Function at 0x1004d6c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e155
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x10084040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x1008a09c], 0
je 0x1004daee
push 0xf
xor edx, edx
mov ecx, str.Weapon
call fcn.10016740
mov eax, dword [0x1008a124]
add esp, 4
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
push dword [ebp - 0x24]
mov eax, dword [eax + 0x138a78]
push dword [ebp - 0x28]
push dword [0x10089fa0]
mov eax, dword [eax + 0x10]
mov dword [0x10089fbc], eax
mov al, byte [0x1008a07c]
push eax
push ecx
mov ecx, str.SHOW_WEAPON
call fcn.100681f0
add esp, 0x14
test al, al
je 0x1004d79e
cmp byte [0x1008a07c], 0
mov edi, dword [0x1008a184]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
sete al
mov byte [ebp - 0x19], al
add edi, 0x68
mov byte [0x1008a07c], al
lea eax, [ebp - 0x18]
push eax
push 0x40
push 1
push edi
call esi
mov al, byte [ebp - 0x19]
mov byte [edi], al
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 1
push edi
call esi
mov al, byte [0x1008a087]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push dword [ebp - 0x28]
push dword [0x10089fa0]
push eax
push ecx
mov ecx, str.INFINITE_AMMO
call fcn.100681f0
add esp, 0x14
test al, al
je 0x1004d7f5
cmp byte [0x1008a087], 0
sete al
mov byte [0x1008a087], al
mov byte [ebp - 0x18], al
mov eax, dword [0x1008a104]
add eax, 0x3a9d20
mov dword [ebp - 0x20], eax
push dword [ebp - 0x18]
call dword [ebp - 0x20]
mov al, byte [0x1008a078]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push dword [ebp - 0x28]
push dword [0x10089fa0]
push eax
push ecx
mov ecx, str.NPC_AIMING
call fcn.100681f0
add esp, 0x14
test al, al
je 0x1004d847
cmp byte [0x1008a078], 0
sete al
mov byte [0x1008a078], al
movzx ecx, al
mov eax, dword [0x1008a168]
xor ecx, 1
mov dword [eax + 0x3a9], ecx
push ecx
mov edx, 0x1008a77c
mov ecx, str.KILL_ENEMIES
call fcn.10069040
add esp, 4
test al, al
je 0x1004d86e
mov eax, dword [0x1008a104]
add eax, 0x3acea0
mov dword [ebp - 0x20], eax
call dword [ebp - 0x20]
push ecx
mov edx, 0x1008a77c
mov ecx, str.SET_WEAPON
call fcn.10069040
add esp, 4
test al, al
je 0x1004d93a
mov eax, dword [0x1008a124]
lea ecx, [ebp - 0x28]
mov esi, dword [0x1008a100]
push ecx
mov dword [ebp - 0x24], 0
mov eax, dword [eax + 0x138a78]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [0x1008a068]
shl eax, 2
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
push eax
push ecx
lea ecx, [ebp - 0x38]
call fcn.10054440
mov edi, dword [ebp - 0x34]
xor ecx, ecx
mov edx, dword [ebp - 0x38]
sub edi, edx
sar edi, 2
test edi, edi
je 0x1004d8e0
mov eax, dword [edx + ecx*4]
inc ecx
add eax, dword [esi]
mov esi, eax
cmp ecx, edi
jb 0x1004d8d4
test edx, edx
je 0x1004d91d
mov eax, dword [ebp - 0x30]
sub eax, edx
sar eax, 2
lea ecx, [eax*4]
mov eax, edx
cmp ecx, 0x1000
jb 0x1004d913
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1004d913
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1006c5e3
add esp, 8
add dword [ebp - 0x20], 0xcd0
mov dword [ebp - 0x18], esi
mov byte [ebp - 0x19], 1
mov dl, byte [ebp - 0x19]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call dword [0x1008a140]
movss xmm1, dword [0x1007d354]
xorps xmm0, xmm0
call fcn.1001a4d0
mov edi, dword [0x1008a068]
lea ecx, [ebp - 0x38]
push 0x1008a820
call fcn.10054620
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
cmp esi, ecx
je 0x1004d996
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x1004d996
lea eax, [edi + edi*2]
cmp dword [esi + eax*8 + 0x14], 0xf
lea edx, [esi + eax*8]
jbe 0x1004d99b
mov edx, dword [edx]
jmp 0x1004d99b
mov edx, 0x10078888
push 0x24
mov ecx, str.Weapons
call fcn.10033e60
add esp, 4
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.10054800
cmp byte [ebp - 0x19], 0
je 0x1004d9e3
sub esp, 0xc
mov ecx, esp
push 0x1008a820
call fcn.10054620
mov ecx, 0x1008a068
call fcn.10067ba0
add esp, 0xc
call fcn.1001b5d0
push ecx
mov edx, 0x1008a77c
mov ecx, str.EXPLOSION
call fcn.10069040
add esp, 4
test al, al
je 0x1004da40
mov eax, dword [0x1008a0fc]
mov dword [ebp - 0x18], 0
mov ecx, dword [eax + 0x24]
mov eax, dword [0x1008a04c]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x10089fbc]
add eax, 0x1d0
mov dword [ebp - 0x20], eax
mov eax, dword [0x10089f68]
add eax, 0x3fbef0
mov dword [ebp - 0x24], eax
mov esi, dword [0x1008a16c]
mov edi, dword [ebp - 0x20]
push dword [ebp - 0x18]
push dword [ebp - 0x3c]
call dword [ebp - 0x24]
movss xmm1, dword [0x1007d354]
xorps xmm0, xmm0
call fcn.1001a4d0
mov esi, dword [0x1008a04c]
lea ecx, [ebp - 0x50]
push 0x1008a82c
call fcn.10054620
mov dword [ebp - 4], 1
mov edi, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
cmp edi, ecx
je 0x1004da9c
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jae 0x1004da9c
lea eax, [esi + esi*2]
cmp dword [edi + eax*8 + 0x14], 0xf
lea edx, [edi + eax*8]
jbe 0x1004daa1
mov edx, dword [edx]
jmp 0x1004daa1
mov edx, 0x10078888
push 0x24
mov ecx, str.Explosions
call fcn.10033e60
add esp, 4
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10054800
cmp byte [ebp - 0x19], 0
je 0x1004dae9
sub esp, 0xc
mov ecx, esp
push 0x1008a82c
call fcn.10054620
mov ecx, 0x1008a04c
call fcn.10067ba0
add esp, 0xc
call fcn.1001b5d0
call fcn.10019040
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006c1ab
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret