Function at 0x100350f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005955b
mov eax, dword fs:[0]
push eax
sub esp, 0x1d4
push esi
push edi
mov eax, dword [0x1006a010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 8
lea ecx, [ebp - 0x1e0]
call fcn.10009ae0
mov ecx, str.WantedLevelEditor.xml
mov dword [ebp - 4], 0
call fcn.1003bb90
push eax
lea ecx, [ebp - 0x1e0]
call fcn.10009f70
test eax, eax
jne 0x100353ab
mov esi, dword [ebp - 0x1c4]
test esi, esi
je 0x1003519f
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov edi, eax
test edi, edi
je 0x10035198
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x18]
test eax, eax
je 0x10035172
xor eax, eax
jmp 0x1003517a
lea ecx, [edi + 0xc]
call fcn.10007e00
cmp eax, str.misc
je 0x100351a1
push 0x7fffffff
push str.misc
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x100351a1
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10035157
xor edi, edi
mov esi, dword [edi + 0x1c]
test esi, esi
je 0x100351f0
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov edi, eax
test edi, edi
je 0x100351e9
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x18]
test eax, eax
je 0x100351c3
xor eax, eax
jmp 0x100351cb
lea ecx, [edi + 0xc]
call fcn.10007e00
cmp eax, str.MaxStarsLimit
je 0x100351f2
push 0x7fffffff
push str.MaxStarsLimit
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x100351f2
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x100351a8
xor edi, edi
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x1003522f
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x1003522f
mov esi, dword [edi + 0x1c]
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0x18]
test eax, eax
je 0x10035214
xor eax, eax
jmp 0x1003521c
lea ecx, [esi + 0xc]
call fcn.10007e00
push 0x1006ab48
push 0x10062d84
push eax
call fcn.100078f0
add esp, 0xc
mov edx, str.StarsOnHud
mov ecx, 0x1006ad80
call fcn.10037de0
test al, al
je 0x100353a1
movzx eax, byte [0x100ec940]
push eax
mov eax, 0x580750
call eax
add esp, 4
mov ecx, 0x1006ad80
push 0xa
push str.StarsOnHud
call fcn.10037420
mov eax, dword [0x1025c244]
test al, 1
jne 0x1003529d
or eax, 1
mov dword [0x1025b6cc], 0x1006353c
mov dword [0x1025c244], eax
mov dword [0x1025b6d4], 0
mov dword [0x1025b6d0], 0
call fcn.1000c4c0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
push eax
push 0x40
mov esi, 0x582029
mov dword [ebp - 0x1c], 4
push 4
push esi
mov dword [ebp - 0x20], esi
call edi
test eax, eax
setne byte [ebp - 0x14]
mov dword [esi], 1
cmp byte [ebp - 0x14], 0
je 0x100352e2
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x20]
call edi
push 0
push 1
push 1
push 1
sub esp, 0xc
mov eax, 0x582300
mov dword [esp + 8], 0x42480000
mov dword [esp + 4], 0x432a0000
mov dword [esp], 0x41e80000
push str.DUMMY
push 0
call eax
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
movzx eax, al
push 0x1006523c
push 0
mov dword [0x100ec940], eax
push eax
mov eax, 0x581e00
call eax
movzx eax, byte [0x100ec940]
add esp, 0x60
push 0x96
push 0
push eax
mov eax, 0x582050
call eax
movzx eax, byte [0x100ec940]
push 0xffffffffffffffff
push dword [0x1006ab48]
push str.NUMBER
push 0
push 0
push eax
mov eax, 0x581d70
call eax
add esp, 0x24
mov eax, dword [0xb7cb84]
mov dword [0x1025b6c8], eax
lea ecx, [ebp - 0x1e0]
call fcn.10009d40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret