Function at 0x1002d610
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010dda5
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1012800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [0x102ec1c0]
call fcn.100376c0
mov ecx, dword [0x102ec1c0]
call fcn.1004a5c0
push dword [0x102ec1c0]
call fcn.1003e660
push 2
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push 0x1011cbf8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.10008a30
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push dword [0x102ec1c0]
lea ecx, [ebp - 0x48]
call fcn.100092c0
sub esp, 8
mov byte [ebp - 4], 1
mov ecx, eax
call fcn.1002e080
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x1002d6e1
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002d6d7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002df46
push edx
push ecx
call fcn.1008025d
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp edx, 0x10
jb 0x1002d72e
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002d724
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002df46
push edx
push ecx
call fcn.1008025d
add esp, 8
push 2
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push 0x1011cbf8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.10008a30
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 2
push eax
push dword [0x102ec1c0]
lea ecx, [ebp - 0x48]
call fcn.100092c0
push 0x1002bb00
push str.SetEffectHelper
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.10022550
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x1002d7bc
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002d7b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002df4b
push edx
push ecx
call fcn.1008025d
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp edx, 0x10
jb 0x1002d809
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002d7ff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002df4b
push edx
push ecx
call fcn.1008025d
add esp, 8
push 2
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push 0x1011cbf8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.10008a30
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 4
push eax
push dword [0x102ec1c0]
lea ecx, [ebp - 0x48]
call fcn.100092c0
push 0x1002bb00
push str.SetEffectHelperMiniature
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.10022550
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x1002d897
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002d88d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002df50
push edx
push ecx
call fcn.1008025d
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp edx, 0x10
jb 0x1002d8e4
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002d8da
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002df50
push edx
push ecx
call fcn.1008025d
add esp, 8
push 2
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push 0x1011cbf8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.10008a30
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 6
push eax
push dword [0x102ec1c0]
lea ecx, [ebp - 0x48]
call fcn.100092c0
push 0x1002bcb0
push str.CheckModelById
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.1000bd50
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x1002d972
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002d968
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002df55
push edx
push ecx
call fcn.1008025d
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp edx, 0x10
jb 0x1002d9bf
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002d9b5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002df55
push edx
push ecx
call fcn.1008025d
add esp, 8
push str.Data__Local__Rpx__Lua__CharacterSystem__CharacterHelper.lua
mov ecx, 0x102ec1bc
call fcn.10036920
push 0x1011cd78
push str.LoadHelpers
push 0x102ec1bc
call fcn.10036a80
add esp, 0xc
push 0x1002af60
push 0x4d7348
push 0xe8
call fcn.1007d440
add esp, 0xc
push 0x1002af60
push 0x4d7a98
push 0xe8
call fcn.1007d440
add esp, 0xc
push 0x1002af60
push 0x4d9a65
push 0xe8
call fcn.1007d440
add esp, 0xc
push 0x1002b0c0
push 0x4d6ea5
push 0xe8
call fcn.1007d440
add esp, 0xc
push 0x1002b0c0
push 0x4d7787
push 0xe8
call fcn.1007d440
add esp, 0xc
push 0x1002b0c0
push 0x4d9568
push 0xe8
call fcn.1007d440
add esp, 0xc
push 0x1002c0b0
push 0x8363d9
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c1f0
push 0x835e80
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c250
push 0x7dfe51
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c2e0
push 0x4d72eb
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c330
push 0x534c65
push 0xe8
call fcn.1007d440
add esp, 0xc
push 0x1002c400
push 0x54eac8
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c4b0
push 0x54ed55
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c500
push 0x54ec8f
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c550
push 0x54ed43
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c5a0
push 0x54f8ea
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c5f0
push 0x54fc7d
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c640
push 0x550706
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c690
push 0x54fe28
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c700
push 0x54fcd8
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c750
push 0x5506c2
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c7a0
push 0x5a383a
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c840
push 0x5517a4
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c8a0
push 0x551916
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c8f0
push 0x551b3f
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c960
push 0x551b09
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002c9f0
push 0x55273e
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002ca60
push 0x552995
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002cab0
push 0x5528de
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002cb30
push 0x552777
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002cb80
push 0x564c9c
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002cbe0
push 0x564ba2
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002cc30
push 0x564c1c
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002cc80
push 0x564e6e
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002ccd0
push 0x56f688
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002cd40
push 0x57e108
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002cd90
push 0x5b53ff
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002ce30
push 0x59b656
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002ced0
push 0x5a3817
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002cf70
push 0x63edc8
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002cfc0
push 0x640a89
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002d010
push 0x640dcf
push 0xe9
call fcn.1007d440
add esp, 0xc
cmp byte [0x1012fbad], 0
jne 0x1002dde2
push 0x1002d060
push 0x813f5a
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002d100
push 0x5b5411
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002d1a0
push 0x54fd0e
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002d250
push 0x644520
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002d320
push 0x648daf
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002d370
push 0x648dd3
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002d410
push 0x5ae1e0
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002d460
push 0x5ae201
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002d500
push 0x54ed07
push 0xe9
call fcn.1007d440
add esp, 0xc
push 0x1002d520
push 0x5af273
push 0xe9
call fcn.1007d440
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
add esp, 0xc
push eax
push 0x40
push 6
push 0x8140cf
call esi
mov eax, 0x8140cf
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 6
push 0x8140cf
call esi
push 0x1002d570
push 0x8140cf
push 0xe9
call fcn.1007d440
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push 0x59c7e5
call esi
mov eax, 0x59c7e5
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 6
push 0x59c7e5
call esi
push 0x1002d5c0
push 0x59c7e5
push 0xe9
call fcn.1007d440
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007ff35
mov esp, ebp
pop ebp
ret
call fcn.100e1d1d
call fcn.100e1d1d
call fcn.100e1d1d
call fcn.100e1d1d
int3