Function at 0x1008ef70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1010ef98
push eax
mov dword fs:[0], esp
sub esp, 0x1c
cmp byte [0x10174f84], 0
push esi
push edi
je 0x1008efd8
test byte [0x10174f88], 1
je 0x1008efd8
mov edx, str.Checking_for_changed_skilldex_images.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x1008efd8
mov edx, str.Checking_for_changed_skilldex_images.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push str.Lockpick
mov edx, str.Misc
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x1008f039
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f032
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
mov edi, 0x125
jmp 0x1008f06f
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edx, 0x125
cmovae ecx, dword [ebp - 0x28]
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov edi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f06a
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x1008f0aa
cmp eax, 1
je 0x1008f0aa
push str..ddraw.ini
push 0x125
mov edx, str.Lockpick
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp edi, 0x125
je 0x1008f0dd
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d54
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d54], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d54
call esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
push str.Steal
mov edx, str.Misc
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x1008f13e
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f137
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
mov edi, 0x125
jmp 0x1008f174
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edx, 0x125
cmovae ecx, dword [ebp - 0x28]
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov edi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f16f
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x1008f1af
cmp eax, 1
je 0x1008f1af
push str..ddraw.ini
push 0x125
mov edx, str.Steal
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f1dc
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d58
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d58], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d58
call esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
push str.Traps
mov edx, str.Misc
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x1008f23d
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f236
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
mov edi, 0x125
jmp 0x1008f273
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edx, 0x125
cmovae ecx, dword [ebp - 0x28]
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov edi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f26e
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x1008f2ae
cmp eax, 1
je 0x1008f2ae
push str..ddraw.ini
push 0x125
mov edx, str.Traps
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f2db
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d5c
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d5c], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d5c
call esi
push str.._sfall.ini
push 0x125
mov edx, str.FirstAid
mov ecx, str.Misc
call fcn.10005480
cmp byte [0x10153f67], 0
mov edi, eax
je 0x1008f323
cmp dword [0x10154e3c], 1
je 0x1008f323
push str..ddraw.ini
push 0x125
mov edx, str.FirstAid
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f350
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d4c
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d4c], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d4c
call esi
push str.._sfall.ini
push 0x125
mov edx, str.Doctor
mov ecx, str.Misc
call fcn.10005480
cmp byte [0x10153f67], 0
mov edi, eax
je 0x1008f398
cmp dword [0x10154e3c], 1
je 0x1008f398
push str..ddraw.ini
push 0x125
mov edx, str.Doctor
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f3c5
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d50
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d50], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d50
call esi
push str.._sfall.ini
push 0x125
mov edx, str.Science
mov ecx, str.Misc
call fcn.10005480
cmp byte [0x10153f67], 0
mov edi, eax
je 0x1008f40d
cmp dword [0x10154e3c], 1
je 0x1008f40d
push str..ddraw.ini
push 0x125
mov edx, str.Science
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f43a
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d60
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d60], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d60
call esi
push str.._sfall.ini
push 0x125
mov edx, str.Repair
mov ecx, str.Misc
call fcn.10005480
cmp byte [0x10153f67], 0
mov edi, eax
je 0x1008f482
cmp dword [0x10154e3c], 1
je 0x1008f482
push str..ddraw.ini
push 0x125
mov edx, str.Repair
mov ecx, str.Misc
call fcn.10005480
mov edi, eax
cmp edi, 0x125
je 0x1008f4af
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x518d64
call esi
lea eax, [ebp - 0x10]
mov dword [0x518d64], edi
push eax
push dword [ebp - 0x10]
push 4
push 0x518d64
call esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret