Function at 0x1008ef60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1010ef98
push eax
mov dword fs:[0], esp
sub esp, 0x1c
cmp byte [0x10174f84], 0
push esi
push edi
je 0x1008efc8
test byte [0x10174f88], 1
je 0x1008efc8
mov edx, str.Checking_for_changed_skilldex_images.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x1008efc8
mov edx, str.Checking_for_changed_skilldex_images.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push str.Lockpick
mov edx, str.Misc
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x1008f029
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f022
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
mov edi, 0x125
jmp 0x1008f05f
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edx, 0x125
cmovae ecx, dword [ebp - 0x28]
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov edi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f05a
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x1008f09a
cmp eax, 1
je 0x1008f09a
push str..ddraw.ini
push 0x125
mov edx, str.Lockpick
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp edi, 0x125
je 0x1008f0cd
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d54
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d54], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d54
call esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
push str.Steal
mov edx, str.Misc
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x1008f12e
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f127
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
mov edi, 0x125
jmp 0x1008f164
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edx, 0x125
cmovae ecx, dword [ebp - 0x28]
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov edi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f15f
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x1008f19f
cmp eax, 1
je 0x1008f19f
push str..ddraw.ini
push 0x125
mov edx, str.Steal
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f1cc
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d58
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d58], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d58
call esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
push str.Traps
mov edx, str.Misc
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x1008f22d
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f226
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
mov edi, 0x125
jmp 0x1008f263
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edx, 0x125
cmovae ecx, dword [ebp - 0x28]
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov edi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f25e
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x1008f29e
cmp eax, 1
je 0x1008f29e
push str..ddraw.ini
push 0x125
mov edx, str.Traps
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f2cb
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d5c
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d5c], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d5c
call esi
push str.._sfall.ini
push 0x125
mov edx, str.FirstAid
mov ecx, str.Misc
call fcn.10005480
cmp byte [0x10153f67], 0
mov edi, eax
je 0x1008f313
cmp dword [0x10154e3c], 1
je 0x1008f313
push str..ddraw.ini
push 0x125
mov edx, str.FirstAid
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f340
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d4c
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d4c], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d4c
call esi
push str.._sfall.ini
push 0x125
mov edx, str.Doctor
mov ecx, str.Misc
call fcn.10005480
cmp byte [0x10153f67], 0
mov edi, eax
je 0x1008f388
cmp dword [0x10154e3c], 1
je 0x1008f388
push str..ddraw.ini
push 0x125
mov edx, str.Doctor
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f3b5
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d50
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d50], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d50
call esi
push str.._sfall.ini
push 0x125
mov edx, str.Science
mov ecx, str.Misc
call fcn.10005480
cmp byte [0x10153f67], 0
mov edi, eax
je 0x1008f3fd
cmp dword [0x10154e3c], 1
je 0x1008f3fd
push str..ddraw.ini
push 0x125
mov edx, str.Science
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f42a
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d60
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d60], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d60
call esi
push str.._sfall.ini
push 0x125
mov edx, str.Repair
mov ecx, str.Misc
call fcn.10005480
cmp byte [0x10153f67], 0
mov edi, eax
je 0x1008f472
cmp dword [0x10154e3c], 1
je 0x1008f472
push str..ddraw.ini
push 0x125
mov edx, str.Repair
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f49f
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d64
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d64], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d64
call esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret