Function at 0x1003ff10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005642d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x98
mov eax, dword [0x10069040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x1006ef21], 0
je 0x100402bf
push 0xf
xor edx, edx
mov ecx, 0x100624ec
call fcn.1000c090
mov edx, 0x1006efdc
mov ecx, str.KILL_ENEMIES
call fcn.10051b40
add esp, 4
test al, al
je 0x1003ff92
mov eax, dword [0x1006ef68]
add eax, 0x3acea0
mov dword [ebp - 0x18], eax
call dword [ebp - 0x18]
push ecx
mov edx, 0x1006efdc
mov ecx, str.CREATE_RNPC
call fcn.10051b40
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
test al, al
je 0x1004007b
mov eax, dword [0x1006ef64]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 0xc
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call edi
movq xmm0, qword [esi + 0x1d0]
movq qword [ebp - 0x24], xmm0
mov eax, dword [esi + 0x1d8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push 0xc
push eax
call edi
movq xmm0, qword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
movq qword [0x1006eeb0], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xa0], xmm0
mov dword [0x1006eeb8], eax
mov eax, dword [0x1006ef68]
movups xmmword [ebp - 0x90], xmm0
add eax, 0x1853b0
mov dword [ebp - 0x64], 0
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x18], eax
movss xmm0, dword [ebp - 0x24]
movss dword [ebp - 0x70], xmm0
movss xmm0, dword [ebp - 0x20]
movss dword [ebp - 0x6c], xmm0
movss xmm0, dword [ebp - 0x1c]
movss dword [ebp - 0x68], xmm0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0xa0]
push eax
push dword [0x1006efac]
xor eax, eax
call dword [ebp - 0x18]
push ecx
mov edx, 0x1006efdc
mov ecx, str.CREATE_NPC
call fcn.10051b40
add esp, 4
test al, al
je 0x10040211
mov eax, dword [0x1006eef8]
lea ecx, [ebp - 0x18]
mov esi, dword [0x1006ef68]
lea edx, [ebp - 0x24]
push ecx
push ecx
shl eax, 2
lea ecx, [ebp - 0x40]
push edx
mov dword [ebp - 0x24], 8
add esi, 0x112652c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
call fcn.10042460
mov edi, dword [ebp - 0x3c]
xor ecx, ecx
mov edx, dword [ebp - 0x40]
sub edi, edx
sar edi, 2
test edi, edi
je 0x100400ec
nop dword [eax]
mov eax, dword [edx + ecx*4]
inc ecx
add eax, dword [esi]
mov esi, eax
cmp ecx, edi
jb 0x100400e0
test edx, edx
je 0x10040129
mov eax, dword [ebp - 0x38]
sub eax, edx
sar eax, 2
lea ecx, [eax*4]
mov eax, edx
cmp ecx, 0x1000
jb 0x1004011f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1004011f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10054b4d
add esp, 8
mov eax, dword [0x1006ef64]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x48], esi
mov esi, dword [eax + 0x10]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 0xc
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call edi
movq xmm0, qword [esi + 0x1d0]
movq qword [ebp - 0x24], xmm0
mov eax, dword [esi + 0x1d8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push 0xc
push eax
call edi
mov eax, dword [ebp - 0x1c]
movq xmm0, qword [ebp - 0x24]
push 0x3c
mov dword [0x1006eeb8], eax
lea eax, [ebp - 0x9c]
push 0
push eax
movq qword [0x1006eeb0], xmm0
mov dword [ebp - 0xa0], 0
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [ebp - 0x24]
lea eax, [ebp - 0xa0]
movss dword [ebp - 0x40], xmm0
add esp, 0xc
movss xmm0, dword [ebp - 0x20]
movss dword [ebp - 0x3c], xmm0
movss xmm0, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [0x1006ef68]
movss dword [ebp - 0x38], xmm0
add eax, 0x12ac50
mov dword [ebp - 0x34], 0x3f800000
movaps xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x70], xmm0
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x18]
push dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
call dword [ebp - 0x4c]
mov dword [ebp - 0x2c], eax
movss xmm1, dword [0x1006307c]
xorps xmm0, xmm0
call fcn.1000fe20
mov esi, dword [0x1006eef8]
lea ecx, [ebp - 0x60]
push 0x1006f008
call fcn.10042280
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
cmp edi, ecx
je 0x1004026d
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jae 0x1004026d
lea eax, [esi + esi*2]
cmp dword [edi + eax*8 + 0x14], 0xf
lea edx, [edi + eax*8]
jbe 0x10040272
mov edx, dword [edx]
jmp 0x10040272
mov edx, 0x1005f46c
push 0x24
mov ecx, str.Actors
call fcn.10029770
add esp, 4
mov byte [ebp - 0x25], al
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0xffffffff
call fcn.10042530
cmp byte [ebp - 0x25], 0
je 0x100402ba
sub esp, 0xc
mov ecx, esp
push 0x1006f008
call fcn.10042280
mov ecx, 0x1006eef8
call fcn.10050c10
add esp, 0xc
call fcn.10010f20
call fcn.1000e990
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005465b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret