Function at 0x541850
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
mov eax, dword [0x68225c]
push ebx
push ebp
push esi
mov esi, dword [eax + 0x1ae460]
lea ebx, [eax + 0x207910]
mov ebp, dword [eax + 0x1ae4b0]
push edi
mov edi, ecx
mov dword [esp + 0x18], esi
mov ecx, dword [eax + 0x1ae474]
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x541d47
test ebp, ebp
je 0x541d47
test esi, esi
je 0x541d47
imul eax, dword [0x66b030], 0xe2c
push 0
push dword [eax + 0x66be50]
call fcn.0043c8d0
lea eax, [edi + 0x94]
push eax
push str.P1invincible_p1
call fcn.00431e50
add esp, 8
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.004181d0
lea eax, [edi + 0x95]
push eax
push str.P2invincible_p2
call fcn.00431e50
imul eax, dword [0x66b030], 0xe2c
push 0
push dword [eax + 0x66be20]
call fcn.0043c8d0
push 0
push 0x5cbf5c
push dword [ebx + 0x54]
lea eax, [ebx + 0x50]
push 1
push eax
push str.P1lives_p1
call fcn.00439a40
add esp, 0x30
test al, al
je 0x54192d
mov eax, dword [0x68225c]
lea ecx, [esi + 0x10]
add eax, 0x101e90
call eax
sub esp, 8
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.004181d0
lea esi, [edi + 0x96]
push esi
call fcn.00415590
imul eax, dword [0x66b030], 0xe2c
push esi
push dword [eax + 0x66b260]
call fcn.00431e50
call fcn.00415260
push 0
push 0x5cbf5c
push dword [ebx + 0x114]
lea eax, [ebx + 0x110]
push 1
push eax
push str.P2lives_p2
call fcn.00439a40
add esp, 0x2c
test al, al
je 0x5419a5
mov eax, dword [0x68225c]
mov ecx, dword [esp + 0x18]
add eax, 0x101e90
add ecx, 0x7c
call eax
sub esp, 8
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.004181d0
lea esi, [edi + 0x97]
push esi
call fcn.00415590
imul eax, dword [0x66b030], 0xe2c
push esi
push dword [eax + 0x66b260]
call fcn.00431e50
call fcn.00415260
imul eax, dword [0x66b030], 0xe2c
push 0
push dword [eax + 0x66b258]
call fcn.0043c8d0
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0
push eax
push str.P1instant_death_p1
mov dword [esp + 0x40], 0
call fcn.00431560
mov esi, dword [esp + 0x38]
add esp, 0x24
test al, al
je 0x541a32
mov dword [ebx + 0x50], 0
mov dword [esi + 0x10], 4
sub esp, 8
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.004181d0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push str.P2instant_death_p2
mov dword [esp + 0x2c], 0
call fcn.00431560
add esp, 0x10
test al, al
je 0x541a80
mov dword [ebx + 0x110], 0
mov dword [ebp + 0x10], 4
sub esp, 8
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.004181d0
imul eax, dword [0x66b030], 0xe2c
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
push dword [eax + 0x66b24c]
call fcn.00431560
add esp, 0x10
test al, al
je 0x541ae7
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x110], 0
mov dword [esi + 0x10], 4
mov dword [ebp + 0x10], 4
imul eax, dword [0x66b030], 0xe2c
push 0
push dword [eax + 0x66b250]
call fcn.0043c8d0
add esp, 8
lea eax, [edi + 0x78]
lea ecx, [esp + 0x13]
push eax
push str.P1:__d
lea eax, [edi + 0x75]
push eax
push ebx
call fcn.005413a0
lea eax, [edi + 0x7c]
push eax
push str.P2:__d
lea eax, [edi + 0x76]
push eax
lea esi, [ebx + 0xc0]
push esi
lea ecx, [esp + 0x23]
call fcn.005413a0
imul eax, dword [0x66b030], 0xe2c
push 0
push dword [eax + 0x66b910]
call fcn.0043c8d0
add esp, 8
lea eax, [edi + 0x81]
lea ecx, [esp + 0x13]
push eax
lea eax, [edi + 0x80]
push eax
lea eax, [edi + 0x88]
push eax
lea eax, [edi + 0x84]
push eax
push ebx
call fcn.00541580
imul eax, dword [0x66b030], 0xe2c
push 0
push dword [eax + 0x66b914]
call fcn.0043c8d0
add esp, 8
lea eax, [edi + 0x83]
lea ecx, [esp + 0x13]
push eax
lea eax, [edi + 0x82]
push eax
lea eax, [edi + 0x90]
push eax
lea eax, [edi + 0x8c]
push eax
push esi
call fcn.00541580
imul eax, dword [0x66b030], 0xe2c
push 0
push dword [eax + 0x66b254]
call fcn.0043c8d0
add esp, 8
lea eax, [edi + 0x98]
lea ecx, [esp + 0x13]
push eax
mov eax, dword [0x68225c]
push 0x5e571c
add eax, 0x1ae4a4
push eax
call fcn.005416d0
lea eax, [edi + 0x99]
push eax
mov eax, dword [0x68225c]
lea ecx, [esp + 0x17]
push 0x5e5734
add eax, 0x1ae4e0
push eax
call fcn.005416d0
imul eax, dword [0x66b030], 0xe2c
push 0
push dword [eax + 0x66b90c]
call fcn.0043c8d0
add esp, 8
push str.P1p1_barrier
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x17]
add eax, 0x18
push eax
call fcn.00541730
sub esp, 8
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.004181d0
add esp, 8
lea eax, [ebp + 0x18]
lea ecx, [esp + 0x13]
push str.P2p2_barrier
push eax
call fcn.00541730
imul eax, dword [0x66b030], 0xe2c
push 0
push dword [eax + 0x66b268]
call fcn.0043c8d0
lea ebp, [edi + 0xa0]
add esp, 8
cmp byte [ebp], 0
lea ecx, [edi + 0x9c]
jne 0x541ca3
mov eax, dword [ebx + 0x180]
mov dword [edi + 0x9c], eax
imul eax, dword [0x66b030], 0xe2c
push 0
push dword [eax + 0x66b918]
push 7
push 0
push ecx
push str.rank
call fcn.00439a40
add esp, 0x10
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.004181d0
push ebp
call fcn.00415590
imul eax, dword [0x66b030], 0xe2c
push ebp
push dword [eax + 0x66b260]
call fcn.00431e50
call fcn.00415260
mov eax, dword [edi + 0x9c]
lea esi, [edi + 0xa1]
mov dword [ebx + 0x180], eax
imul eax, dword [0x66b030], 0xe2c
push esi
push dword [eax + 0x66b91c]
call fcn.00431e50
add esp, 0x1c
test al, al
je 0x541d47
cmp byte [esi], 0
lea ecx, [edi + 0x5c]
pop edi
pop esi
pop ebp
pop ebx
je 0x541d3f
add esp, 0x10
jmp fcn.0045ae60
add esp, 0x10
jmp fcn.0045adb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret