Function at 0x1005e100
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101050f8
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x10167080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [ebp - 0x5c]
mov dword [edi], vtable.components::rtx_fixed_function.0
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x1005e166
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 0
mov dword [ebp - 0x58], 0x655a10
mov dword [ebp - 0x54], 0x1005bce0
mov eax, dword [0x655a11]
add eax, 0x655a15
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x1005e182
mov byte [eax + 1], 0
mov dword [ebp - 4], 1
cmp byte [ebp - 0x5c], 0
je 0x1005e198
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x1005e1d5
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x65722c
mov dword [ebp - 0x54], 0x1005c3d0
mov eax, dword [0x65722d]
add eax, 0x657231
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x1005e1f1
mov byte [eax + 1], 0
mov dword [ebp - 4], 3
cmp byte [ebp - 0x5c], 0
je 0x1005e207
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x1005e244
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x6575c5
mov dword [ebp - 0x54], 0x1005c3e0
mov eax, dword [0x6575c6]
add eax, 0x6575ca
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x1005e260
mov byte [eax + 1], 0
mov dword [ebp - 4], 5
cmp byte [ebp - 0x5c], 0
je 0x1005e276
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc4]
add esp, 4
push eax
push 0x40
push 3
push 0x646ece
call esi
mov eax, 0x646ece
mov ecx, 0x90909090
mov word [eax], cx
mov byte [eax + 2], cl
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0xc4]
push 3
push 0x646ece
call esi
push 3
push 0x646ece
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x1005e305
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x646ed4
mov dword [ebp - 0x54], 0x1005c970
mov eax, dword [0x646ed5]
add eax, 0x646ed9
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x1005e321
mov byte [eax + 1], 0
mov dword [ebp - 4], 7
cmp byte [ebp - 0x5c], 0
je 0x1005e337
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x1005e374
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 0
mov dword [ebp - 0x58], 0x65618e
mov dword [ebp - 0x54], 0x1005c980
mov eax, dword [0x65618f]
add eax, 0x656193
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x1005e390
mov byte [eax + 1], 0
mov dword [ebp - 4], 9
cmp byte [ebp - 0x5c], 0
je 0x1005e3a6
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x1005e3e3
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 0
mov dword [ebp - 0x58], 0x6486f4
mov dword [ebp - 0x54], 0x1005cf00
mov eax, dword [0x6486f5]
add eax, 0x6486f9
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x1005e3ff
mov byte [eax + 1], 0
mov dword [ebp - 4], 0xb
cmp byte [ebp - 0x5c], 0
je 0x1005e415
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x1005e452
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 0
mov dword [ebp - 0x58], 0x648563
mov dword [ebp - 0x54], 0x1005d130
mov eax, dword [0x648564]
add eax, 0x648568
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x1005e46e
mov byte [eax + 1], 0
mov dword [ebp - 4], 0xd
cmp byte [ebp - 0x5c], 0
je 0x1005e484
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x1005e4c1
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x648710
mov dword [ebp - 0x54], 0x1005d300
mov eax, dword [0x648711]
add eax, 0x648715
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 0xe
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x1005e4dd
mov byte [eax + 1], 0
mov dword [ebp - 4], 0xf
cmp byte [ebp - 0x5c], 0
je 0x1005e4f3
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x1005e530
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x61a36f
mov dword [ebp - 0x54], 0x1005e0d0
mov eax, dword [0x61a370]
add eax, 0x61a374
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x1005e54c
mov byte [eax + 1], 0
mov dword [ebp - 4], 0x11
cmp byte [ebp - 0x5c], 0
je 0x1005e562
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x1005e59f
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x44031b
mov dword [ebp - 0x54], 0x1005dc20
mov eax, dword [0x44031c]
add eax, 0x440320
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x1005e5bb
mov byte [eax + 1], 0
mov dword [ebp - 4], 0x13
cmp byte [ebp - 0x5c], 0
je 0x1005e5d1
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x1005e60e
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x5f5052
mov dword [ebp - 0x54], 0x1005dd10
mov eax, dword [0x5f5053]
add eax, 0x5f5057
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 0x14
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x1005e62a
mov byte [eax + 1], 0
mov dword [ebp - 4], 0x15
cmp byte [ebp - 0x5c], 0
je 0x1005e640
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
push 0
push 0
push 0
push 0
push 0
push 1
push str.Build_static_model_vertex_buffers_on_map_load__fixed_function_rendering_only_
push 1
push 0
push str.rtx_warm_smodels
mov dword [ebp - 4], 0xffffffff
call dword [0x10167e44]
xorps xmm0, xmm0
mov dword [0x1020d3c0], eax
mov eax, dword [0x10148afc]
add esp, 0x2c
movups xmmword [ebp - 0x74], xmm0
mov dword [ebp - 0x6c], eax
movq xmm0, qword [str.stock_effects]
mov al, byte [0x10148b00]
mov dword [ebp - 0x64], 0xd
mov dword [ebp - 0x60], 0xf
movq qword [ebp - 0x74], xmm0
mov byte [ebp - 0x68], al
mov byte [ebp - 0x67], 0
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], 0x16
call fcn.10038990
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x60]
mov byte [ebp - 0xc5], al
cmp ecx, 0xf
jbe 0x1005e704
mov edx, dword [ebp - 0x74]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1005e6f4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005e944
push ecx
push edx
call fcn.100d91c2
mov al, byte [ebp - 0xc5]
add esp, 8
test al, al
jne 0x1005e927
lea eax, [ebp - 0xc4]
push eax
push 0x40
push 1
push 0x645d33
call esi
lea eax, [ebp - 0xc4]
mov byte [0x645d33], 0x10
push eax
push dword [ebp - 0xc4]
push 1
push 0x645d33
call esi
push 1
push 0x645d33
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0xc4]
push eax
push 0x40
push 1
push 0x645e0a
call esi
lea eax, [ebp - 0xc4]
mov byte [0x645e0a], 0x10
push eax
push dword [ebp - 0xc4]
push 1
push 0x645e0a
call esi
push 1
push 0x645e0a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0xc4]
push eax
push 0x40
push 5
push 0x645c71
call esi
mov eax, 0x645c71
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0xc4]
push 5
push 0x645c71
call esi
push 5
push 0x645c71
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0xc4]
push eax
push 0x40
push 5
push 0x645cbb
call esi
mov eax, 0x645cbb
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0xc4]
push 5
push 0x645cbb
call esi
push 5
push 0x645cbb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x1005e859
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x645bb3
mov dword [ebp - 0x54], 0x1005d9b0
mov eax, dword [0x645bb4]
add eax, 0x645bb8
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 0x17
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x1005e875
mov byte [eax + 1], 0
mov dword [ebp - 4], 0x18
cmp byte [ebp - 0x5c], 0
je 0x1005e88b
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea ecx, [ebp - 0xc0]
call fcn.10004700
cmp byte [ebp - 0xc0], 0
jne 0x1005e8dd
mov byte [ebp - 0xc0], 1
mov byte [ebp - 0xab], 1
mov dword [ebp - 0xbc], 0x645e1a
mov dword [ebp - 0xb8], 0x1005d9d0
mov eax, dword [0x645e1b]
add eax, 0x645e1f
mov dword [ebp - 0xb4], eax
sub esp, 8
mov dword [ebp - 4], 0x19
lea ecx, [ebp - 0xc0]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x1005e8fc
mov byte [eax + 1], 0
mov dword [ebp - 4], 0x1a
cmp byte [ebp - 0xc0], 0
je 0x1005e918
push ecx
lea ecx, [ebp - 0xc0]
call fcn.10068b40
lea eax, [ebp - 0xa4]
push eax
call fcn.1000ab50
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d8e9a
mov esp, ebp
pop ebp
ret
call fcn.100de11f
int3