Function at 0x11058420
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88
cmp byte [0x110d720f], 0
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
jne 0x1105850e
lea eax, [esp + 0x98]
mov dword [esp + 0x84], 0x496669
push eax
lea edx, [esp + 0x88]
mov dword [esp + 0x8c], 0x496837
mov ecx, 0x110f6b00
mov dword [esp + 0x90], 0x496bad
mov dword [esp + 0x94], 0x496c41
mov dword [esp + 0x98], 0x496d25
call fcn.1100f980
lea eax, [esp + 0x60]
mov dword [esp + 0x58], 0x496696
push eax
lea edx, [esp + 0x5c]
mov dword [esp + 0x60], 0x496bd1
mov ecx, 0x110f6b04
call fcn.1100f980
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x496bf5
call ebp
lea eax, [esp + 0x10]
mov dword [0x496bf5], 0x110f6b08
push eax
push dword [esp + 0x14]
push 4
push 0x496bf5
call ebp
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x496ad4
call ebp
lea eax, [esp + 0x10]
mov dword [0x496ad4], 0x110f6b0c
push eax
push dword [esp + 0x14]
push 4
push 0x496ad4
call ebp
push 0x2354
push 0x519dcc
push 0x110f6b00
call fcn.11081160
add esp, 0xc
cmp dword [0x110d8720], 0
je 0x110595bc
xor esi, esi
push 0xa
lea eax, [esp + 0x14]
push eax
push esi
call fcn.1108a068
add esp, 0xc
lea ecx, [esp + 0x10]
mov eax, esi
mov edx, 0x110b8a84
shl eax, 6
push 0x110e2fe8
push 0x3f
lea edi, [eax + 0x110e1228]
push edi
push 0x110aeab8
call fcn.1100a410
test eax, eax
je 0x11058577
imul eax, esi, 0x4c
mov dword [eax + 0x110f6b00], edi
mov eax, esi
lea ecx, [esp + 0x10]
shl eax, 8
mov edx, str.Desc
push 0x110e2fe8
push 0xff
lea edi, [eax + 0x110d9b28]
push edi
push 0x110aeab8
call fcn.1100a410
test eax, eax
je 0x110585ad
imul eax, esi, 0x4c
mov dword [eax + 0x110f6b04], edi
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110585fd
lea ecx, [esp + 0x14]
push ecx
push 0x110b7828
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x110585fd
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x14], 0x10
jb 0x110585e8
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x110585fd
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b08], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1105864d
lea ecx, [esp + 0x18]
push ecx
push str.Ranks
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x1105864d
mov ecx, dword [esp + 0x18]
cmp dword [ecx + 0x14], 0x10
jb 0x11058638
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x1105864d
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b0c], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1105869d
lea ecx, [esp + 0x1c]
push ecx
push str.Level
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x1105869d
mov ecx, dword [esp + 0x1c]
cmp dword [ecx + 0x14], 0x10
jb 0x11058688
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x1105869d
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b10], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110586ed
lea ecx, [esp + 0x20]
push ecx
push str.Stat
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x110586ed
mov ecx, dword [esp + 0x20]
cmp dword [ecx + 0x14], 0x10
jb 0x110586d8
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x110586ed
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b14], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1105873d
lea ecx, [esp + 0x24]
push ecx
push str.StatMag
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x1105873d
mov ecx, dword [esp + 0x24]
cmp dword [ecx + 0x14], 0x10
jb 0x11058728
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x1105873d
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b18], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1105878d
lea ecx, [esp + 0x28]
push ecx
push str.Skill1
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x1105878d
mov ecx, dword [esp + 0x28]
cmp dword [ecx + 0x14], 0x10
jb 0x11058778
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x1105878d
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b1c], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110587dd
lea ecx, [esp + 0x2c]
push ecx
push str.Skill1Mag
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x110587dd
mov ecx, dword [esp + 0x2c]
cmp dword [ecx + 0x14], 0x10
jb 0x110587c8
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x110587dd
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b20], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1105882d
lea ecx, [esp + 0x30]
push ecx
push str.Type
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x1105882d
mov ecx, dword [esp + 0x30]
cmp dword [ecx + 0x14], 0x10
jb 0x11058818
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x1105882d
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b24], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1105887d
lea ecx, [esp + 0x34]
push ecx
push str.Skill2
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x1105887d
mov ecx, dword [esp + 0x34]
cmp dword [ecx + 0x14], 0x10
jb 0x11058868
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x1105887d
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b28], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110588cd
lea ecx, [esp + 0x38]
push ecx
push str.Skill2Mag
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x110588cd
mov ecx, dword [esp + 0x38]
cmp dword [ecx + 0x14], 0x10
jb 0x110588b8
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x110588cd
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b2c], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1105891d
lea ecx, [esp + 0x3c]
push ecx
push 0x110b8ae4
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x1105891d
mov ecx, dword [esp + 0x3c]
cmp dword [ecx + 0x14], 0x10
jb 0x11058908
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x1105891d
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b30], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1105896d
lea ecx, [esp + 0x40]
push ecx
push 0x110b8ae8
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x1105896d
mov ecx, dword [esp + 0x40]
cmp dword [ecx + 0x14], 0x10
jb 0x11058958
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x1105896d
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b34], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110589bd
lea ecx, [esp + 0x44]
push ecx
push 0x110b8aec
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x110589bd
mov ecx, dword [esp + 0x44]
cmp dword [ecx + 0x14], 0x10
jb 0x110589a8
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x110589bd
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b38], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058a0d
lea ecx, [esp + 0x48]
push ecx
push 0x110b8af0
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058a0d
mov ecx, dword [esp + 0x48]
cmp dword [ecx + 0x14], 0x10
jb 0x110589f8
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x11058a0d
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b3c], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058a5d
lea ecx, [esp + 0x4c]
push ecx
push 0x110b8af4
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058a5d
mov ecx, dword [esp + 0x4c]
cmp dword [ecx + 0x14], 0x10
jb 0x11058a48
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x11058a5d
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b40], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058aad
lea ecx, [esp + 0x50]
push ecx
push 0x110b8af8
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058aad
mov ecx, dword [esp + 0x50]
cmp dword [ecx + 0x14], 0x10
jb 0x11058a98
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x11058aad
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b44], eax
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058afd
lea ecx, [esp + 0x54]
push ecx
push 0x110b8afc
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058afd
mov ecx, dword [esp + 0x54]
cmp dword [ecx + 0x14], 0x10
jb 0x11058ae8
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xfffe7961
je 0x11058afd
imul ecx, esi, 0x4c
mov dword [ecx + 0x110f6b48], eax
inc esi
cmp esi, 0x77
jl 0x11058534
cmp byte [0x110d720f], 0
jne 0x110595bc
mov ecx, dword [0x110e54a0]
mov eax, 0x939a85c5
sub ecx, dword [0x110e5498]
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x89
jae 0x11058b44
push 0x89
call fcn.1105ad50
push 1
call fcn.1105aa70
xor ebx, ebx
mov edi, 0x77
push 0xa
lea eax, [esp + 0x14]
push eax
push edi
call fcn.1108a068
add esp, 0xc
push 0x110e2fe8
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110594ae
lea ecx, [esp + 0x54]
push ecx
push str.Ranks
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x110594ae
mov ecx, dword [esp + 0x54]
cmp dword [ecx + 0x14], 0x10
jb 0x11058ba5
mov ecx, dword [ecx]
call fcn.11011f90
cmp eax, 0xffffffff
je 0x110594ae
mov ecx, dword [0x110e5498]
imul esi, ebx, 0x1bc
push 0x110e2fe8
mov dword [esi + ecx + 0x154], eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058c0a
lea ecx, [esp + 0x50]
push ecx
push 0x110b7828
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058c0a
mov ecx, dword [esp + 0x50]
cmp dword [ecx + 0x14], 0x10
jb 0x11058c01
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x11058c0d
or ecx, 0xffffffff
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x150], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058c5d
lea ecx, [esp + 0x4c]
push ecx
push str.Level
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058c5d
mov ecx, dword [esp + 0x4c]
cmp dword [ecx + 0x14], 0x10
jb 0x11058c54
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x11058c60
or ecx, 0xffffffff
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x158], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058cb0
lea ecx, [esp + 0x48]
push ecx
push str.Stat
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058cb0
mov ecx, dword [esp + 0x48]
cmp dword [ecx + 0x14], 0x10
jb 0x11058ca7
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x11058cb3
or ecx, 0xffffffff
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x15c], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058d03
lea ecx, [esp + 0x44]
push ecx
push str.StatMag
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058d03
mov ecx, dword [esp + 0x44]
cmp dword [ecx + 0x14], 0x10
jb 0x11058cfa
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x11058d05
xor ecx, ecx
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x160], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058d55
lea ecx, [esp + 0x40]
push ecx
push str.Skill1
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058d55
mov ecx, dword [esp + 0x40]
cmp dword [ecx + 0x14], 0x10
jb 0x11058d4c
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x11058d58
or ecx, 0xffffffff
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x164], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058da8
lea ecx, [esp + 0x3c]
push ecx
push str.Skill1Mag
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058da8
mov ecx, dword [esp + 0x3c]
cmp dword [ecx + 0x14], 0x10
jb 0x11058d9f
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x11058daa
xor ecx, ecx
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x168], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058dfa
lea ecx, [esp + 0x38]
push ecx
push str.Type
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058dfa
mov ecx, dword [esp + 0x38]
cmp dword [ecx + 0x14], 0x10
jb 0x11058df1
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x11058dfc
xor ecx, ecx
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x16c], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058e4c
lea ecx, [esp + 0x34]
push ecx
push str.Skill2
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058e4c
mov ecx, dword [esp + 0x34]
cmp dword [ecx + 0x14], 0x10
jb 0x11058e43
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x11058e4f
or ecx, 0xffffffff
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x170], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058e9f
lea ecx, [esp + 0x30]
push ecx
push str.Skill2Mag
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058e9f
mov ecx, dword [esp + 0x30]
cmp dword [ecx + 0x14], 0x10
jb 0x11058e96
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x11058ea1
xor ecx, ecx
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x174], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058ef1
lea ecx, [esp + 0x2c]
push ecx
push 0x110b8ae4
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058ef1
mov ecx, dword [esp + 0x2c]
cmp dword [ecx + 0x14], 0x10
jb 0x11058ee8
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x11058ef3
xor ecx, ecx
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x178], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058f43
lea ecx, [esp + 0x28]
push ecx
push 0x110b8ae8
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058f43
mov ecx, dword [esp + 0x28]
cmp dword [ecx + 0x14], 0x10
jb 0x11058f3a
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x11058f45
xor ecx, ecx
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x17c], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058f95
lea ecx, [esp + 0x24]
push ecx
push 0x110b8aec
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058f95
mov ecx, dword [esp + 0x24]
cmp dword [ecx + 0x14], 0x10
jb 0x11058f8c
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x11058f97
xor ecx, ecx
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x180], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11058fe7
lea ecx, [esp + 0x20]
push ecx
push 0x110b8af0
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11058fe7
mov ecx, dword [esp + 0x20]
cmp dword [ecx + 0x14], 0x10
jb 0x11058fde
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x11058fe9
xor ecx, ecx
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x184], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11059039
lea ecx, [esp + 0x1c]
push ecx
push 0x110b8af4
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11059039
mov ecx, dword [esp + 0x1c]
cmp dword [ecx + 0x14], 0x10
jb 0x11059030
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x1105903b
xor ecx, ecx
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x188], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1105908b
lea ecx, [esp + 0x18]
push ecx
push 0x110b8af8
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x1105908b
mov ecx, dword [esp + 0x18]
cmp dword [ecx + 0x14], 0x10
jb 0x11059082
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x1105908d
xor ecx, ecx
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x18c], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110590dd
lea ecx, [esp + 0x14]
push ecx
push 0x110b8afc
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x110590dd
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x14], 0x10
jb 0x110590d4
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x110590df
xor ecx, ecx
mov eax, dword [0x110e5498]
mov edx, 0x110b8a84
push 0x110e2fe8
push 0x3f
mov dword [esi + eax + 0x190], ecx
lea ecx, [esp + 0x18]
mov eax, dword [0x110e5498]
add eax, 8
add eax, esi
push eax
push str.Error
call fcn.1100a410
mov ecx, dword [0x110e5498]
mov edx, str.Desc
push 0x110e2fe8
push 0xff
lea eax, [ecx + 8]
add eax, esi
mov dword [ecx + esi + 0x148], eax
lea ecx, [esp + 0x18]
mov eax, dword [0x110e5498]
add eax, 0x48
add eax, esi
push eax
push str.Error
call fcn.1100a410
mov ecx, dword [0x110e5498]
push 0x110e2fe8
lea eax, [ecx + 0x48]
add eax, esi
mov dword [ecx + esi + 0x14c], eax
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110591a0
lea ecx, [esp + 0x60]
push ecx
push str.Stat1
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x110591a0
mov ecx, dword [esp + 0x60]
cmp dword [ecx + 0x14], 0x10
jb 0x11059197
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x110591a3
or ecx, 0xffffffff
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x194], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110591f3
lea ecx, [esp + 0x64]
push ecx
push str.Stat1Mag
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x110591f3
mov ecx, dword [esp + 0x64]
cmp dword [ecx + 0x14], 0x10
jb 0x110591ea
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x110591f5
xor ecx, ecx
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x198], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11059245
lea ecx, [esp + 0x68]
push ecx
push str.Stat2
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11059245
mov ecx, dword [esp + 0x68]
cmp dword [ecx + 0x14], 0x10
jb 0x1105923c
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x11059248
or ecx, 0xffffffff
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x19c], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x11059298
lea ecx, [esp + 0x6c]
push ecx
push str.Stat2Mag
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x11059298
mov ecx, dword [esp + 0x6c]
cmp dword [ecx + 0x14], 0x10
jb 0x1105928f
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x1105929a
xor ecx, ecx
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x1a0], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110592ea
lea ecx, [esp + 0x70]
push ecx
push str.Skill3
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x110592ea
mov ecx, dword [esp + 0x70]
cmp dword [ecx + 0x14], 0x10
jb 0x110592e1
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x110592ed
or ecx, 0xffffffff
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x1a4], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1105933d
lea ecx, [esp + 0x74]
push ecx
push str.Skill3Mod
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x1105933d
mov ecx, dword [esp + 0x74]
cmp dword [ecx + 0x14], 0x10
jb 0x11059334
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x1105933f
xor ecx, ecx
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x1a8], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1105938f
lea ecx, [esp + 0x78]
push ecx
push str.Skill4
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x1105938f
mov ecx, dword [esp + 0x78]
cmp dword [ecx + 0x14], 0x10
jb 0x11059386
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x11059392
or ecx, 0xffffffff
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x1ac], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x110593e2
lea ecx, [esp + 0x7c]
push ecx
push str.Skill4Mod
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x110593e2
mov ecx, dword [esp + 0x7c]
cmp dword [ecx + 0x14], 0x10
jb 0x110593d9
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x110593e4
xor ecx, ecx
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x1b0], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1105943a
lea ecx, [esp + 0x80]
push ecx
push str.Skill5
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x1105943a
mov ecx, dword [esp + 0x80]
cmp dword [ecx + 0x14], 0x10
jb 0x11059431
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x1105943d
or ecx, 0xffffffff
mov eax, dword [0x110e5498]
push 0x110e2fe8
mov dword [esi + eax + 0x1b4], ecx
call fcn.1100a210
mov ecx, eax
call fcn.1100a300
test eax, eax
je 0x1105948d
lea ecx, [esp + 0x58]
push ecx
push str.Skill5Mod
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.11003200
test al, al
je 0x1105948d
mov ecx, dword [esp + 0x58]
cmp dword [ecx + 0x14], 0x10
jb 0x11059484
mov ecx, dword [ecx]
call fcn.11011f90
mov ecx, eax
jmp 0x1105948f
xor ecx, ecx
mov eax, dword [0x110e5498]
inc ebx
mov dword [esi + eax + 0x1b8], ecx
mov eax, dword [0x110e5498]
mov word [esi + eax], di
lea eax, [ebx + 1]
push eax
call fcn.1105aa70
inc edi
cmp edi, 0x100
jl 0x11058b52
mov ecx, dword [0x110e549c]
sub ecx, 0x1bc
mov dword [0x110e549c], ecx
cmp dword [0x110e54a0], ecx
je 0x11059506
mov eax, dword [0x110e5498]
cmp eax, ecx
jne 0x110594e5
call fcn.1105ac50
jmp 0x11059500
sub ecx, eax
mov eax, 0x939a85c5
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
call fcn.1105ad50
mov ecx, dword [0x110e549c]
cmp dword [0x110e5498], ecx
je 0x110595bc
lea eax, [esp + 0x14]
push eax
push 0x40
push 5
push 0x496823
call ebp
mov eax, 0x11057fe0
mov byte [0x496823], 0xe9
sub eax, 0x496828
mov dword [0x496824], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push 5
push 0x496823
call ebp
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push 0x496c2e
call ebp
mov eax, 0x11058040
sub eax, 0x496c32
mov dword [0x496c2e], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push 4
push 0x496c2e
call ebp
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push 0x496d12
call ebp
mov eax, 0x11058070
sub eax, 0x496d16
mov dword [0x496d12], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push 4
push 0x496d12
call ebp
push ebx
push 1
push str.Added_extra__d_perks_n
call fcn.1100ff40
add esp, 0xc
pop edi
mov byte [0x110d720f], 0
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret