Function at 0x100704b0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7b48
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xff
push 0x2e
lea edx, [ebp - 0x44]
mov dword [ebp - 0x44], 0xffe8c88b
mov ecx, 0x400000
mov dword [ebp - 0x40], 0xe8ffffff
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x38], 0xffffffe8
mov dword [ebp - 0x34], 0xffffe8ff
mov dword [ebp - 0x30], 0xc88bffff
mov dword [ebp - 0x2c], 0xffffffe8
mov dword [ebp - 0x28], 0xffffe8ff
mov dword [ebp - 0x24], 0xc88bffff
mov dword [ebp - 0x20], 0xffffffe8
mov dword [ebp - 0x1c], 0xffffe8ff
mov word [ebp - 0x18], 0xffff
call fcn.10086180
mov esi, eax
add esp, 8
mov dword [0x101eef8c], esi
test esi, esi
je 0x100705b6
lea edx, [esi + 2]
mov dword [0x101eef84], edx
lea edi, [esi + 7]
mov ecx, dword [edx + 1]
add ecx, 5
mov dword [0x101ef0a4], edi
add ecx, edx
mov dword [0x101eef84], ecx
mov eax, dword [edi + 1]
add eax, 5
add eax, edi
mov dword [0x101ef0a4], eax
lea eax, [esi + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x101ef054], eax
lea eax, [ebp - 0x80]
push eax
push 0x40
push 5
push edi
call esi
mov eax, 0x100545e0
mov byte [edi], 0xe9
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x80]
push 5
push edi
call esi
push 0xff
push 0x2e
lea edx, [ebp - 0x44]
mov dword [ebp - 0x44], 0xffe90574
mov ecx, 0x400000
mov dword [ebp - 0x40], 0x83ffffff
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x38], 0xffc600ff
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x30], 0xffffff00
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], 0xff74ff85
mov dword [ebp - 0x24], 0xffffffc6
mov dword [ebp - 0x20], 0xc601ffff
mov dword [ebp - 0x1c], 0xffffffff
mov word [ebp - 0x18], 0xff
call fcn.10086180
add esp, 8
mov dword [0x101ef158], eax
test eax, eax
je 0x10070633
mov eax, dword [eax + 0x18]
mov dword [0x101ef158], eax
jmp 0x1007063d
mov ecx, str.SS6_VK_RBUTTON
call fcn.10086360
sub esp, 8
mov dword [ebp - 0x40], 0xfe51026a
lea edx, [ebp - 0x40]
mov dword [ebp - 0x3c], 0xfef3fefe
mov dword [ebp - 0x38], 0x8bfefefe
mov dword [ebp - 0x34], 0xfe05fefe
mov dword [ebp - 0x30], 0x50fefefe
mov dword [ebp - 0x2c], 0xfefefeff
mov dword [ebp - 0x28], 0xfefffefe
mov dword [ebp - 0x24], 0xfefefefe
mov dword [ebp - 0x20], 0xfffefe8b
mov dword [ebp - 0x1c], 0x184fe
mov byte [ebp - 0x18], 0
call fcn.10086270
mov edx, eax
add esp, 8
mov dword [0x101eefd0], edx
test edx, edx
je 0x100706d2
mov eax, dword [edx + 0x33]
mov ecx, dword [edx + 0x1c]
add eax, 0x37
add eax, edx
mov dword [0x101eef24], ecx
add edx, 0x47
mov dword [0x101ef0f0], eax
add ecx, 4
mov dword [0x101ef12c], ecx
mov eax, dword [edx + 1]
add eax, 5
add eax, edx
mov dword [0x101eefd0], eax
jmp 0x10070712
mov edx, 0x47
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + 0x100d24e4]
xor al, dl
mov byte [ebp + ecx - 0x78], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xc
jb 0x100706e0
mov byte [ebp - 0x6c], 0
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], 0
call fcn.10086360
mov dword [ebp - 4], 0xffffffff
push 0xfe
push 0x10
lea edx, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0xfefefe83
mov ecx, 0x400000
mov dword [ebp - 0x78], 0x74fffefe
mov dword [ebp - 0x74], 0xfefe8bfe
mov dword [ebp - 0x70], 0xfefe83
call fcn.10086180
add esp, 8
mov dword [0x101ef09c], eax
test eax, eax
je 0x10070758
mov eax, dword [eax + 2]
mov dword [0x101ef09c], eax
jmp 0x10070762
mov ecx, str.SS6_InDex_PLayer_Monster
call fcn.10086360
push 0xff
push 0x1d
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], 0xffffff8a
mov ecx, 0x400000
mov dword [ebp - 0x30], 0xff880000
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], 0x75ff85ff
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 0xff83ffff
mov dword [ebp - 0x1c], 0xffffffff
mov byte [ebp - 0x18], 0
call fcn.10086180
add esp, 8
mov dword [0x101eefe4], eax
test eax, eax
je 0x100707dd
mov ecx, dword [eax + 2]
mov dword [0x101eefe4], ecx
lea eax, [ecx + 0x2a]
mov dword [0x101ef008], eax
lea eax, [ecx + 0x2c]
mov dword [0x101ef044], eax
lea eax, [ecx + 0x2e8]
mov dword [0x101ef15c], eax
jmp 0x100707e7
mov ecx, str.SS18_ShowCharter
call fcn.10086360
push 0xff
push 0x13
lea edx, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0x8bffff89
mov ecx, 0x400000
mov dword [ebp - 0x78], 0xffff08ff
mov dword [ebp - 0x74], 0xffffff
mov dword [ebp - 0x70], 0xfcff8900
mov word [ebp - 0x6c], 0xff8b
mov byte [ebp - 0x6a], 8
call fcn.10086180
add esp, 8
mov dword [0x101ef038], eax
test eax, eax
je 0x10070837
mov eax, dword [eax + 0x16]
mov dword [0x101ef038], eax
jmp 0x10070841
mov ecx, str.SS18_eObjectType
call fcn.10086360
push 0xff
push 0x19
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0xffffffa1
mov ecx, 0x400000
mov dword [ebp - 0x2c], 0xe4ff89ff
mov dword [ebp - 0x28], 0x5ffff83
mov dword [ebp - 0x24], 0xffe8ff75
mov dword [ebp - 0x20], 0x89ffffff
mov dword [ebp - 0x1c], 0xff8be0ff
mov byte [ebp - 0x18], 0xe0
call fcn.10086180
add esp, 8
mov dword [0x101eef38], eax
test eax, eax
je 0x10070899
mov eax, dword [eax + 1]
mov dword [0x101eef38], eax
jmp 0x100708a3
mov ecx, str.SS6_Status_Game
call fcn.10086360
cmp dword [0x101ef154], 0
jne 0x10070962
push 0xc
lea eax, [ebp - 0x78]
mov dword [ebp - 0x38], 0xffffffa1
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0xffffffff
push 0x400000
mov dword [ebp - 0x30], 0xffff8b32
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0x500000ff
mov dword [ebp - 0x20], 0xffffffe8
mov dword [ebp - 0x1c], 0xe8ff8bff
mov dword [ebp - 0x78], 0
movq qword [ebp - 0x74], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
mov ebx, dword [ebp - 0x74]
mov edi, dword [0x101ef154]
test ebx, ebx
je 0x10070954
mov esi, 0x400001
test edi, edi
jne 0x10070948
push 0xff
push 0x20
lea ecx, [esi - 1]
lea edx, [ebp - 0x38]
call fcn.10086120
add esp, 8
test eax, eax
je 0x10070948
mov eax, dword [esi + 0xa]
mov edi, dword [esi]
mov dword [0x101ef128], eax
inc esi
sub ebx, 1
jne 0x10070921
mov dword [0x101ef154], edi
test edi, edi
jne 0x10070962
mov ecx, str.SS6_ME
call fcn.10086360
push 0xff
push 0x14
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x190b8
mov ecx, 0x400000
mov dword [ebp - 0x28], 0x5dff8b00
mov dword [ebp - 0x24], 0xff8b55c3
mov dword [ebp - 0x20], 0xff335151
mov dword [ebp - 0x1c], 0x2ffc140
call fcn.10086180
mov edx, eax
add esp, 8
test edx, edx
je 0x100709bf
mov ecx, dword [edx - 0x39]
mov eax, dword [edx - 0x32]
add ecx, 0xffffffcb
add ecx, edx
add eax, 0xffffffd2
add eax, edx
mov dword [0x101ef0fc], ecx
mov dword [0x101eeef8], eax
jmp 0x100709c9
mov ecx, str.SS18_get_singleton_SS18_get_by_id
call fcn.10086360
push 0xff
push 0x1a
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0x7fc45c7
mov ecx, 0x400000
mov dword [ebp - 0x2c], 0x8b000000
mov dword [ebp - 0x28], 0x8b66f045
mov dword [ebp - 0x24], 0x89660840
mov dword [ebp - 0x20], 0xff6ac445
mov dword [ebp - 0x1c], 0xc168
mov word [ebp - 0x18], 0x8d00
call fcn.10086180
mov edx, eax
add esp, 8
mov dword [0x101ef04c], edx
test edx, edx
je 0x10070a55
mov eax, dword [edx + 0x7c]
mov ecx, dword [edx + 0xdb]
sub eax, 0xffffff80
add eax, edx
add ecx, 0xdf
mov dword [0x101ef1c8], eax
add ecx, edx
mov eax, dword [edx + 0x75]
add eax, 0x79
mov dword [0x101ef07c], ecx
add eax, edx
mov dword [0x101eefdc], eax
movzx eax, byte [edx + 0x13]
mov dword [0x101ef04c], eax
jmp 0x10070a5f
mov ecx, str.SS18_Skill_Dien_Rong
call fcn.10086360
push 0xff
push 0x52
lea edx, [ebp - 0x68]
mov dword [ebp - 0x68], 0x83e34588
mov ecx, 0x400000
mov dword [ebp - 0x64], 0x8bfffc4d
mov dword [ebp - 0x60], 0xe083ec45
mov dword [ebp - 0x5c], 0x83ff7401
mov dword [ebp - 0x58], 0x8dffffff
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x50], 0xffffe8ff
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x48], 0xc085ffff
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x38], 0xffffffa3
mov dword [ebp - 0x34], 0xffff8dff
mov dword [ebp - 0x30], 0xe8ffffff
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], 0x1fc45c7
mov dword [ebp - 0x24], 0x8b000000
mov dword [ebp - 0x20], 0x8b66f045
mov dword [ebp - 0x1c], 0x89660840
mov word [ebp - 0x18], 0xd845
call fcn.10086180
add esp, 8
mov dword [0x101eefa4], eax
test eax, eax
je 0x10070b1c
movzx eax, byte [eax + 0x53]
mov dword [0x101eefa4], eax
jmp 0x10070b26
mov ecx, str.SS18_Skill_One_Target
call fcn.10086360
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret