Function at 0x10001920
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1001a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push str.RegistryPath
push esi
mov edi, edx
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001a50
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001956
sub ecx, edx
cmp ecx, 1
jb 0x10001a23
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001970
sub ecx, edx
cmp ecx, 0x15
ja 0x10001a23
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10001987
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
sub esi, ecx
mov dword [ebp - 8], 0x20
push 0x40
inc esi
push esi
push 0x50ddfd
call edi
push esi
push ebx
push 0x50ddfd
call fcn.100035f0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push 0x50ddfd
call edi
mov esi, ebx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x100019d0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x20
push eax
sub esi, ecx
push 0x40
inc esi
push esi
push 0x509eb8
call edi
push esi
push ebx
push 0x509eb8
call fcn.100035f0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push 0x509eb8
call edi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100020de
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push str.Invalid_value_length_n__s__s_s_nValid_length_1_21
push 0x200
push 0x1001b2a0
call fcn.10001010
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100020de
mov esp, ebp
pop ebp
ret
push str.GameVersionString
push esi
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001aea
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001a70
sub ecx, edx
cmp ecx, 7
ja 0x10001adc
mov edi, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x10001a83
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
sub edi, ecx
mov dword [ebp - 8], 0x20
push 0x40
inc edi
push edi
push 0x5031b4
call esi
push edi
push ebx
push 0x5031b4
call fcn.100035f0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 0x5031b4
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100020de
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push ebx
push str.Value_too_long____s_n__s__s_s_nValid_length_0_7
jmp 0x1000205b
push str.MultiplayerVersionMajor
push esi
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001ba6
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001b05
sub ecx, edx
cmp ecx, 2
ja 0x10001c5a
movsx eax, byte [ebx]
push eax
call fcn.10005500
add esp, 4
test eax, eax
je 0x10001c5a
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001b30
sub ecx, edx
cmp ecx, 1
je 0x10001b53
movsx eax, byte [ebx + 1]
push eax
call fcn.10005500
add esp, 4
test eax, eax
je 0x10001c5a
push ebx
call fcn.1000590b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov bl, al
mov dword [ebp - 8], 0x20
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x49e9c0
call esi
lea eax, [ebp - 8]
mov byte [0x49e9c0], bl
push eax
push dword [ebp - 8]
push 1
push 0x49e9c0
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100020de
mov esp, ebp
pop ebp
ret
push str.MultiplayerVersionMinor
push esi
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001c68
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001bc1
sub ecx, edx
cmp ecx, 2
ja 0x10001c5a
movsx eax, byte [ebx]
push eax
call fcn.10005500
add esp, 4
test eax, eax
je 0x10001c5a
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001be8
sub ecx, edx
cmp ecx, 1
je 0x10001c07
movsx eax, byte [ebx + 1]
push eax
call fcn.10005500
add esp, 4
test eax, eax
je 0x10001c5a
push ebx
call fcn.1000590b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov bl, al
mov dword [ebp - 8], 0x20
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x49e9c9
call esi
lea eax, [ebp - 8]
mov byte [0x49e9c9], bl
push eax
push dword [ebp - 8]
push 1
push 0x49e9c9
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100020de
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push ebx
push str.Invalid_value____s_n__s__s_s_nValid_values__0_99
jmp 0x1000205b
push str.CommanderOrdersNotReset
push esi
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001d33
push 0x10017ec0
push ebx
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001d07
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x20
lea esi, [eax + 0x6fb4]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
lea eax, [ebp - 8]
mov byte [esi], 0xeb
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
push 0
call edi
mov dword [ebp - 8], 0x20
lea esi, [eax + 0x6fb5]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
lea eax, [ebp - 8]
mov byte [esi], 0x40
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100020de
mov esp, ebp
pop ebp
ret
push 0x10017ec4
push ebx
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10002047
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100020de
mov esp, ebp
pop ebp
ret
push str.ChangePathfindingSearch
push esi
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001dfd
push 0x10017ec0
push ebx
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001d07
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x20
lea esi, [eax + 0xead6]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
lea eax, [ebp - 8]
mov byte [esi], 0x5a
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
push 0
call edi
mov dword [ebp - 8], 0x20
lea esi, [eax + 0xead7]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
lea eax, [ebp - 8]
mov byte [esi], 4
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
push 0
call edi
lea esi, [eax + 0xead8]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x20
push eax
push 0x40
push 1
push esi
call ebx
mov byte [esi], 1
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100020de
mov esp, ebp
pop ebp
ret
push str.DirectxPopupElimination
push esi
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001e6a
push 0x10017ec0
push ebx
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001d07
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x20
lea esi, [eax + 0x266a5]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
lea eax, [ebp - 8]
mov byte [esi], 0xb0
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
push 0
call edi
lea esi, [eax + 0x266a6]
jmp 0x10001dc6
push str.CursorReclaim
push esi
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001eec
push 0x10017ec0
push ebx
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001d07
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x20
lea esi, [eax + 0x3e786]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
lea eax, [ebp - 8]
mov byte [esi], 0
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
push 0
call edi
mov dword [ebp - 8], 0x20
lea esi, [eax + 0x3e787]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
mov byte [esi], 0
jmp 0x10001ddb
push str.DisableKeyLastCommandRepeat
push esi
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001f5e
push 0x10017ec0
push ebx
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001d07
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x20
lea edi, [eax + 0x966e7]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x27
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100020de
mov esp, ebp
pop ebp
ret
push str.EnableF10Debug
push esi
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001fe0
push 0x10017ec0
push ebx
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10001d07
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x20
lea esi, [eax + 0x96776]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
lea eax, [ebp - 8]
mov byte [esi], 0x24
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
push 0
call edi
mov dword [ebp - 8], 0x20
lea esi, [eax + 0x96779]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
mov byte [esi], 0xd
jmp 0x10001ddb
push str.IncreaseAtmToFillResources
push esi
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10002052
push 0x10017ec0
push ebx
call fcn.10005967
add esp, 8
test eax, eax
jne 0x10002031
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x20
lea edi, [eax + 0xfcc7f]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xd4
jmp 0x10001f3c
push 0x10017ec4
push ebx
call fcn.10005967
add esp, 8
test eax, eax
je 0x10001f48
push ebx
push esi
push edi
push ebx
push str.Invalid_value____s_n__s__s_s_nValid_values__Yes_and_No
jmp 0x1000205b
push ebx
push esi
push edi
push esi
push str.Unknown_setting____s_n__s__s_s
push 0x200
push 0x1001b2a0
call fcn.10001010
mov ecx, dword [ebp - 4]
add esp, 0x1c
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.100020de
mov esp, ebp
pop ebp
ret