x10]
call fcn.1004dc70
movss xmm1, dword [0x1006a784]
xorps xmm0, xmm0
call fcn.10010190
mov esi, dword [0x10076f28]
lea ecx, [ebp - 0x50]
push 0x10077128
call fcn.100455f0
mov dword [ebp - 4], 3
mov edi, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
cmp edi, ecx
je 0x1004157d
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jae 0x1004157d
lea eax, [esi + esi*2]
cmp dword [edi + eax*8 + 0x14], 0xf
lea edx, [edi + eax*8]
jbe 0x10041582
mov edx, dword [edx]
jmp 0x10041582
mov edx, 0x10066510
push 0x24
mov ecx, str.Skeletons
call fcn.10029e50
add esp, 4
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.100458b0
cmp byte [ebp - 0x19], 0
je 0x100415ca
sub esp, 0xc
mov ecx, esp
push 0x10077128
call fcn.100455f0
mov ecx, 0x10076f28
call fcn.10056dc0
add esp, 0xc
call fcn.10011290
push ecx
mov edx, 0x10077084
mov ecx, str.ATTACHMENTS
call fcn.10057cf0
add esp, 4
test al, al
je 0x10041606
mov eax, dword [0x10076fc8]
add eax, 0x3b7c50
mov byte [0x10076f59], 1
mov byte [0x10076f5b], 1
mov byte [ebp - 0x20], 1
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x20]
call dword [ebp - 0x3c]
call fcn.1000ed00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005ae5b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret