Function at 0x1003e580
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10047f85
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x10054040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
mov dword [ebp - 0x58], esi
call esi
push 0
call esi
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x40
lea edi, [esi + 0x783f0]
mov dword [0x100552cc], esi
push 9
lea ecx, [edi + 9]
mov dword [ebp - 0x14], eax
push edi
mov dword [0x10055214], ecx
call eax
mov dword [esi + 0x783f1], 0x90909090
mov eax, 0x1003cf90
sub eax, edi
mov dword [esi + 0x783f5], 0x90909090
sub eax, 5
mov byte [edi], 0xe9
mov dword [edi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
push 9
push edi
mov edi, dword [ebp - 0x14]
call edi
mov esi, dword [0x100552cc]
add esi, 0x78405
lea eax, [esi + 6]
mov dword [0x1005520c], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push esi
call edi
mov eax, 0x90909090
mov dword [esi], eax
mov word [esi + 4], ax
mov eax, 0x1003d000
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov ecx, dword [0x100552cc]
lea eax, [ecx + 0x7b940]
lea esi, [ecx + 0x20fee0]
mov dword [0x100551f0], eax
lea eax, [esi + 5]
mov dword [0x10055190], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push esi
call edi
mov eax, 0x1003d0c0
mov dword [esi], 0x90909090
sub eax, esi
mov byte [esi + 4], 0x90
sub eax, 5
mov byte [esi], 0xe9
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 5
push esi
call edi
mov esi, dword [0x100552cc]
add esi, 0x5ca38
lea eax, [esi + 5]
mov dword [0x100551b0], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push esi
call edi
mov eax, 0x1003d0f0
mov dword [esi], 0x90909090
sub eax, esi
mov byte [esi + 4], 0x90
sub eax, 5
mov byte [esi], 0xe9
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 5
push esi
call edi
mov esi, dword [0x100552cc]
add esi, 0x4f49b
lea eax, [esi + 6]
mov dword [0x100551bc], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push esi
call edi
mov eax, 0x90909090
mov dword [esi], eax
mov word [esi + 4], ax
mov eax, 0x1003d120
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
add esi, 0x77593
lea eax, [esi + 6]
mov dword [0x100551ec], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push esi
call edi
mov eax, 0x90909090
mov dword [esi], eax
mov word [esi + 4], ax
mov eax, 0x1003d150
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
add esi, 0x101b6f
lea eax, [esi + 6]
mov dword [0x1005521c], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push esi
call edi
mov eax, 0x90909090
mov dword [esi], eax
mov word [esi + 4], ax
mov eax, 0x1003d620
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
add esi, 0x7da5c
lea eax, [esi + 5]
mov dword [0x100551cc], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push esi
call edi
mov eax, 0x1003d660
mov dword [esi], 0x90909090
sub eax, esi
mov byte [esi + 4], 0x90
sub eax, 5
mov byte [esi], 0xe9
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 5
push esi
call edi
mov esi, dword [0x100552cc]
add esi, 0x2d6fb8
lea eax, [esi + 6]
mov dword [0x10055224], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push esi
call edi
mov eax, 0x90909090
mov dword [esi], eax
mov word [esi + 4], ax
mov eax, 0x1003da10
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
add esi, 0x14b85
lea eax, [esi + 6]
mov dword [0x10055194], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push esi
call edi
mov eax, 0x90909090
mov dword [esi], eax
mov word [esi + 4], ax
mov eax, 0x1003dc00
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
add esi, 0x5cf40
lea eax, [esi + 0xa]
mov dword [0x10055204], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xa
push esi
call edi
mov eax, 0x90909090
mov dword [esi], eax
mov dword [esi + 4], eax
mov word [esi + 8], ax
mov eax, 0x1003dc60
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 0xa
push esi
call edi
mov esi, dword [0x100552cc]
add esi, 0x26467
lea eax, [esi + 5]
mov dword [0x10055198], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push esi
call edi
mov eax, 0x1003dc90
mov dword [esi], 0x90909090
sub eax, esi
mov byte [esi + 4], 0x90
sub eax, 5
mov byte [esi], 0xe9
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 5
push esi
call edi
mov esi, dword [0x100552cc]
add esi, 0x2ed069
lea eax, [esi + 6]
mov dword [0x100551e4], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push esi
call edi
mov eax, 0x90909090
mov dword [esi], eax
mov word [esi + 4], ax
mov eax, 0x1003dcb0
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
add esi, 0x2e43a4
lea eax, [esi + 6]
mov dword [0x1005522c], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push esi
call edi
mov eax, 0x90909090
mov dword [esi], eax
mov word [esi + 4], ax
mov eax, 0x1003dce0
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov ecx, dword [0x100552cc]
lea eax, [ecx + 0x2f4150]
lea esi, [ecx + 0x2f6ea0]
mov dword [0x10055238], eax
lea eax, [esi + 8]
mov dword [0x100551d0], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 8
push esi
call edi
mov eax, 0x1003dd10
mov dword [esi], 0x90909090
sub eax, esi
mov dword [esi + 4], 0x90909090
sub eax, 5
mov byte [esi], 0xe9
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 8
push esi
call edi
mov esi, dword [0x100552cc]
add esi, 0x2f8de4
lea eax, [esi + 6]
mov dword [0x100551e0], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push esi
call edi
mov eax, 0x90909090
mov dword [esi], eax
mov word [esi + 4], ax
mov eax, 0x1003dd50
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
add esi, 0x2fae50
lea eax, [esi + 7]
mov dword [0x100551d8], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 7
push esi
call edi
mov eax, 0x90909090
mov dword [esi], eax
mov word [esi + 4], ax
mov byte [esi + 6], al
mov eax, 0x1003dd80
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 7
push esi
call edi
mov esi, dword [0x100552cc]
add esi, 0x26135
lea eax, [esi + 6]
mov dword [0x1005519c], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push esi
call edi
mov eax, 0x90909090
mov dword [esi], eax
mov word [esi + 4], ax
mov eax, 0x1003ddc0
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov ecx, dword [0x100552cc]
lea eax, [ecx + 0x114ef0]
lea esi, [ecx + 0x3b01c]
mov dword [0x10055210], eax
lea eax, [esi + 5]
mov dword [0x10055208], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push esi
call edi
mov eax, 0x1003ddf0
mov dword [esi], 0x90909090
sub eax, esi
mov byte [esi + 4], 0x90
sub eax, 5
mov byte [esi], 0xe9
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 5
push esi
call edi
mov esi, dword [0x100552cc]
add esi, 0x10cd30
lea eax, [esi + 5]
mov dword [0x100551dc], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push esi
call edi
mov eax, 0x1003de10
mov dword [esi], 0x90909090
sub eax, esi
mov byte [esi + 4], 0x90
sub eax, 5
mov byte [esi], 0xe9
mov dword [esi + 1], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 5
push esi
call edi
mov ecx, dword [0x100552cc]
xorps xmm0, xmm0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
lea eax, [ecx + 0x5d030]
mov byte [ebp - 0x38], 0
mov dword [0x1005518c], eax
lea eax, [ecx + 0x1d7870]
mov dword [0x100551fc], eax
lea eax, [ecx + 0x4a580]
mov dword [0x10055220], eax
push 0x11
push str.Aquaberry_Cruiser
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.10044bf0
mov dword [ebp - 0x20], 0x11b
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 1
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003ec15
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003ec0b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 5
push str.BMX_I
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 2
call fcn.10044bf0
mov dword [ebp - 0x20], 0x112
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 3
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003ec96
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003ec8c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 6
push str.BMX_II
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 4
call fcn.10044bf0
mov dword [ebp - 0x20], 0x111
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 5
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003ed17
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003ed0d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 7
push str.BMX_III
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 6
call fcn.10044bf0
mov dword [ebp - 0x20], 0x110
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 7
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003ed98
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003ed8e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 6
push str.BMX_IV
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 8
call fcn.10044bf0
mov dword [ebp - 0x20], 0x116
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 9
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003ee19
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003ee0f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 5
push str.BMX_V
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xa
call fcn.10044bf0
mov dword [ebp - 0x20], 0x115
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0xb
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003ee9a
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003ee90
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 5
push str.Racer
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xc
call fcn.10044bf0
mov dword [ebp - 0x20], 0x11a
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0xd
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003ef1b
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003ef11
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 0xd
push str.Mountain_Bike
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xe
call fcn.10044bf0
mov dword [ebp - 0x20], 0x118
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0xf
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003ef9c
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003ef92
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 0x14
push str.Girls_Delivery_Bike
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x10
call fcn.10044bf0
mov dword [ebp - 0x20], 0x119
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x11
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f01d
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f013
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 9
push str.70s_Bike
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x12
call fcn.10044bf0
mov dword [ebp - 0x20], 0x117
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x13
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f09e
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f094
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 7
push str.Scooter
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x14
call fcn.10044bf0
mov dword [ebp - 0x20], 0x114
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x15
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f11f
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f115
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 7
push str.Go_kart
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x16
call fcn.10044bf0
mov dword [ebp - 0x20], 0x121
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x17
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f1a0
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f196
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 5
push str.Mower
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x18
call fcn.10044bf0
mov dword [ebp - 0x20], 0x11c
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x19
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f221
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f217
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 8
push str.Arcade_1
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x1a
call fcn.10044bf0
mov dword [ebp - 0x20], 0x12a
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x1b
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f2a2
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f298
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 8
push str.Arcade_2
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x1c
call fcn.10044bf0
mov dword [ebp - 0x20], 0x11f
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x1d
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f323
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f319
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 8
push str.Arcade_3
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x1e
call fcn.10044bf0
mov dword [ebp - 0x20], 0x11d
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x1f
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f3a4
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f39a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 8
push str.Cop_Bike
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x20
call fcn.10044bf0
mov dword [ebp - 0x20], 0x113
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x21
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f425
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f41b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 0xa
push str.Police_Car
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x22
call fcn.10044bf0
mov dword [ebp - 0x20], 0x127
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x23
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f4a6
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f49c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 8
push str.Taxi_Cab
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x24
call fcn.10044bf0
mov dword [ebp - 0x20], 0x11e
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x25
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f527
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f51d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 9
push str.Green_Car
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x26
call fcn.10044bf0
mov dword [ebp - 0x20], 0x125
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x27
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f5a8
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f59e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 0xe
push str.Delivery_Truck
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x28
call fcn.10044bf0
mov dword [ebp - 0x20], 0x123
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x29
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f629
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f61f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 8
push str.70_Wagon
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x2a
call fcn.10044bf0
mov dword [ebp - 0x20], 0x126
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x2b
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f6aa
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f6a0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 8
push str.Domestic
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x2c
call fcn.10044bf0
mov dword [ebp - 0x20], 0x128
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x2d
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f72b
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f721
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 7
push str.Foreign
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x2e
call fcn.10044bf0
mov dword [ebp - 0x20], 0x124
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x2f
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f7ac
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f7a2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 4
push str.Limo
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x30
call fcn.10044bf0
mov dword [ebp - 0x20], 0x122
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x31
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f82d
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f823
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 5
push str.Truck
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x32
call fcn.10044bf0
mov dword [ebp - 0x20], 0x129
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x33
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f8aa
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f8a0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f91d
push ecx
push edx
call fcn.100463fe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push 5
push str.Dozer
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0x34
call fcn.10044bf0
mov dword [ebp - 0x20], 0x120
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0x35
push eax
call fcn.10044ab0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x1003f92d
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003f923
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1003f923
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100463fe
add esp, 8
mov ecx, dword [0x100552cc]
mov esi, dword [ebp - 0x58]
push 0
mov dword [0x10055284], 0x30
lea eax, [ecx + 0x1d04c0]
mov dword [0x10055288], 3
mov dword [0x10055188], eax
lea eax, [ecx + 0x4a550]
mov dword [0x10055244], eax
lea eax, [ecx + 0x6e110]
mov dword [0x100551a0], eax
lea eax, [ecx + 0x141c30]
mov dword [0x100551c8], eax
lea eax, [ecx + 0x20ab40]
mov dword [0x100551d4], eax
mov eax, dword [sym.imp.USER32.dll_DefWindowProcA]
mov dword [0x1005528c], eax
mov dword [0x10055290], 0
mov dword [0x10055294], 0
call esi
xorps xmm0, xmm0
mov dword [0x10055298], eax
push 0x10055284
movups xmmword [0x1005529c], xmm0
mov dword [0x100552ac], 0x1004e8fc
mov dword [0x100552b0], 0
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x1003fb41
push 0
push dword [0x10055298]
push 0
push 0
push 0x64
push 0x64
push 0
push 0
push 0xcf0000
push str.Cheat_Window
push dword [0x100552ac]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x100552f8], eax
test eax, eax
jne 0x1003fa19
push str.Failed_to_create_window
jmp 0x1003fb46
push str.d3d9.dll
mov dword [ebp - 4], 0x36
call esi
test eax, eax
jne 0x1003fa32
xor al, al
jmp 0x1003fae2
push str.Direct3DCreate9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1003fa49
xor al, al
jmp 0x1003fae2
push 0x20
call eax
mov edx, eax
mov dword [0x10055278], edx
test edx, edx
jne 0x1003fa60
xor al, al
jmp 0x1003fae2
mov ecx, dword [0x100552f8]
lea esi, [ebp - 0x54]
push 0x10055280
push esi
push 0x120
push ecx
push 4
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov eax, dword [edx]
push 0
push edx
call dword [eax + 0x40]
test eax, eax
setns al
mov dword [ebp - 4], 0xffffffff
test al, al
jne 0x1003fb04
push str.Failed_to_create_device.
lea ecx, [ebp - 0x70]
call fcn.1003ce90
push 0x10052e28
lea eax, [ebp - 0x70]
jmp 0x1003fb56
mov eax, dword [0x100552f8]
test eax, eax
je 0x1003fb14
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [0x10055298]
push dword [0x100552ac]
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100462db
mov esp, ebp
pop ebp
ret
push str.Failed_to_create_window_class.
lea ecx, [ebp - 0x64]
call fcn.1003ce90
push 0x10052e28
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3