Function at 0x1004cea0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e115
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x10084040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x1008a09d], 0
je 0x1004d6a2
push 0xf
xor edx, edx
mov ecx, str.Player
call fcn.10016740
add esp, 4
cmp dword [0x1008a044], 2
jne 0x1004cf23
mov eax, dword [0x10089fb8]
mov ecx, dword [eax + 0xc8]
cmp dword [ecx + 0x14], 0x7e8a2dc4
je 0x1004cf1e
mov eax, dword [ecx + 0xc]
jmp 0x1004cf28
mov eax, dword [eax + 0xc]
jmp 0x1004cf28
mov eax, str.PLAYER
push eax
push str.CURRENT:__s
call fcn.10068170
add esp, 4
mov edx, 0x1008a77c
mov ecx, str.HEALTH
call fcn.10069040
add esp, 4
test al, al
je 0x1004cf61
mov eax, dword [0x10089fb8]
movss xmm0, dword [0x1008914c]
movss dword [eax + 0x9e0], xmm0
movss xmm1, dword [0x1007d354]
xorps xmm0, xmm0
call fcn.1001a4d0
push 0
push 0
sub esp, 8
mov edx, 8
mov ecx, 0x1007ba94
push 0x1008914c
call fcn.10035b50
mov eax, dword [0x10089fb8]
add esp, 0x14
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
push dword [ebp - 0x20]
mov al, byte [eax + 0x6e4]
push dword [ebp - 0x24]
shr al, 3
push dword [0x10089fa0]
and al, 1
push eax
push ecx
mov ecx, str.INVISIBILITY
call fcn.100681f0
mov edx, dword [0x10089fb8]
add esp, 0x14
test al, al
je 0x1004cfee
mov cl, byte [edx + 0x6e4]
mov al, cl
shr al, 3
not al
shl al, 3
xor al, cl
and al, 8
xor al, cl
mov byte [edx + 0x6e4], al
mov eax, dword [edx + 0xc8]
mov dword [ebp - 0x20], 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
mov al, byte [eax + 0x1d9]
push dword [0x10089fa0]
push eax
push ecx
mov ecx, str.GOD_MODE
call fcn.100681f0
add esp, 0x14
test al, al
je 0x1004d042
mov eax, dword [0x10089fb8]
mov ecx, dword [eax + 0xc8]
cmp byte [ecx + 0x1d9], 0
sete al
mov byte [ecx + 0x1d9], al
cmp byte [0x1008a084], 0
jne 0x1004d167
mov al, byte [0x1008a083]
mov dword [ebp - 0x20], 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
push dword [0x10089fa0]
push eax
push ecx
mov ecx, str.NOCLIP
call fcn.100681f0
add esp, 0x14
test al, al
je 0x1004d15e
mov eax, dword [0x1008a124]
cmp byte [0x1008a083], 0
sete ch
mov eax, dword [eax + 0x138a78]
mov cl, ch
mov byte [0x1008a083], ch
shl cl, 4
mov edx, dword [eax + 0x10]
mov al, byte [edx + 0x1d73]
and al, 0xef
or cl, al
mov byte [edx + 0x1d73], cl
test ch, ch
je 0x1004d0e7
mov edi, dword [0x1008a160]
lea eax, [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 2
push edi
call esi
mov eax, 0x9eb
mov word [edi], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 2
push edi
call esi
cmp byte [0x1008a083], 0
mov eax, dword [0x1008a124]
mov eax, dword [eax + 0x138a78]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0xc8]
jne 0x1004d139
cmp byte [0x1008a088], 0
setne cl
mov byte [eax + 0x1d9], cl
mov eax, dword [0x1008a124]
mov eax, dword [eax + 0x138ab0]
mov eax, dword [eax + 0xc8]
mov byte [eax + 0x32], 0
mov al, 1
mov byte [0x1008a081], 1
mov byte [0x1008a082], al
jmp 0x1004d174
mov byte [eax + 0x1d9], 1
mov eax, dword [0x1008a124]
mov eax, dword [eax + 0x138ab0]
mov eax, dword [eax + 0xc8]
mov byte [eax + 0x32], 1
xor al, al
mov byte [0x1008a082], al
jmp 0x1004d174
cmp byte [0x1008a084], 0
je 0x1004d174
push str.NOCLIP
call fcn.10068170
add esp, 4
mov eax, dword [0x10089fb8]
mov dword [ebp - 0x20], 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
mov al, byte [eax + 0x1d72]
push dword [0x10089fa0]
shr al, 7
push eax
push ecx
mov ecx, str.COLLISION
call fcn.100681f0
add esp, 0x14
test al, al
je 0x1004d1cc
mov edx, dword [0x10089fb8]
mov cl, byte [edx + 0x1d72]
mov al, cl
and cl, 0x7f
not al
and al, 0x80
or al, cl
mov byte [edx + 0x1d72], al
mov eax, dword [0x1008a124]
mov dword [ebp - 0x20], 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
mov al, byte [eax + 0x2fd8]
push dword [0x10089fa0]
push eax
push ecx
mov ecx, str.FLASHLIGHT
call fcn.100681f0
add esp, 0x14
test al, al
je 0x1004d21a
mov ecx, dword [0x1008a124]
cmp byte [ecx + 0x2fd8], 0
sete al
mov byte [ecx + 0x2fd8], al
mov al, byte [0x1008a086]
mov dword [ebp - 0x20], 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
push dword [0x10089fa0]
push eax
push ecx
mov ecx, str.HIDE_HAT
call fcn.100681f0
add esp, 0x14
test al, al
je 0x1004d305
cmp byte [0x1008a086], 0
lea edx, [ebp - 0x40]
mov ecx, dword [0x1008a104]
sete al
mov dword [ebp - 0x40], 0x10
mov byte [0x1008a086], al
xor al, 1
mov byte [ebp - 0x18], al
lea eax, [ecx + 0x144640]
mov dword [ebp - 0x3c], 0
push ecx
mov dword [ebp - 0x20], eax
lea esi, [ecx + 0x1126508]
lea eax, [ebp - 0x38]
push eax
push edx
lea ecx, [ebp - 0x38]
call fcn.10054440
mov edi, dword [ebp - 0x34]
xor ecx, ecx
mov edx, dword [ebp - 0x38]
sub edi, edx
sar edi, 2
test edi, edi
je 0x1004d2bc
nop dword [eax]
mov eax, dword [edx + ecx*4]
inc ecx
add eax, dword [esi]
mov esi, eax
cmp ecx, edi
jb 0x1004d2b0
test edx, edx
je 0x1004d2f9
mov eax, dword [ebp - 0x30]
sub eax, edx
sar eax, 2
lea ecx, [eax*4]
mov eax, edx
cmp ecx, 0x1000
jb 0x1004d2ef
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1004d2ef
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1006c5e3
add esp, 8
mov dword [ebp - 0x3c], esi
push dword [ebp - 0x18]
push dword [ebp - 0x3c]
call dword [ebp - 0x20]
push ecx
mov edx, 0x1008a77c
mov ecx, str.SET_HAT
call fcn.10069040
add esp, 4
test al, al
je 0x1004d321
call fcn.1005d6c0
movss xmm1, dword [0x1007d354]
xorps xmm0, xmm0
call fcn.1001a4d0
mov edi, dword [0x1008a074]
lea ecx, [ebp - 0x38]
push 0x1008a7d8
call fcn.10054620
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
cmp esi, ecx
je 0x1004d37d
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x1004d37d
lea eax, [edi + edi*2]
cmp dword [esi + eax*8 + 0x14], 0xf
lea edx, [esi + eax*8]
jbe 0x1004d382
mov edx, dword [edx]
jmp 0x1004d382
mov edx, 0x10078888
push 0x24
mov ecx, str.Hats
call fcn.10033e60
add esp, 4
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.10054800
cmp byte [ebp - 0x19], 0
je 0x1004d3ca
sub esp, 0xc
mov ecx, esp
push 0x1008a7d8
call fcn.10054620
mov ecx, 0x1008a074
call fcn.10067ba0
add esp, 0xc
call fcn.1001b5d0
push ecx
mov edx, 0x1008a77c
mov ecx, str.SET_HEAD
call fcn.10069040
add esp, 4
test al, al
je 0x1004d3e6
call fcn.1005e1d0
movss xmm1, dword [0x1007d354]
xorps xmm0, xmm0
call fcn.1001a4d0
mov edi, dword [0x1008a070]
lea ecx, [ebp - 0x38]
push 0x1008a7e4
call fcn.10054620
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
cmp esi, ecx
je 0x1004d442
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x1004d442
lea eax, [edi + edi*2]
cmp dword [esi + eax*8 + 0x14], 0xf
lea edx, [esi + eax*8]
jbe 0x1004d447
mov edx, dword [edx]
jmp 0x1004d447
mov edx, 0x10078888
push 0x24
mov ecx, str.Heads
call fcn.10033e60
add esp, 4
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.10054800
cmp byte [ebp - 0x19], 0
je 0x1004d48f
sub esp, 0xc
mov ecx, esp
push 0x1008a7e4
call fcn.10054620
mov ecx, 0x1008a070
call fcn.10067ba0
add esp, 0xc
call fcn.1001b5d0
push ecx
mov edx, 0x1008a77c
mov ecx, str.SET_OUTFIT
call fcn.10069040
add esp, 4
test al, al
je 0x1004d4ab
call fcn.1005da80
movss xmm1, dword [0x1007d354]
xorps xmm0, xmm0
call fcn.1001a4d0
mov edi, dword [0x1008a06c]
lea ecx, [ebp - 0x38]
push 0x1008a7f0
call fcn.10054620
mov dword [ebp - 4], 2
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
cmp esi, ecx
je 0x1004d507
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x1004d507
lea eax, [edi + edi*2]
cmp dword [esi + eax*8 + 0x14], 0xf
lea edx, [esi + eax*8]
jbe 0x1004d50c
mov edx, dword [edx]
jmp 0x1004d50c
mov edx, 0x10078888
push 0x24
mov ecx, str.Outfits
call fcn.10033e60
add esp, 4
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.10054800
cmp byte [ebp - 0x19], 0
je 0x1004d554
sub esp, 0xc
mov ecx, esp
push 0x1008a7f0
call fcn.10054620
mov ecx, 0x1008a06c
call fcn.10067ba0
add esp, 0xc
call fcn.1001b5d0
push ecx
mov edx, 0x1008a77c
mov ecx, str.SET_SKELETON
call fcn.10069040
add esp, 4
test al, al
je 0x1004d57c
mov dl, byte [0x1008a064]
mov ecx, dword [0x10089fb8]
call fcn.1005ebd0
movss xmm1, dword [0x1007d354]
xorps xmm0, xmm0
call fcn.1001a4d0
mov esi, dword [0x1008a064]
lea ecx, [ebp - 0x50]
push 0x1008a868
call fcn.10054620
mov dword [ebp - 4], 3
mov edi, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
cmp edi, ecx
je 0x1004d5d8
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jae 0x1004d5d8
lea eax, [esi + esi*2]
cmp dword [edi + eax*8 + 0x14], 0xf
lea edx, [edi + eax*8]
jbe 0x1004d5dd
mov edx, dword [edx]
jmp 0x1004d5dd
mov edx, 0x10078888
push 0x24
mov ecx, str.Skeletons
call fcn.10033e60
add esp, 4
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10054800
cmp byte [ebp - 0x19], 0
je 0x1004d625
sub esp, 0xc
mov ecx, esp
push 0x1008a868
call fcn.10054620
mov ecx, 0x1008a064
call fcn.10067ba0
add esp, 0xc
call fcn.1001b5d0
push ecx
mov edx, 0x1008a77c
mov ecx, str.ATTACHMENTS
call fcn.10069040
add esp, 4
test al, al
je 0x1004d661
mov eax, dword [0x1008a104]
add eax, 0x3b7c50
mov byte [0x1008a08d], 1
mov byte [0x1008a091], 1
mov byte [ebp - 0x20], 1
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x20]
call dword [ebp - 0x3c]
push ecx
mov edx, 0x1008a77c
mov ecx, str.SET_ANIMGROUP
call fcn.10069040
add esp, 4
test al, al
je 0x1004d69d
mov eax, dword [0x1008a104]
add eax, 0x3b7c50
mov byte [0x1008a08d], 1
mov byte [0x1008a08f], 1
mov byte [ebp - 0x20], 1
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x20]
call dword [ebp - 0x3c]
call fcn.10019040
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006c1ab
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret