Function at 0x100215e0
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp dword [0x7b02758], 0x93
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
jne 0x10022262
mov eax, 0x3f
call fcn.1000fff0
test al, al
je 0x10021641
xor eax, eax
cmp dword [0x101e496c], eax
sete al
mov dword [0x101e496c], eax
test eax, eax
mov eax, 0x1003cb64
jne 0x1002162b
mov eax, 0x1003c468
push str.._config.ini
push eax
push str.DisableShadow
push str.Custom
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, 0x40
call fcn.1000fff0
test al, al
je 0x100216c4
xor eax, eax
cmp dword [0x101e4970], eax
sete al
mov dword [0x101e4970], eax
test eax, eax
mov eax, 0x1003cb64
jne 0x1002166d
mov eax, 0x1003c468
push str.._config.ini
push eax
push str.DisabledObject
push str.Custom
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ebx, dword [0x101e4970]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x10]
push eax
neg ebx
push 0x40
sbb bl, bl
push 1
and bl, 0x6e
push 0x614dba
add bl, 0x55
call esi
lea ecx, [esp + 0x10]
push ecx
mov byte [0x614dba], bl
mov edx, dword [esp + 0x14]
push edx
push 1
push 0x614dba
call esi
jmp 0x100216ca
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x41
call fcn.1000fff0
test al, al
je 0x10021748
xor eax, eax
cmp dword [0x101e4978], eax
sete al
mov dword [0x101e4978], eax
test eax, eax
mov eax, 0x1003cb64
jne 0x100216f6
mov eax, 0x1003c468
push str.._config.ini
push eax
push str.DisabledSkill
push str.Custom
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ebx, dword [0x101e4978]
lea eax, [esp + 0x10]
push eax
neg ebx
push 0x40
sbb bl, bl
push 1
and bl, 0xd
push 0x510e56
add bl, 2
call esi
lea ecx, [esp + 0x10]
push ecx
mov byte [0x510e56], bl
mov edx, dword [esp + 0x14]
push edx
push 1
push 0x510e56
call esi
mov edi, dword [ebp + 8]
mov eax, 0x42
call fcn.1000fff0
test al, al
je 0x100217c0
xor eax, eax
cmp dword [0x101e497c], eax
sete al
mov dword [0x101e497c], eax
test eax, eax
mov eax, 0x1003cb64
jne 0x10021774
mov eax, 0x1003c468
push str.._config.ini
push eax
push str.DisabledStaticEffect
push str.Custom
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [0x101e497c], 0
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x6ee8c3
sete bl
call esi
lea ecx, [esp + 0x10]
push ecx
mov byte [0x6ee8c3], bl
mov edx, dword [esp + 0x14]
push edx
push 1
push 0x6ee8c3
call esi
mov edi, dword [ebp + 8]
mov eax, 0x43
call fcn.1000fff0
test al, al
je 0x10021838
xor eax, eax
cmp dword [0x101e4980], eax
sete al
mov dword [0x101e4980], eax
test eax, eax
mov eax, 0x1003cb64
jne 0x100217ec
mov eax, 0x1003c468
push str.._config.ini
push eax
push str.DisabledDinamicEffect
push str.Custom
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [0x101e4980], 0
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x6daa0c
sete bl
call esi
lea ecx, [esp + 0x10]
push ecx
mov byte [0x6daa0c], bl
mov edx, dword [esp + 0x14]
push edx
push 1
push 0x6daa0c
call esi
mov edi, dword [ebp + 8]
mov eax, 0x44
call fcn.1000fff0
test al, al
je 0x100218ce
xor eax, eax
cmp dword [0x101e4984], eax
sete al
mov dword [0x101e4984], eax
test eax, eax
mov eax, 0x1003cb64
jne 0x10021868
mov eax, 0x1003c468
push str.._config.ini
push eax
push str.DisabledNieve
push str.Custom
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [0x101e4984], 0
jne 0x100218ac
push 0x6efac4
push 0x6f067e
mov bl, 0xe8
call fcn.10034b90
push 0x6efde7
push 0x6f0743
call fcn.10034b90
add esp, 0x10
jmp 0x100218cb
mov esi, 5
mov ebx, 0x6f067e
call fcn.10034d10
mov ebx, 0x6f0743
call fcn.10034d10
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebp + 8]
mov eax, 0x45
call fcn.1000fff0
test al, al
je 0x10021914
xor eax, eax
cmp dword [0x101e4950], eax
sete al
mov dword [0x101e4950], eax
test eax, eax
mov eax, 0x1003cb64
jne 0x100218fa
mov eax, 0x1003c468
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str.._config.ini
push eax
push str.ShowFPS
push str.Custom
call ebx
jmp 0x1002191a
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, 0x46
call fcn.1000fff0
test al, al
je 0x10021958
xor eax, eax
cmp dword [0x101e4948], eax
sete al
mov dword [0x101e4948], eax
test eax, eax
mov eax, 0x1003cb64
jne 0x10021946
mov eax, 0x1003c468
push str.._config.ini
push eax
push str.ShowHP
push str.Custom
call ebx
mov eax, 0x47
call fcn.1000fff0
test al, al
je 0x10021996
xor eax, eax
cmp dword [0x101e494c], eax
sete al
mov dword [0x101e494c], eax
test eax, eax
mov eax, 0x1003cb64
jne 0x10021984
mov eax, 0x1003c468
push str.._config.ini
push eax
push str.GlowItem
push str.Custom
call ebx
mov eax, 0x48
call fcn.1000fff0
test al, al
je 0x100219d4
xor eax, eax
cmp dword [0x101e4954], eax
sete al
mov dword [0x101e4954], eax
test eax, eax
mov eax, 0x1003cb64
jne 0x100219c2
mov eax, 0x1003c468
push str.._config.ini
push eax
push str.ReduceCPU
push str.Custom
call ebx
mov eax, 0x49
call fcn.1000fff0
test al, al
je 0x10021a24
xor eax, eax
cmp dword [0x101df710], eax
sete al
mov dword [0x101df710], eax
test eax, eax
jne 0x10021a0c
push 0x51cbc4
push 0x52620b
mov bl, 0xe8
call fcn.10034b90
add esp, 8
jmp 0x10021a21
mov esi, 5
mov ebx, 0x52620b
call fcn.10034d10
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebp + 8]
mov eax, 0x4b
call fcn.1000fff0
test al, al
je 0x10021c2f
xor eax, eax
cmp dword [0x101e4974], eax
sete al
mov dword [0x101e4974], eax
test eax, eax
mov eax, 0x1003cb64
jne 0x10021a54
mov eax, 0x1003c468
push str.._config.ini
push eax
push str.DisabledSuelo
push str.Custom
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [0x101e4974], 0
jne 0x10021c1d
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x6617d2
call esi
lea ecx, [esp + 0x10]
push ecx
mov byte [0x6617d2], 0x6a
mov edx, dword [esp + 0x14]
push edx
push 1
push 0x6617d2
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x6617d3
call esi
lea ecx, [esp + 0x10]
push ecx
mov byte [0x6617d3], 0
mov edx, dword [esp + 0x14]
push edx
push 1
push 0x6617d3
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x6617d4
call esi
lea ecx, [esp + 0x10]
push ecx
mov byte [0x6617d4], 0xe8
mov edx, dword [esp + 0x14]
push edx
push 1
push 0x6617d4
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x6617d5
call esi
lea ecx, [esp + 0x10]
push ecx
mov byte [0x6617d5], 0x55
mov edx, dword [esp + 0x14]
push edx
push 1
push 0x6617d5
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x6617d6
call esi
lea ecx, [esp + 0x10]
push ecx
mov byte [0x6617d6], 0x7b
mov edx, dword [esp + 0x14]
push edx
push 1
push 0x6617d6
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x6617d7
call esi
lea ecx, [esp + 0x10]
mov byte [0x6617d7], 0xfa
mov edx, dword [esp + 0x10]
push ecx
push edx
push 1
push 0x6617d7
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x6617d8
call esi
lea ecx, [esp + 0x10]
push ecx
mov byte [0x6617d8], 0xff
mov edx, dword [esp + 0x14]
push edx
push 1
push 0x6617d8
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x6617d9
call esi
lea ecx, [esp + 0x10]
push ecx
mov byte [0x6617d9], 0x83
mov edx, dword [esp + 0x14]
push edx
push 1
push 0x6617d9
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x6617da
call esi
lea ecx, [esp + 0x10]
push ecx
mov byte [0x6617da], 0xc4
mov edx, dword [esp + 0x14]
push edx
push 1
push 0x6617da
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x6617db
call esi
lea ecx, [esp + 0x10]
push ecx
mov byte [0x6617db], 4
mov edx, dword [esp + 0x14]
push edx
push 1
push 0x6617db
call esi
jmp 0x10021c2f
mov esi, 0xa
mov ebx, 0x6617d2
call fcn.10034d10
mov edi, dword [ebp + 8]
mov eax, 0x4c
call fcn.1000fff0
test al, al
je 0x10021c56
push 0x1e0
push 0x280
call fcn.10020d00
add esp, 8
xor al, al
call fcn.10020f80
mov eax, 0x4d
call fcn.1000fff0
test al, al
je 0x10021c7d
push 0x258
push 0x320
call fcn.10020d00
add esp, 8
mov al, 1
call fcn.10020f80
mov eax, 0x4e
call fcn.1000fff0
test al, al
je 0x10021ca4
push 0x300
push 0x400
call fcn.10020d00
add esp, 8
mov al, 2
call fcn.10020f80
mov eax, 0x4f
call fcn.1000fff0
test al, al
je 0x10021ccb
push 0x400
push 0x500
call fcn.10020d00
add esp, 8
mov al, 3
call fcn.10020f80
mov eax, 0x50
call fcn.1000fff0
test al, al
je 0x10021cf2
push 0x300
push 0x556
call fcn.10020d00
add esp, 8
mov al, 4
call fcn.10020f80
mov eax, 0x51
call fcn.1000fff0
test al, al
je 0x10021d19
push 0x384
push 0x5a0
call fcn.10020d00
add esp, 8
mov al, 5
call fcn.10020f80
mov eax, 0x52
call fcn.1000fff0
test al, al
je 0x10021d40
push 0x384
push 0x640
call fcn.10020d00
add esp, 8
mov al, 6
call fcn.10020f80
mov eax, 0x53
call fcn.1000fff0
test al, al
je 0x10021d67
push 0x41a
push 0x690
call fcn.10020d00
add esp, 8
mov al, 7
call fcn.10020f80
mov eax, 0x54
call fcn.1000fff0
test al, al
je 0x10021d8e
push 0x438
push 0x780
call fcn.10020d00
add esp, 8
mov al, 8
call fcn.10020f80
mov eax, 0x5f
call fcn.1000fff0
test al, al
je 0x10021db0
push 0xa
call fcn.10021140
add esp, 4
push 0xa
call fcn.10020fe0
add esp, 4
mov eax, 0x60
call fcn.1000fff0
test al, al
je 0x10021dd2
push 0xb
call fcn.10021140
add esp, 4
push 0xb
call fcn.10020fe0
add esp, 4
mov eax, 0x61
call fcn.1000fff0
test al, al
je 0x10021df4
push 0xc
call fcn.10021140
add esp, 4
push 0xc
call fcn.10020fe0
add esp, 4
mov eax, 0x62
call fcn.1000fff0
test al, al
je 0x10021e16
push 0xd
call fcn.10021140
add esp, 4
push 0xd
call fcn.10020fe0
add esp, 4
mov eax, 0x63
call fcn.1000fff0
test al, al
je 0x10021e38
push 0xe
call fcn.10021140
add esp, 4
push 0xe
call fcn.10020fe0
add esp, 4
mov eax, 0x64
call fcn.1000fff0
test al, al
je 0x10021e5a
push 0xf
call fcn.10021140
add esp, 4
push 0xf
call fcn.10020fe0
add esp, 4
mov eax, 0x65
call fcn.1000fff0
test al, al
je 0x10021e7c
push 0x10
call fcn.10021140
add esp, 4
push 0x10
call fcn.10020fe0
add esp, 4
mov eax, 0x66
call fcn.1000fff0
test al, al
je 0x10021e9e
push 0x11
call fcn.10021140
add esp, 4
push 0x11
call fcn.10020fe0
add esp, 4
mov eax, 0x67
call fcn.1000fff0
test al, al
je 0x10021ec0
push 0x12
call fcn.10021140
add esp, 4
push 0x12
call fcn.10020fe0
add esp, 4
mov eax, 0x68
call fcn.1000fff0
test al, al
je 0x10021ee2
push 0x13
call fcn.10021140
add esp, 4
push 0x13
call fcn.10020fe0
add esp, 4
mov edi, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebx + 0x69]
call fcn.1000fff0
test al, al
je 0x10021ef9
mov byte [0x7b02760], bl
inc ebx
cmp ebx, 9
jl 0x10021ee7
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, 0x73
mov esi, 0x101e8b9c
nop
movsx eax, bx
lea ecx, [eax + eax*8]
add ecx, ecx
add ecx, ecx
mov eax, 0x7afe950
fld dword [ecx + 0x101e7b5c]
fstp dword [esp + 0x14]
fild dword [eax]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fld dword [esp + 0x14]
fcom st(1)
fnstsw ax
test ah, 0x41
je 0x10021fc9
fadd dword [ecx + 0x101e7b54]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fcompp
fnstsw ax
test ah, 5
jnp 0x10021fcd
fild dword [0x7afe94c]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fld dword [ecx + 0x101e7b60]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x10021fcb
fld dword [ecx + 0x101e7b68]
fcompp
fnstsw ax
test ah, 5
jnp 0x10021fcd
call edi
sub eax, dword [esi - 4]
cmp dword [ebp + 8], 0x201
jne 0x10021fae
cmp byte [esi], 0
jne 0x10021f9d
mov byte [esi], 1
cmp eax, 0x1f4
jb 0x10021fcd
mov byte [esi], 0
call edi
mov dword [esi - 4], eax
jmp 0x10021fcd
cmp dword [ebp + 8], 0x202
jne 0x10021f9d
cmp byte [esi], 1
jne 0x10021f9d
lea eax, [ebx - 0x73]
mov byte [esi], 0
mov byte [0x770388], al
jmp 0x10021fcd
fstp st(1)
fstp st(0)
inc ebx
lea ecx, [ebx - 0x73]
add esi, 0x24
cmp ecx, 5
jl 0x10021f10
fld dword [0x101e8c60]
fstp dword [esp + 0x14]
fild dword [0x7afe950]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fld dword [esp + 0x14]
fcom st(1)
fnstsw ax
test ah, 0x41
je 0x100220b1
fadd dword [0x101e8c58]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fcompp
fnstsw ax
test ah, 5
jnp 0x100220b5
fild dword [0x7afe94c]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fld dword [0x101e8c64]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x100220b3
fld dword [0x101e8c6c]
fcompp
fnstsw ax
test ah, 5
jnp 0x100220b5
call edi
mov ecx, dword [ebp + 8]
sub eax, dword [0x101e8c70]
cmp ecx, 0x201
jne 0x10022087
cmp byte [0x101e8c74], 0
jne 0x10022070
mov byte [0x101e8c74], 1
cmp eax, 0x1f4
jb 0x100220b5
mov byte [0x101e8c74], 0
call edi
mov dword [0x101e8c70], eax
jmp 0x100220b5
cmp ecx, 0x202
jne 0x10022070
cmp byte [0x101e8c74], 1
jne 0x10022070
mov byte [0x101e8c74], 0
cmp byte [0x76efb0], 0
sete dl
mov byte [0x76efb0], dl
jmp 0x100220b5
fstp st(1)
fstp st(0)
fld dword [0x101e8c84]
fstp dword [esp + 0x14]
fild dword [0x7afe950]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fld dword [esp + 0x14]
fcom st(1)
fnstsw ax
test ah, 0x41
je 0x10022188
fadd dword [0x101e8c7c]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fcompp
fnstsw ax
test ah, 5
jnp 0x1002218c
fild dword [0x7afe94c]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fld dword [0x101e8c88]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x1002218a
fld dword [0x101e8c90]
fcompp
fnstsw ax
test ah, 5
jnp 0x1002218c
call edi
mov esi, dword [ebp + 8]
sub eax, dword [0x101e8c94]
cmp esi, 0x201
jne 0x1002215f
cmp byte [0x101e8c98], 0
jne 0x10022148
mov byte [0x101e8c98], 1
cmp eax, 0x1f4
jb 0x1002218f
mov byte [0x101e8c98], 0
call edi
mov dword [0x101e8c94], eax
jmp 0x1002218f
cmp esi, 0x202
jne 0x10022148
cmp byte [0x101e8c98], 1
jne 0x10022148
mov byte [0x101e8c98], 0
cmp byte [0x75ae948], 0
sete al
mov byte [0x75ae948], al
jmp 0x1002218f
fstp st(1)
fstp st(0)
mov esi, dword [ebp + 8]
fld dword [0x101e8ca8]
fstp dword [esp + 0x14]
fild dword [0x7afe950]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fld dword [esp + 0x14]
fcom st(1)
fnstsw ax
test ah, 0x41
je 0x1002225e
fadd dword [0x101e8ca0]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fcompp
fnstsw ax
test ah, 5
jnp 0x10022262
fild dword [0x7afe94c]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fld dword [0x101e8cac]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x10022260
fld dword [0x101e8cb4]
fcompp
fnstsw ax
test ah, 5
jnp 0x10022262
call edi
sub eax, dword [0x101e8cb8]
cmp esi, 0x201
jne 0x1002223d
cmp byte [0x101e8cbc], 0
jne 0x1002221f
mov byte [0x101e8cbc], 1
cmp eax, 0x1f4
jb 0x10022262
mov byte [0x101e8cbc], 0
call edi
mov dword [0x101e8cb8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x202
jne 0x1002221f
cmp byte [0x101e8cbc], 1
jne 0x1002221f
mov byte [0x101e8cbc], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
fstp st(1)
fstp st(0)
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4