Function at 0x10001850
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1001e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push str.RegistryPath
push esi
mov edi, edx
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001980
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001886
sub ecx, edx
cmp ecx, 1
jb 0x10001953
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100018a0
sub ecx, edx
cmp ecx, 0x15
ja 0x10001953
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x100018b7
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
sub esi, ecx
mov dword [ebp - 8], 0x20
push 0x40
inc esi
push esi
push 0x50ddfd
call edi
push esi
push ebx
push 0x50ddfd
call fcn.10003730
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push 0x50ddfd
call edi
mov esi, ebx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x10001900
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x20
push eax
sub esi, ecx
push 0x40
inc esi
push esi
push 0x509eb8
call edi
push esi
push ebx
push 0x509eb8
call fcn.10003730
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push 0x509eb8
call edi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002223
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push str.Invalid_value_length_n__s__s_s_nValid_length_1_21
push 0x200
push 0x1001f2a0
call fcn.10001010
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002223
mov esp, ebp
pop ebp
ret
push str.GameVersionString
push esi
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001a1a
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100019a0
sub ecx, edx
cmp ecx, 7
ja 0x10001a0c
mov edi, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x100019b3
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
sub edi, ecx
mov dword [ebp - 8], 0x20
push 0x40
inc edi
push edi
push 0x5031b4
call esi
push edi
push ebx
push 0x5031b4
call fcn.10003730
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 0x5031b4
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002223
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push ebx
push str.Value_too_long____s_n__s__s_s_nValid_length_0_7
jmp 0x10001f8b
push str.MultiplayerVersionMajor
push esi
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001ad6
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001a35
sub ecx, edx
cmp ecx, 2
ja 0x10001b8a
movsx eax, byte [ebx]
push eax
call fcn.10005640
add esp, 4
test eax, eax
je 0x10001b8a
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001a60
sub ecx, edx
cmp ecx, 1
je 0x10001a83
movsx eax, byte [ebx + 1]
push eax
call fcn.10005640
add esp, 4
test eax, eax
je 0x10001b8a
push ebx
call fcn.10005e38
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov bl, al
mov dword [ebp - 8], 0x20
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x49e9c0
call esi
lea eax, [ebp - 8]
mov byte [0x49e9c0], bl
push eax
push dword [ebp - 8]
push 1
push 0x49e9c0
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002223
mov esp, ebp
pop ebp
ret
push str.MultiplayerVersionMinor
push esi
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001b98
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001af1
sub ecx, edx
cmp ecx, 2
ja 0x10001b8a
movsx eax, byte [ebx]
push eax
call fcn.10005640
add esp, 4
test eax, eax
je 0x10001b8a
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001b18
sub ecx, edx
cmp ecx, 1
je 0x10001b37
movsx eax, byte [ebx + 1]
push eax
call fcn.10005640
add esp, 4
test eax, eax
je 0x10001b8a
push ebx
call fcn.10005e38
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov bl, al
mov dword [ebp - 8], 0x20
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x49e9c9
call esi
lea eax, [ebp - 8]
mov byte [0x49e9c9], bl
push eax
push dword [ebp - 8]
push 1
push 0x49e9c9
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002223
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push ebx
push str.Invalid_value____s_n__s__s_s_nValid_values__0_99
jmp 0x10001f8b
push str.CommanderOrdersNotReset
push esi
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001c63
push 0x1001c018
push ebx
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001c37
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x20
lea esi, [eax + 0x6fb4]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
lea eax, [ebp - 8]
mov byte [esi], 0xeb
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
push 0
call edi
mov dword [ebp - 8], 0x20
lea esi, [eax + 0x6fb5]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
lea eax, [ebp - 8]
mov byte [esi], 0x40
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002223
mov esp, ebp
pop ebp
ret
push 0x1001c01c
push ebx
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001f77
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002223
mov esp, ebp
pop ebp
ret
push str.ChangePathfindingSearch
push esi
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001d2d
push 0x1001c018
push ebx
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001c37
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x20
lea esi, [eax + 0xead6]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
lea eax, [ebp - 8]
mov byte [esi], 0x5a
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
push 0
call edi
mov dword [ebp - 8], 0x20
lea esi, [eax + 0xead7]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
lea eax, [ebp - 8]
mov byte [esi], 4
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
push 0
call edi
lea esi, [eax + 0xead8]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x20
push eax
push 0x40
push 1
push esi
call ebx
mov byte [esi], 1
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002223
mov esp, ebp
pop ebp
ret
push str.DirectxPopupElimination
push esi
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001d9a
push 0x1001c018
push ebx
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001c37
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x20
lea esi, [eax + 0x266a5]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
lea eax, [ebp - 8]
mov byte [esi], 0xb0
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
push 0
call edi
lea esi, [eax + 0x266a6]
jmp 0x10001cf6
push str.CursorReclaim
push esi
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001e1c
push 0x1001c018
push ebx
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001c37
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x20
lea esi, [eax + 0x3e786]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
lea eax, [ebp - 8]
mov byte [esi], 0
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
push 0
call edi
mov dword [ebp - 8], 0x20
lea esi, [eax + 0x3e787]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
mov byte [esi], 0
jmp 0x10001d0b
push str.DisableKeyLastCommandRepeat
push esi
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001e8e
push 0x1001c018
push ebx
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001c37
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x20
lea edi, [eax + 0x966e7]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x27
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002223
mov esp, ebp
pop ebp
ret
push str.EnableF10Debug
push esi
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001f10
push 0x1001c018
push ebx
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001c37
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x20
lea esi, [eax + 0x96776]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
lea eax, [ebp - 8]
mov byte [esi], 0x24
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
push 0
call edi
mov dword [ebp - 8], 0x20
lea esi, [eax + 0x96779]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
mov byte [esi], 0xd
jmp 0x10001d0b
push str.IncreaseAtmToFillResources
push esi
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001f82
push 0x1001c018
push ebx
call fcn.1000a710
add esp, 8
test eax, eax
jne 0x10001f61
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x20
lea edi, [eax + 0xfcc7f]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xd4
jmp 0x10001e6c
push 0x1001c01c
push ebx
call fcn.1000a710
add esp, 8
test eax, eax
je 0x10001e78
push ebx
push esi
push edi
push ebx
push str.Invalid_value____s_n__s__s_s_nValid_values__Yes_and_No
jmp 0x10001f8b
push ebx
push esi
push edi
push esi
push str.Unknown_setting____s_n__s__s_s
push 0x200
push 0x1001f2a0
call fcn.10001010
mov ecx, dword [ebp - 4]
add esp, 0x1c
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.10002223
mov esp, ebp
pop ebp
ret