Function at 0x1000e4a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov ecx, dword [0x102279f0]
push str.B__t_Chance_S___1_:_Fade_Out
mov dword [0x10227788], 1
call fcn.10007e90
ret
mov ecx, dword [0x102279f0]
xor eax, eax
push str.B__t_Chance_S___2_:_Fade_In
mov dword [0x1017d21c], eax
mov dword [0x10227780], eax
mov dword [0x10227784], eax
call fcn.10007e90
ret
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
push edi
mov edi, dword [0x10227c20]
lea ebx, [eax + 0x5f]
mov dword [0x1017d21c], eax
mov dword [0x10227780], eax
mov dword [0x10227784], eax
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push edi
lea ebp, [ebx + 0x3c]
call esi
mov eax, 0x1c7
mov ecx, edi
lea edx, [esp + 0x18]
push edx
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
push eax
push 4
push edi
call esi
mov edi, dword [0x10227c20]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
add edi, 4
push edi
call esi
mov eax, 0xff
lea edx, [esp + 0x18]
push edx
mov dword [edi], eax
mov eax, dword [esp + 0x18]
push eax
push 4
push edi
call esi
mov edi, dword [0x10227c20]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
add edi, 8
push edi
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
push 4
push edi
mov dword [edi], ebp
call esi
mov edi, dword [0x10227c20]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
add edi, 0xc
push edi
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
push 4
push edi
mov dword [edi], ebx
call esi
mov ecx, dword [0x102279f0]
push str.B__t_Chance_S___3_:_Chance_4_6
call fcn.10007e90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
push edi
mov edi, dword [0x10227c20]
lea ebx, [eax + 0x5a]
mov dword [0x1017d21c], eax
mov dword [0x10227780], eax
mov dword [0x10227784], eax
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push edi
lea ebp, [ebx + 0x3c]
call esi
mov eax, 0x1c2
mov ecx, edi
lea edx, [esp + 0x18]
push edx
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
push eax
push 4
push edi
call esi
mov edi, dword [0x10227c20]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
add edi, 4
push edi
call esi
mov eax, 0xfa
lea edx, [esp + 0x18]
push edx
mov dword [edi], eax
mov eax, dword [esp + 0x18]
push eax
push 4
push edi
call esi
mov edi, dword [0x10227c20]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
add edi, 8
push edi
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
push 4
push edi
mov dword [edi], ebp
call esi
mov edi, dword [0x10227c20]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
add edi, 0xc
push edi
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
push 4
push edi
mov dword [edi], ebx
call esi
mov ecx, dword [0x102279f0]
push str.B__t_Chance_S___4_:__a_o_Ng___c_Tr_n_D___i
call fcn.10007e90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
push edi
mov edi, dword [0x10227c20]
lea ebx, [eax + 0x5a]
mov dword [0x1017d21c], eax
mov dword [0x10227780], eax
mov dword [0x10227784], eax
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push edi
lea ebp, [ebx + 0x3c]
call esi
mov eax, 0x1c2
mov ecx, edi
lea edx, [esp + 0x18]
push edx
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
push eax
push 4
push edi
call esi
mov edi, dword [0x10227c20]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
add edi, 4
push edi
call esi
mov eax, 0xfa
lea edx, [esp + 0x18]
push edx
mov dword [edi], eax
mov eax, dword [esp + 0x18]
push eax
push 4
push edi
call esi
mov edi, dword [0x10227c20]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
add edi, 8
push edi
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
push 4
push edi
mov dword [edi], ebp
call esi
mov edi, dword [0x10227c20]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
add edi, 0xc
push edi
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
push 4
push edi
mov dword [edi], ebx
call esi
mov ecx, dword [0x102279f0]
push str.B__t_Chance_S___5_:__a_o_Ng___c_7_9_1_3
call fcn.10007e90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
push edi
mov edi, dword [0x10227c20]
lea ebx, [eax + 0x5f]
mov dword [0x1017d21c], eax
mov dword [0x10227780], eax
mov dword [0x10227784], eax
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push edi
lea ebp, [ebx + 0x3c]
call esi
mov eax, 0x1c7
mov ecx, edi
lea edx, [esp + 0x18]
push edx
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
push eax
push 4
push edi
call esi
mov edi, dword [0x10227c20]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
add edi, 4
push edi
call esi
mov eax, 0xff
lea edx, [esp + 0x18]
push edx
mov dword [edi], eax
mov eax, dword [esp + 0x18]
push eax
push 4
push edi
call esi
mov edi, dword [0x10227c20]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
add edi, 8
push edi
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
push 4
push edi
mov dword [edi], ebp
call esi
mov edi, dword [0x10227c20]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
add edi, 0xc
push edi
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
push 4
push edi
mov dword [edi], ebx
call esi
mov ecx, dword [0x102279f0]
push str.B__t_Chance_S___6_:_Multi_Speed
call fcn.10007e90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
push edi
mov edi, dword [0x10227c20]
lea ebx, [eax + 0x64]
mov dword [0x1017d21c], eax
mov dword [0x10227780], eax
mov dword [0x10227784], eax
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push edi
lea ebp, [ebx + 0x3c]
call esi
mov eax, 0x1cc
mov ecx, edi
lea edx, [esp + 0x18]
push edx
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
push eax
push 4
push edi
call esi
mov edi, dword [0x10227c20]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
add edi, 4
push edi
call esi
mov eax, 0x104
lea edx, [esp + 0x18]
push edx
mov dword [edi], eax
mov eax, dword [esp + 0x18]
push eax
push 4
push edi
call esi
mov edi, dword [0x10227c20]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
add edi, 8
push edi
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
push 4
push edi
mov dword [edi], ebp
call esi
mov edi, dword [0x10227c20]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
add edi, 0xc
push edi
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
push 4
push edi
mov dword [edi], ebx
call esi
mov ecx, dword [0x102279f0]
push str.B__t_Chance_S___7_:__a_o_Ng___c_Tr_n_D___i_Tra_i_Pha_i
call fcn.10007e90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x10227788]
cmp eax, 7
ja case.default.0x1000e4aa
jmp dword [eax*4 + 0x1000e4dc]
jmp fcn.1000adc0
jmp 0x1000afa0
jmp 0x1000afc0
jmp 0x1000aff0
jmp 0x1000b0d0
jmp 0x1000b1b0
jmp 0x1000b290
jmp 0x1000b370
ret