Function at 0x100402e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005646d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x10069040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x1006ef20], 0
je 0x10040bb0
push 0xf
xor edx, edx
mov ecx, str.Environment
call fcn.1000c090
mov al, byte [0x1006ef1c]
add esp, 4
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [0x1006ee94]
push eax
push ecx
mov ecx, str.PAUSE_GAME
call fcn.10050cf0
add esp, 0x14
test al, al
je 0x100403a6
cmp byte [0x1006ef1b], 0
jne 0x1004038e
cmp byte [0x1006ef1c], 0
sete al
mov byte [0x1006ef1c], al
test al, al
je 0x1004038e
mov al, 1
jmp 0x10040390
xor al, al
mov byte [ebp - 0x18], al
mov eax, dword [0x1006ef68]
add eax, 0x3b7c50
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
call dword [ebp - 0x1c]
mov al, byte [0x1006ef1d]
mov dword [ebp - 0x30], 0
push dword [ebp - 0x30]
mov dword [ebp - 0x34], 0
push dword [ebp - 0x34]
push dword [0x1006ee94]
push eax
push ecx
mov ecx, str.IO_VISUALIZATION
call fcn.10050cf0
add esp, 0x14
test al, al
je 0x10040485
mov ecx, dword [0x1006ef68]
lea edx, [ebp - 0x1c]
cmp byte [0x1006ef1d], 0
push ecx
sete al
mov dword [ebp - 0x1c], 0
mov byte [0x1006ef1d], al
lea esi, [ecx + 0xff0f84]
mov byte [ebp - 0x18], al
lea eax, [ecx + 0x3f5bd0]
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x18]
push eax
push edx
call fcn.10042460
mov edi, dword [ebp - 0x4c]
xor ecx, ecx
mov edx, dword [ebp - 0x50]
sub edi, edx
sar edi, 2
test edi, edi
je 0x1004043c
nop dword [eax]
mov eax, dword [edx + ecx*4]
inc ecx
add eax, dword [esi]
mov esi, eax
cmp ecx, edi
jb 0x10040430
test edx, edx
je 0x10040479
mov eax, dword [ebp - 0x48]
sub eax, edx
sar eax, 2
lea ecx, [eax*4]
mov eax, edx
cmp ecx, 0x1000
jb 0x1004046f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1004046f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10054b4d
add esp, 8
mov dword [ebp - 0x1c], esi
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
call dword [ebp - 0x30]
push ecx
mov edx, 0x1006efdc
mov ecx, str.TIME_SCALE
call fcn.10051b40
add esp, 4
test al, al
je 0x100404bc
mov eax, dword [0x1006ef68]
movss xmm0, dword [0x1006e130]
add eax, 0x3b7ca0
movss dword [ebp - 0x30], xmm0
mov dword [ebp - 0x18], eax
push dword [ebp - 0x30]
call dword [ebp - 0x18]
movss xmm1, dword [0x1006307c]
xorps xmm0, xmm0
call fcn.1000fe20
push 0
push 0
sub esp, 8
mov edx, 8
mov ecx, 0x1005f46c
push 0x1006e130
call fcn.1002b460
add esp, 0x10
mov edx, 0x1006efdc
mov ecx, str.TIME_OF_DAY
call fcn.10051b40
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
test al, al
je 0x10040614
mov al, byte [0x1006ee6f]
lea ecx, [ebp - 0x18]
mov edi, dword [0x1006ef68]
lea edx, [ebp - 0x1c]
mov byte [ebp - 0x21], al
add edi, 0x1126570
mov al, byte [0x1006ef08]
push ecx
push ecx
mov byte [ebp - 0x3a], al
lea ecx, [ebp - 0x38]
mov al, byte [0x1006ef09]
push edx
mov byte [ebp - 0x39], al
mov dword [ebp - 0x1c], 0
call fcn.10042460
mov esi, dword [ebp - 0x34]
xor ecx, ecx
mov edx, dword [ebp - 0x38]
sub esi, edx
sar esi, 2
test esi, esi
je 0x10040563
mov eax, dword [edx + ecx*4]
inc ecx
add eax, dword [edi]
mov edi, eax
cmp ecx, esi
jb 0x10040557
test edx, edx
je 0x100405b5
mov eax, dword [ebp - 0x30]
sub eax, edx
sar eax, 2
lea ecx, [eax*4]
mov eax, edx
cmp ecx, 0x1000
jb 0x10040596
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10040596
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10054b4d
add esp, 8
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
movzx eax, byte [ebp - 0x39]
mov ecx, eax
shl ecx, 4
sub ecx, eax
movzx eax, byte [ebp - 0x3a]
lea eax, [eax + ecx*4]
mov ecx, eax
shl ecx, 4
sub ecx, eax
movzx eax, byte [ebp - 0x21]
lea esi, [eax + ecx*4]
cmp esi, 0x15180
ja 0x1004060e
lea eax, [ebp - 0x18]
add edi, 0x288
push eax
push 0x40
push 4
push edi
add esi, 0x1502e80
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
mov dword [edi], esi
push eax
push dword [ebp - 0x18]
push 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
jmp 0x10040614
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x1006ee70]
mov edx, 1
push 0
push str._02d
sub esp, 8
mov ecx, 0x1006250c
or dword [eax + 0x1aa4], 1
mov dword [eax + 0x1aa8], 0x41c80000
push 0x1006ef09
call fcn.1002b460
add esp, 0x14
xorps xmm0, xmm0
xorps xmm1, xmm1
call fcn.1000fe20
push 0x1006277c
call fcn.10027570
add esp, 4
xorps xmm0, xmm0
xorps xmm1, xmm1
call fcn.1000fe20
mov eax, dword [0x1006ee70]
mov edx, 1
push 0
push str._02d
sub esp, 8
mov ecx, 0x10062744
or dword [eax + 0x1aa4], 1
mov dword [eax + 0x1aa8], 0x41c80000
push 0x1006ef08
call fcn.1002b460
add esp, 0x14
xorps xmm0, xmm0
xorps xmm1, xmm1
call fcn.1000fe20
push 0x1006277c
call fcn.10027570
add esp, 4
xorps xmm0, xmm0
xorps xmm1, xmm1
call fcn.1000fe20
mov eax, dword [0x1006ee70]
mov edx, 1
push 0
push str._02d
sub esp, 8
mov ecx, 0x10062760
or dword [eax + 0x1aa4], 1
mov dword [eax + 0x1aa8], 0x41c80000
push 0x1006ee6f
call fcn.1002b460
add esp, 0x14
cmp byte [0x1006ee6f], 0x3b
jbe 0x1004070f
mov byte [0x1006ee6f], 0x3b
cmp byte [0x1006ef08], 0x3b
jbe 0x1004071f
mov byte [0x1006ef08], 0x3b
cmp byte [0x1006ef09], 0x17
jbe 0x1004072f
mov byte [0x1006ef09], 0x17
push ecx
mov edx, 0x1006efdc
mov ecx, str.DRAW_MODE
call fcn.10051b40
add esp, 4
test al, al
je 0x1004080a
mov al, byte [0x1006eef0]
lea ecx, [ebp - 0x14]
mov esi, dword [0x1006ef68]
lea edx, [ebp - 0x18]
push ecx
push ecx
push edx
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x21], al
mov dword [ebp - 0x18], 0
add esi, 0x1126720
call fcn.10042460
mov edi, dword [ebp - 0x34]
xor ecx, ecx
mov edx, dword [ebp - 0x38]
sub edi, edx
sar edi, 2
test edi, edi
je 0x10040793
mov eax, dword [edx + ecx*4]
inc ecx
add eax, dword [esi]
mov esi, eax
cmp ecx, edi
jb 0x10040787
test edx, edx
je 0x100407e5
mov eax, dword [ebp - 0x30]
sub eax, edx
sar eax, 2
lea ecx, [eax*4]
mov eax, edx
cmp ecx, 0x1000
jb 0x100407c6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100407c6
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10054b4d
add esp, 8
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 1
add esi, 0x2c
push esi
call edi
mov al, byte [ebp - 0x21]
mov byte [esi], al
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 1
push esi
call edi
movss xmm1, dword [0x1006307c]
xorps xmm0, xmm0
call fcn.1000fe20
mov esi, dword [0x1006eef0]
lea ecx, [ebp - 0x50]
push 0x1006f02c
call fcn.10042280
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
je 0x10040869
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jae 0x10040869
mov ecx, dword [ebp - 0x50]
lea eax, [esi + esi*2]
cmp dword [ecx + eax*8 + 0x14], 0xf
lea edx, [ecx + eax*8]
jbe 0x1004086e
mov edx, dword [edx]
jmp 0x1004086e
mov edx, 0x1005f46c
push 0x24
mov ecx, str.DrawTypes
call fcn.10029770
add esp, 4
mov byte [ebp - 0x21], al
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.10042530
cmp byte [ebp - 0x21], 0
je 0x100408b6
sub esp, 0xc
mov ecx, esp
push 0x1006f02c
call fcn.10042280
mov ecx, 0x1006eef0
call fcn.10050c10
add esp, 0xc
call fcn.10010f20
mov al, byte [0x1006ef15]
mov dword [ebp - 0x30], 0
push dword [ebp - 0x30]
mov dword [ebp - 0x34], 0
push dword [ebp - 0x34]
push dword [0x1006ee94]
push eax
push ecx
mov ecx, str.ENABLE_RAIN
call fcn.10050cf0
add esp, 0x14
test al, al
je 0x100409b7
mov al, byte [0x1006ef14]
test al, al
je 0x100408fc
sete byte [0x1006ef14]
cmp byte [0x1006ef15], 0
sete cl
sub esp, 0x60
mov byte [0x1006ef15], cl
mov dword [esp + 0x5c], 0xbf800000
mov dword [esp + 0x58], 0xbf800000
mov dword [esp + 0x54], 0xbf800000
mov dword [esp + 0x50], 0xbf800000
mov dword [esp + 0x4c], 0xbf800000
mov dword [esp + 0x48], 0xbf800000
mov dword [esp + 0x44], 0xbf800000
mov dword [esp + 0x40], 0xbf800000
mov dword [esp + 0x3c], 0xbf800000
mov dword [esp + 0x38], 0x3d4ccccd
mov dword [esp + 0x34], 0x40000000
mov dword [esp + 0x30], 0xbf800000
mov dword [esp + 0x2c], 0x40000000
mov dword [esp + 0x28], 0x41f00000
mov dword [esp + 0x24], 0x41a00000
mov dword [esp + 0x20], 0xbf800000
mov dword [esp + 0x1c], 0xbf800000
mov dword [esp + 0x18], 0x3c4ccccd
mov dword [esp + 0x14], 0x3e4ccccd
mov dword [esp + 0x10], 0x41200000
call fcn.100455f0
add esp, 0x60
mov al, byte [0x1006ef14]
mov dword [ebp - 0x30], 0
push dword [ebp - 0x30]
mov dword [ebp - 0x34], 0
push dword [ebp - 0x34]
push dword [0x1006ee94]
push eax
push ecx
mov ecx, str.ENABLE_SNOW
call fcn.10050cf0
add esp, 0x14
test al, al
je 0x10040ab8
mov al, byte [0x1006ef15]
test al, al
je 0x100409fd
sete byte [0x1006ef15]
cmp byte [0x1006ef14], 0
sete cl
sub esp, 0x60
mov byte [0x1006ef14], cl
mov dword [esp + 0x5c], 0xbf800000
mov dword [esp + 0x58], 0xbf800000
mov dword [esp + 0x54], 0xbf800000
mov dword [esp + 0x50], 0xbf800000
mov dword [esp + 0x4c], 0xbf800000
mov dword [esp + 0x48], 0xbf800000
mov dword [esp + 0x44], 0xbf800000
mov dword [esp + 0x40], 0xbf800000
mov dword [esp + 0x3c], 0xbf800000
mov dword [esp + 0x38], 0x3e99999a
mov dword [esp + 0x34], 0x40000000
mov dword [esp + 0x30], 0xbf800000
mov dword [esp + 0x2c], 0x40000000
mov dword [esp + 0x28], 0x41f00000
mov dword [esp + 0x24], 0x41a00000
mov dword [esp + 0x20], 0xbf800000
mov dword [esp + 0x1c], 0xbf800000
mov dword [esp + 0x18], 0x3da3d70a
mov dword [esp + 0x14], 0xbe4ccccd
mov dword [esp + 0x10], 0x3fc00000
call fcn.100455f0
add esp, 0x60
mov al, byte [0x1006ef0d]
mov dword [ebp - 0x30], 0
push dword [ebp - 0x30]
mov dword [ebp - 0x34], 0
push dword [ebp - 0x34]
push dword [0x1006ee94]
push eax
push ecx
mov ecx, str.DISABLE_FAILURE
call fcn.10050cf0
add esp, 0x14
test al, al
je 0x10040b3e
cmp byte [0x1006ef0d], 0
mov esi, dword [0x1006ef8c]
sete al
mov byte [0x1006ef0d], al
test al, al
je 0x10040b1f
lea eax, [ebp - 0x18]
push eax
push 0x40
push 2
push esi
call edi
mov eax, 0x28eb
mov word [esi], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
jmp 0x10040b39
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push esi
call edi
mov eax, 0x2875
mov word [esi], ax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push esi
call edi
mov al, byte [0x1006929c]
mov dword [ebp - 0x30], 0
push dword [ebp - 0x30]
mov dword [ebp - 0x34], 0
push dword [ebp - 0x34]
push dword [0x1006ee94]
push eax
push ecx
mov ecx, str.NPC_AIMING_BLOCKER
call fcn.10050cf0
add esp, 0x14
test al, al
je 0x10040b8d
cmp byte [0x1006929c], 0
sete al
mov byte [0x1006929c], al
movzx ecx, al
mov eax, dword [0x1006ef94]
mov dword [eax + 0x3a9], ecx
push ecx
mov edx, 0x1006efdc
mov ecx, str.SAVE_GAME
call fcn.10051b40
add esp, 4
test al, al
je 0x10040bab
mov byte [0x1006ef0f], 1
call fcn.1000e990
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005465b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret