Function at 0x1008ef40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1010ef88
push eax
mov dword fs:[0], esp
sub esp, 0x1c
cmp byte [0x10174f84], 0
push esi
push edi
je 0x1008efa8
test byte [0x10174f88], 1
je 0x1008efa8
mov edx, str.Checking_for_changed_skilldex_images.
mov ecx, 0x10153db8
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
cmp dword [0x101553d8], 0
je 0x1008efa8
mov edx, str.Checking_for_changed_skilldex_images.
mov ecx, 0x10141e60
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push str.Lockpick
mov edx, str.Misc
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x1008f009
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f002
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
mov edi, 0x125
jmp 0x1008f03f
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edx, 0x125
cmovae ecx, dword [ebp - 0x28]
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov edi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f03a
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x1008f07a
cmp eax, 1
je 0x1008f07a
push str..ddraw.ini
push 0x125
mov edx, str.Lockpick
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp edi, 0x125
je 0x1008f0ad
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d54
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d54], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d54
call esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
push str.Steal
mov edx, str.Misc
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x1008f10e
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f107
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
mov edi, 0x125
jmp 0x1008f144
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edx, 0x125
cmovae ecx, dword [ebp - 0x28]
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov edi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f13f
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x1008f17f
cmp eax, 1
je 0x1008f17f
push str..ddraw.ini
push 0x125
mov edx, str.Steal
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f1ac
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d58
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d58], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d58
call esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
push str.Traps
mov edx, str.Misc
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x1008f20d
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f206
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
mov edi, 0x125
jmp 0x1008f243
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edx, 0x125
cmovae ecx, dword [ebp - 0x28]
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov edi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f23e
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x1008f27e
cmp eax, 1
je 0x1008f27e
push str..ddraw.ini
push 0x125
mov edx, str.Traps
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f2ab
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d5c
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d5c], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d5c
call esi
push str.._sfall.ini
push 0x125
mov edx, str.FirstAid
mov ecx, str.Misc
call fcn.10005480
cmp byte [0x10153f67], 0
mov edi, eax
je 0x1008f2f3
cmp dword [0x10154e3c], 1
je 0x1008f2f3
push str..ddraw.ini
push 0x125
mov edx, str.FirstAid
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f320
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d4c
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d4c], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d4c
call esi
push str.._sfall.ini
push 0x125
mov edx, str.Doctor
mov ecx, str.Misc
call fcn.10005480
cmp byte [0x10153f67], 0
mov edi, eax
je 0x1008f368
cmp dword [0x10154e3c], 1
je 0x1008f368
push str..ddraw.ini
push 0x125
mov edx, str.Doctor
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f395
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d50
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d50], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d50
call esi
push str.._sfall.ini
push 0x125
mov edx, str.Science
mov ecx, str.Misc
call fcn.10005480
cmp byte [0x10153f67], 0
mov edi, eax
je 0x1008f3dd
cmp dword [0x10154e3c], 1
je 0x1008f3dd
push str..ddraw.ini
push 0x125
mov edx, str.Science
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f40a
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d60
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d60], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d60
call esi
push str.._sfall.ini
push 0x125
mov edx, str.Repair
mov ecx, str.Misc
call fcn.10005480
cmp byte [0x10153f67], 0
mov edi, eax
je 0x1008f452
cmp dword [0x10154e3c], 1
je 0x1008f452
push str..ddraw.ini
push 0x125
mov edx, str.Repair
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f47f
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d64
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d64], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d64
call esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret