Function at 0x1005e740
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008b8e5
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x18
mov eax, dword [0x100c8050]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x100c8b94], 0
je 0x1005f24c
mov eax, dword [0x100ca9c8]
mov edx, 0x100c8b94
push 0x22
mov ecx, str.portal2_cheeto
movss xmm2, dword [eax + 0x10]
movss xmm1, dword [eax + 0x14]
mulss xmm2, dword [0x100be664]
or dword [eax + 0x1c18], 3
mulss xmm1, dword [0x100be664]
mov dword [eax + 0x1c30], 0x3f000000
movss dword [eax + 0x1c28], xmm2
mov dword [eax + 0x1c34], 0x3f000000
movss dword [eax + 0x1c2c], xmm1
mov dword [eax + 0x1c1c], 2
mov dword [eax + 0x1c38], 0x43d68000
mov dword [eax + 0x1c3c], 0x43e10000
mov dword [eax + 0x1c20], 2
call fcn.10030ec0
add esp, 4
test al, al
jne 0x1005e81f
call fcn.10033470
jmp 0x1005f24c
mov edx, 0x100ca95d
mov ecx, str.bhop
call fcn.1004ceb0
mov edx, 0x100ca960
mov ecx, str.autostrafer
call fcn.1004ceb0
mov edx, 0x100ca95e
mov ecx, str.airacceleration_fix
call fcn.1004ceb0
test al, al
jne 0x1005e86a
cmp byte [0x100c8b96], al
je 0x1005e919
cmp byte [0x100ca95e], al
je 0x1005e919
jmp 0x1005e873
cmp byte [0x100ca95e], 0
je 0x1005e8d2
mov eax, dword [0x100caa6c]
mov cl, 0xe0
mov esi, dword [0x100caa80]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x1b], eax
mov byte [ebp - 0x1c], 0xb8
mov eax, dword [ebp - 0x1c]
mov dword [0x100ca9d8], eax
mov word [ebp - 0x17], 0xe0ff
movzx eax, word [ebp - 0x18]
mov word [0x100ca9dc], ax
lea eax, [ebp - 0x24]
push eax
push 0x40
push 7
push esi
mov byte [0x100ca9de], cl
call edi
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
movzx eax, word [ebp - 0x18]
mov word [esi + 4], ax
mov al, byte [ebp - 0x16]
mov byte [esi + 6], al
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
jmp 0x1005e909
mov esi, dword [0x100caa80]
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 7
push esi
call edi
mov eax, dword [0x100ca9d8]
mov dword [esi], eax
mov ax, word [0x100ca9dc]
mov word [esi + 4], ax
mov al, byte [0x100ca9de]
mov byte [esi + 6], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 7
push esi
call edi
push 7
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [0x100ca9c8]
mov ecx, dword [eax + 0x1b94]
cmp byte [ecx + 0x8f], 0
jne 0x1005e944
mov ecx, dword [ecx + 0x1a0]
neg ecx
sbb ecx, ecx
add ecx, 6
call fcn.1004d740
mov eax, dword [0x100ca9c8]
or dword [eax + 0x1c78], 1
sub esp, 8
mov dword [eax + 0x1c7c], 0x42f00000
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 0x3f800000
mov dword [ebp - 0x20], 0x40a00000
push eax
lea eax, [ebp - 0x24]
push eax
push ecx
call fcn.100502c0
mov esi, dword [0x100ca190]
add esp, 0x14
mov edi, dword fs:[0x2c]
test al, al
jne 0x1005e9b5
cmp byte [0x100c8b96], 0
je 0x1005ea1f
movss xmm0, dword [0x100c8abc]
subss xmm0, dword [0x100be708]
andps xmm0, xmmword [0x100beb50]
comiss xmm0, dword [0x100be62c]
jbe 0x1005ea1f
mov ecx, dword [edi + esi*4]
mov eax, dword [0x100cbe8c]
cmp eax, dword [ecx + 4]
jle 0x1005ea0d
push 0x100cbe8c
call fcn.10062207
add esp, 4
cmp dword [0x100cbe8c], 0xffffffff
jne 0x1005ea0d
mov dword [ebp - 4], 0
mov ecx, dword [0x100ca970]
push str.sv_paintairacceleration
mov eax, dword [ecx]
mov eax, dword [eax + 0x3c]
call eax
push 0x100cbe8c
mov dword [0x100cbe88], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100621bd
add esp, 4
mov eax, dword [0x100cbe88]
movss xmm0, dword [0x100c8abc]
movss dword [eax + 0x2c], xmm0
movss xmm1, dword [0x100be7a0]
xorps xmm0, xmm0
call fcn.10034080
push 0
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov ecx, str.DEFAULT
mov dword [ebp - 0x18], 0
call fcn.1004be30
add esp, 4
test al, al
je 0x1005eac1
mov ecx, dword [edi + esi*4]
mov eax, dword [0x100cbe8c]
cmp eax, dword [ecx + 4]
jle 0x1005eaab
push 0x100cbe8c
call fcn.10062207
add esp, 4
cmp dword [0x100cbe8c], 0xffffffff
jne 0x1005eaab
mov dword [ebp - 4], 1
mov ecx, dword [0x100ca970]
push str.sv_paintairacceleration
mov eax, dword [ecx]
mov eax, dword [eax + 0x3c]
call eax
push 0x100cbe8c
mov dword [0x100cbe88], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100621bd
add esp, 4
mov eax, dword [0x100cbe88]
mov dword [0x100c8abc], 0x40a00000
mov dword [eax + 0x2c], 0x40a00000
movss xmm1, dword [0x100be7a0]
xorps xmm0, xmm0
call fcn.10034080
push 0
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov ecx, str.CSGO
mov dword [ebp - 0x18], 0
call fcn.1004be30
add esp, 4
test al, al
je 0x1005eb63
mov ecx, dword [edi + esi*4]
mov eax, dword [0x100cbe8c]
cmp eax, dword [ecx + 4]
jle 0x1005eb4d
push 0x100cbe8c
call fcn.10062207
add esp, 4
cmp dword [0x100cbe8c], 0xffffffff
jne 0x1005eb4d
mov dword [ebp - 4], 2
mov ecx, dword [0x100ca970]
push str.sv_paintairacceleration
mov eax, dword [ecx]
mov eax, dword [eax + 0x3c]
call eax
push 0x100cbe8c
mov dword [0x100cbe88], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100621bd
add esp, 4
mov eax, dword [0x100cbe88]
mov dword [0x100c8abc], 0x41400000
mov dword [eax + 0x2c], 0x41400000
movss xmm1, dword [0x100be7a0]
xorps xmm0, xmm0
call fcn.10034080
push 0
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov ecx, str.BHOP
mov dword [ebp - 0x18], 0
call fcn.1004be30
add esp, 4
test al, al
je 0x1005ec05
mov ecx, dword [edi + esi*4]
mov eax, dword [0x100cbe8c]
cmp eax, dword [ecx + 4]
jle 0x1005ebef
push 0x100cbe8c
call fcn.10062207
add esp, 4
cmp dword [0x100cbe8c], 0xffffffff
jne 0x1005ebef
mov dword [ebp - 4], 3
mov ecx, dword [0x100ca970]
push str.sv_paintairacceleration
mov eax, dword [ecx]
mov eax, dword [eax + 0x3c]
call eax
push 0x100cbe8c
mov dword [0x100cbe88], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100621bd
add esp, 4
mov eax, dword [0x100cbe88]
mov dword [0x100c8abc], 0x461c4000
mov dword [eax + 0x2c], 0x461c4000
mov eax, dword [0x100ca9c8]
mov ecx, dword [eax + 0x1b94]
cmp byte [ecx + 0x8f], 0
jne 0x1005ec2b
mov ecx, dword [ecx + 0x1a0]
neg ecx
sbb ecx, ecx
add ecx, 6
call fcn.1004d740
sub esp, 8
mov dword [ebp - 0x24], 0x41200000
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x43200000
mov ecx, 0x100bdf30
push eax
lea eax, [ebp - 0x24]
push eax
push 0x100c8b40
call fcn.1004f740
movss xmm1, dword [0x100be7a0]
add esp, 0x14
xorps xmm0, xmm0
call fcn.10034080
push 0
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov ecx, str.Reset
mov dword [ebp - 0x18], 0
call fcn.1004be30
add esp, 4
test al, al
je 0x1005ec94
mov dword [0x100c8b40], 0x42b40000
mov eax, dword [0x100ca9c8]
mov ecx, dword [eax + 0x1b94]
cmp byte [ecx + 0x8f], 0
jne 0x1005ecba
mov ecx, dword [ecx + 0x1a0]
neg ecx
sbb ecx, ecx
add ecx, 6
call fcn.1004d740
mov ecx, str.Portalgun_Chams
call fcn.10033c60
mov edx, 0x100c8a9c
mov ecx, str.Portalgun_Chams
call fcn.1004ceb0
movss xmm1, dword [0x100be7a0]
xorps xmm0, xmm0
call fcn.10034080
push 0
push 0
mov edx, 0x100c8aa4
mov ecx, str.Color
call fcn.1005e4b0
movss xmm1, dword [0x100be7a0]
add esp, 8
xorps xmm0, xmm0
call fcn.10034080
mov eax, dword [0x100ca9c8]
mov edx, str.Normal
or dword [eax + 0x1c78], 1
xor esi, esi
mov dword [eax + 0x1c7c], 0x42f00000
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005ed30
sub ecx, edi
inc edx
add edx, ecx
inc esi
cmp byte [edx], al
jne 0x1005ed26
push ecx
push esi
sub esp, 8
mov edx, 0x100c8aa0
call fcn.1004e4e0
mov eax, dword [0x100ca9c8]
mov ecx, str.Chell_Chams
mov eax, dword [eax + 0x1b94]
dec dword [eax + 0xc0]
call fcn.10033c60
mov edx, 0x100c8b44
mov ecx, str.Chell_Chams
call fcn.1004ceb0
movss xmm1, dword [0x100be7a0]
xorps xmm0, xmm0
call fcn.10034080
push 0
push 0
mov edx, 0x100c8b4c
mov ecx, str.Color
call fcn.1005e4b0
movss xmm1, dword [0x100be7a0]
add esp, 0x18
xorps xmm0, xmm0
call fcn.10034080
mov eax, dword [0x100ca9c8]
mov edx, str.Normal
or dword [eax + 0x1c78], 1
xor esi, esi
mov dword [eax + 0x1c7c], 0x42f00000
nop dword [eax]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005edd5
sub ecx, edi
inc edx
add edx, ecx
inc esi
cmp byte [edx], al
jne 0x1005edd0
push ecx
push esi
sub esp, 8
mov edx, 0x100c8b48
call fcn.1004e4e0
mov eax, dword [0x100ca9c8]
mov ecx, str.Wheatley_Chams
mov eax, dword [eax + 0x1b94]
dec dword [eax + 0xc0]
call fcn.10033c60
mov edx, 0x100c8b20
mov ecx, str.Wheatley_Chams
call fcn.1004ceb0
movss xmm1, dword [0x100be7a0]
xorps xmm0, xmm0
call fcn.10034080
push 0
push 0
mov edx, 0x100c8b28
mov ecx, str.Color
call fcn.1005e4b0
movss xmm1, dword [0x100be7a0]
add esp, 0x18
xorps xmm0, xmm0
call fcn.10034080
mov eax, dword [0x100ca9c8]
mov edx, str.Normal
or dword [eax + 0x1c78], 1
xor esi, esi
mov dword [eax + 0x1c7c], 0x42f00000
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005ee77
sub ecx, edi
inc edx
add edx, ecx
inc esi
cmp byte [edx], al
jne 0x1005ee72
push ecx
push esi
sub esp, 8
mov edx, 0x100c8b24
call fcn.1004e4e0
mov ecx, dword [0x100ca9c8]
add esp, 0x10
mov eax, dword [ecx + 0x1b94]
dec dword [eax + 0xc0]
mov ecx, dword [ecx + 0x1b94]
cmp byte [ecx + 0x8f], 0
jne 0x1005eecd
mov ecx, dword [ecx + 0x1a0]
neg ecx
sbb ecx, ecx
add ecx, 6
call fcn.1004d740
mov edx, 0x100ca95c
mov ecx, str.Mat_Ambient_Light_modification
call fcn.1004ceb0
movss xmm1, dword [0x100be7a0]
xorps xmm0, xmm0
call fcn.10034080
push str.matambient
push 0
mov edx, 0x100c8b7c
mov ecx, str.Color
call fcn.1005e4b0
mov eax, dword [0x100ca9c8]
add esp, 8
mov ecx, dword [eax + 0x1b94]
cmp byte [ecx + 0x8f], 0
jne 0x1005ef2b
mov ecx, dword [ecx + 0x1a0]
neg ecx
sbb ecx, ecx
add ecx, 6
call fcn.1004d740
mov edx, 0x100ca95f
mov ecx, str.Trails
call fcn.1004ceb0
movss xmm1, dword [0x100be7a0]
xorps xmm0, xmm0
call fcn.10034080
push str.trails
push 0
mov edx, 0x100c8b64
mov ecx, str.Color
call fcn.1005e4b0
movss xmm1, dword [0x100be7a0]
xorps xmm0, xmm0
call fcn.10034080
mov eax, dword [0x100ca9c8]
mov ecx, str.Life_time
mov dword [ebp - 0x24], 0x3f800000
mov dword [ebp - 0x20], 0x41700000
or dword [eax + 0x1c78], 1
mov dword [eax + 0x1c7c], 0x42f00000
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x100c8a98
call fcn.1004f740
mov eax, dword [0x100ca9c8]
add esp, 0x14
mov ecx, dword [eax + 0x1b94]
cmp byte [ecx + 0x8f], 0
jne 0x1005efd4
mov ecx, dword [ecx + 0x1a0]
neg ecx
sbb ecx, ecx
add ecx, 6
call fcn.1004d740
mov ecx, str.Player1:
call fcn.10033c60
push str.Player1:
call fcn.1004b6e0
movss xmm1, dword [0x100be7a0]
add esp, 4
xorps xmm0, xmm0
call fcn.10034080
push str.p1c1
push 2
mov edx, 0x100c8ac0
mov ecx, str.Portal_1
call fcn.1005e4b0
movss xmm1, dword [0x100be7a0]
xorps xmm0, xmm0
call fcn.10034080
push str.p1c2
push 2
mov edx, 0x100c8ad8
mov ecx, str.Portal_2
call fcn.1005e4b0
mov eax, dword [0x100ca9c8]
mov ecx, str.Player2:
mov eax, dword [eax + 0x1b94]
dec dword [eax + 0xc0]
call fcn.10033c60
push str.Player2:
call fcn.1004b6e0
movss xmm1, dword [0x100be7a0]
add esp, 0x14
xorps xmm0, xmm0
call fcn.10034080
push str.p2c1
push 2
mov edx, 0x100c8af0
mov ecx, str.Portal_1
call fcn.1005e4b0
movss xmm1, dword [0x100be7a0]
xorps xmm0, xmm0
call fcn.10034080
push str.p2c2
push 2
mov edx, str.d
mov ecx, str.Portal_2
call fcn.1005e4b0
mov ecx, dword [0x100ca9c8]
add esp, 0x10
mov eax, dword [ecx + 0x1b94]
dec dword [eax + 0xc0]
mov ecx, dword [ecx + 0x1b94]
cmp byte [ecx + 0x8f], 0
jne 0x1005f0e1
mov ecx, dword [ecx + 0x1a0]
neg ecx
sbb ecx, ecx
add ecx, 6
call fcn.1004d740
push 0
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov ecx, str.save
mov dword [ebp - 0x18], 0
call fcn.1004be30
add esp, 4
test al, al
je 0x1005f132
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 6
movups xmmword [ecx], xmm0
push str.config
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.10013180
call fcn.10009cf0
add esp, 0x18
movss xmm1, dword [0x100be7a0]
xorps xmm0, xmm0
call fcn.10034080
push 0
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov ecx, str.load
mov dword [ebp - 0x18], 0
call fcn.1004be30
add esp, 4
test al, al
je 0x1005f193
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 6
movups xmmword [ecx], xmm0
push str.config
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.10013180
call fcn.100095f0
add esp, 0x18
mov eax, dword [0x100ca9c8]
mov ecx, dword [eax + 0x1b94]
cmp byte [ecx + 0x8f], 0
jne 0x1005f1b9
mov ecx, dword [ecx + 0x1a0]
neg ecx
sbb ecx, ecx
add ecx, 6
call fcn.1004d740
push 0
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov ecx, str.randomize_rainbow
mov dword [ebp - 0x18], 0
call fcn.1004be30
add esp, 4
test al, al
je 0x1005f1e2
call fcn.10009060
movss xmm1, dword [0x100be7a0]
xorps xmm0, xmm0
call fcn.10034080
push 0
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov ecx, str.sync_rainbow
mov dword [ebp - 0x18], 0
call fcn.1004be30
add esp, 4
test al, al
je 0x1005f240
mov edx, dword [0x100c8fb0]
mov ecx, dword [0x100c8fac]
cmp ecx, edx
je 0x1005f240
nop word [eax + eax]
mov eax, dword [ecx]
add ecx, 4
mov dword [eax + 0x14], 0
cmp ecx, edx
jne 0x1005f230
call fcn.10033470
mov byte [0x100c8b96], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10061d94
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret