Function at 0x1000c0b0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006bd75
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
mov eax, dword [0x100ab018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x100ab8da], 0
je 0x1000d5f0
mov esi, dword [0x100acd8c]
test esi, esi
je 0x1000c1a9
push 8
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], esi
push eax
push dword [0x100acb90]
call dword [sym.imp.KERNEL32.dll_K32QueryWorkingSetEx]
test eax, eax
je 0x1000c1a9
test byte [ebp - 0x20], 1
je 0x1000c1a9
mov esi, dword [esi]
sub esi, 0xffffff80
cmp esi, dword [0x100ae5a4]
je 0x1000c1a9
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
mov edx, esi
call fcn.10002e70
add esp, 4
test eax, eax
je 0x1000c1a3
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 0
lea edx, [edi + 4]
call fcn.10002e70
add esp, 4
test eax, eax
je 0x1000c1a3
push 0
push 0
push 0xff
push str.Freedom_v0.94.2_DEV__6c0ebbc__is_Loading_
push dword [ebp - 0x18]
lea eax, [edi + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x100
jae 0x1000d61c
mov byte [eax + str.Freedom_v0.94.2_DEV__6c0ebbc__is_Loading_], 0
mov dword [0x100ae5a4], esi
mov ecx, dword [0x100ae15c]
mov edi, ecx
mov esi, dword [0x100ae168]
mov dword [ebp - 0x18], ecx
test ecx, ecx
jne 0x1000c1d2
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1000c1cd
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + 0x44]
mov ecx, dword [eax]
mov edi, ecx
mov dword [ebp - 0x18], ecx
call fcn.1001f180
lea eax, [ebp - 0x18]
lea ecx, [esi + 0x1c90]
push eax
call fcn.100287d0
mov eax, dword [esi + 0x124c]
mov ecx, dword [eax + 0x270]
mov eax, dword [edi + 0x30]
push dword [eax + 4]
call fcn.10030d10
mov eax, dword [0x100ae168]
xor edx, edx
push 0x41
mov ecx, str.Freedom
or dword [eax + 0x1c0c], 1
mov dword [eax + 0x1c1c], 0
mov dword [eax + 0x1c20], 0
mov dword [eax + 0x1c24], 0
mov dword [eax + 0x1c28], 0
mov dword [eax + 0x1c10], 2
call fcn.1001c510
add esp, 4
push str.Freedom_v0.94.2_DEV__6c0ebbc__is_Loading_
push 0x1009f1d4
call fcn.10039460
movss xmm0, dword [0x100a0e7c]
add esp, 8
movss xmm1, dword [0x100ace0c]
comiss xmm0, xmm1
jbe 0x1000c2f8
mulss xmm1, dword [0x100a0f6c]
sub esp, 8
addss xmm1, dword [0x100a0e0c]
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
push str.Memory_Scan:__.0f__
push 0x20
push 0x100ae5a8
call fcn.10013a00
mov eax, dword [0x100ae168]
add esp, 0x14
mov edx, dword [eax + 0x124c]
mov ecx, edx
cmp dword [ecx + 0x198], 0
jne 0x1000c2ca
cmp dword [eax + 0x1f98], 0
mov eax, 0x234
je 0x1000c2cf
mov eax, 0x204
movss xmm0, dword [ecx + eax]
lea ecx, [ebp - 0x24]
subss xmm0, dword [edx + 0xf8]
mov dword [ebp - 0x20], 0
movss dword [ebp - 0x24], xmm0
movss xmm0, dword [0x100ace0c]
call fcn.1003b6e0
mov esi, dword [0x100ae168]
mov eax, dword [esi + 0x124c]
movss xmm1, dword [eax + 0x24]
addss xmm1, dword [eax + 0x1c]
movss xmm0, dword [eax + 0x18]
or dword [esi + 0x1c0c], 1
movss dword [esi + 0x1c1c], xmm0
mov dword [esi + 0x1c24], 0
movss dword [esi + 0x1c20], xmm1
mov dword [esi + 0x1c28], 0
mov dword [esi + 0x1c10], 8
cmp byte [eax + 0xb3], 0
jne 0x1000d5e6
mov ecx, dword [eax + 0xec]
xor edx, edx
mov eax, dword [eax + 0xf4]
push dword [eax + ecx*4 - 4]
mov ecx, str.settings
call fcn.10013b60
add esp, 4
mov edi, eax
cmp byte [esi + 0xaff], 0
je 0x1000c3a2
cmp byte [esi + 0x19cc], 0
jne 0x1000c3a2
mov ecx, 0x20
call fcn.10016c50
test al, al
je 0x1000c3a2
mov edx, 1
mov ecx, edi
call fcn.10022940
mov ecx, edi
call fcn.10022bb0
test al, al
je 0x1000d5e6
cmp byte [0x100ab8e0], 0
jne 0x1000c3d0
cmp byte [0x100ab930], 0
jne 0x1000c3d0
cmp byte [0x100ab908], 0
jne 0x1000c3d0
xor al, al
jmp 0x1000c3d5
mov eax, 1
push eax
push 0
push str.Difficulty
call fcn.1000d670
cmp dword [0x100ace2c], 0
je 0x1000c401
movzx eax, byte [0x100acf51]
push eax
push 1
push str.Relax
call fcn.1000d670
jmp 0x1000c40b
push str.Relax
call fcn.1000d700
cmp dword [0x100ace2c], 0
je 0x1000c42a
movzx eax, byte [0x100acf50]
push eax
push 2
push str.Aimbot
call fcn.1000d670
jmp 0x1000c434
push str.Aimbot
call fcn.1000d700
cmp dword [0x100acf28], 0
je 0x1000c453
movzx eax, byte [0x100acf56]
push eax
push 3
push str.Timewarp
call fcn.1000d670
jmp 0x1000c45d
push str.Timewarp
call fcn.1000d700
cmp dword [0x100acf14], 0
je 0x1000c47c
movzx eax, byte [0x100acf52]
push eax
push 4
push str.Replay
call fcn.1000d670
jmp 0x1000c486
push str.Replay
call fcn.1000d700
cmp byte [0x100acf54], 0
jne 0x1000c4a5
cmp byte [0x100acf55], 0
jne 0x1000c4a5
cmp byte [0x100ae159], 0
jne 0x1000c4a5
xor al, al
jmp 0x1000c4aa
mov eax, 1
push eax
push 5
push 0x1009e3bc
call fcn.1000d670
movzx eax, byte [0x100acf57]
push eax
push 6
push str.Misc
call fcn.1000d670
cmp dword [0x100ae5c8], 7
lea eax, [ebp - 0x24]
push eax
sete dl
mov dword [ebp - 0x24], 0
push 1
mov ecx, str.About
mov dword [ebp - 0x20], 0
call fcn.10042f60
add esp, 8
test al, al
je 0x1000c510
mov eax, dword [0x100ae168]
mov dword [0x100ae5c8], 7
or dword [eax + 0x1c0c], 0x20
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
push 1
xor dl, dl
mov dword [ebp - 0x20], 0
mov ecx, str.Debug
call fcn.10042f60
add esp, 8
test al, al
je 0x1000c54c
mov ecx, dword [0x100ae168]
mov byte [0x100acb97], 1
mov ecx, dword [ecx + 0x20]
call fcn.10027810
mov ecx, dword [0x100ae168]
lea edx, [ebp - 0x24]
mov eax, dword [ecx + 0x124c]
movss xmm0, dword [ecx + 0xfb4]
mov ecx, 5
mulss xmm0, dword [0x100a0f4c]
movss xmm1, dword [eax + 0x24]
movss dword [ebp - 0x20], xmm1
movss dword [ebp - 0x24], xmm0
call fcn.10014980
mov esi, dword [0x100ae168]
push 5
mov ecx, dword [esi + 0x124c]
mov eax, ecx
mov edx, dword [esi + 0x1c0c]
or edx, 2
mov dword [esi + 0x1c2c], 0
mov dword [esi + 0x1c0c], edx
or edx, 1
mov dword [esi + 0x1c30], 0
mov dword [esi + 0x1c14], 1
movss xmm0, dword [ecx + 0x18]
addss xmm0, dword [eax + 0x20]
movss xmm1, dword [ecx + 0x1c]
mov ecx, str.tab_content
mov dword [esi + 0x1c0c], edx
xor edx, edx
movss dword [esi + 0x1c20], xmm1
mov dword [esi + 0x1c24], 0
movss dword [esi + 0x1c1c], xmm0
mov dword [esi + 0x1c28], 0
mov dword [esi + 0x1c10], 1
call fcn.1001c510
add esp, 4
mov ecx, 1
call fcn.10014a00
cmp dword [0x100ae5c8], 0
jne 0x1000c67d
mov eax, dword [0x100ae168]
lea edx, [ebp - 0x24]
mov ecx, 0xe
movss xmm0, dword [eax + 0xfb4]
mulss xmm0, dword [0x100a0e2c]
movss dword [ebp - 0x24], xmm0
movss dword [ebp - 0x20], xmm0
call fcn.10014980
mov edx, 0x100ab8e0
call fcn.1000d7d0
mov edx, 0x100ab930
call fcn.1000d7d0
mov edx, 0x100ab908
call fcn.1000d7d0
mov ecx, 1
call fcn.10014a00
cmp dword [0x100ae5c8], 1
jne 0x1000c8cc
mov edx, 0x100acf51
mov ecx, str.Enable
call fcn.1003ae10
test al, al
je 0x1000c6c0
cmp byte [0x100acf51], 0
je 0x1000c6ad
call fcn.10007f10
jmp 0x1000c6b2
call fcn.10007f60
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x40a00000
call fcn.1003b9b0
mov eax, dword [0x100ae168]
movss xmm3, dword [0x100a0fd4]
push 0
push 0
movss xmm2, dword [eax + 0xfb4]
push 0x1009f29c
push ecx
lea ecx, [ebp - 0x24]
mov dword [esp], 0xbf800000
push ecx
mov ecx, dword [eax + 0xfb0]
call fcn.10036630
movss xmm0, dword [ebp - 0x24]
addss xmm0, dword [0x100a0e80]
cvttss2si eax, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x100a0ec0]
call fcn.10021ab0
push 0
push 0
push 0x14
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
push 2
push 0x100ab8d8
xor edx, edx
mov dword [ebp - 0x20], 0
mov ecx, str.Left_Click
call fcn.1003f710
push 0
push 0
push 0x14
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
push 2
push 0x100ab8d4
xor edx, edx
mov dword [ebp - 0x20], 0
mov ecx, str.Right_Click
call fcn.1003f710
add esp, 0x30
call fcn.10021b10
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x40a00000
call fcn.1003b9b0
cmp dword [0x100ab974], 0x73
mov ecx, str.SingleTap
sete dl
call fcn.1003b230
test al, al
je 0x1000c7eb
push str.SingleTap_Mode
push 0x10073d54
push 0x100abc10
mov dword [0x100ab974], 0x73
call fcn.1000ace0
mov ecx, dword [0x100ae168]
add esp, 0xc
mov ecx, dword [ecx + 0x20]
call fcn.10027810
movss xmm1, dword [0x100a0fe4]
xorps xmm0, xmm0
call fcn.10021a00
cmp dword [0x100ab974], 0x61
mov ecx, str.Alternate
sete dl
call fcn.1003b230
test al, al
je 0x1000c842
push str.Alternate_Mode
push 0x10073d54
push 0x100abc10
mov dword [0x100ab974], 0x61
call fcn.1000ace0
mov ecx, dword [0x100ae168]
add esp, 0xc
mov ecx, dword [ecx + 0x20]
call fcn.10027810
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x40a00000
call fcn.1003b9b0
mov edx, 0x100ab8db
mov ecx, str.Variable_Unstable_Rate
call fcn.1003ae10
test al, al
je 0x1000c879
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x40a00000
call fcn.1003b9b0
mov al, byte [0x100ab8db]
mov byte [ebp - 0x2d], al
test al, al
jne 0x1000c8a0
call fcn.1001f2c0
mov edx, 0x100ae158
mov ecx, str.Jumping_Unstable_Rate_Window
call fcn.1003ae10
test al, al
je 0x1000c8c1
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
cmp byte [ebp - 0x2d], 0
jne 0x1000c8cc
call fcn.1001f320
cmp dword [0x100ae5c8], 2
jne 0x1000ca19
mov edx, 0x100acf50
mov ecx, str.Enable
call fcn.1003ae10
test al, al
je 0x1000c90f
cmp byte [0x100acf50], 0
je 0x1000c8fc
call fcn.10007f10
jmp 0x1000c901
call fcn.10007f60
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x40a00000
call fcn.1003b9b0
movss xmm3, dword [0x100a0f20]
mov edx, 0x100ab970
movss xmm2, dword [0x100a0e0c]
push ecx
push str.Cursor_Delay:__.2f
mov ecx, str.fraction_modifier
call fcn.1000bfc0
add esp, 8
call fcn.10019700
test al, al
je 0x1000c964
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x3f000000
call fcn.1003b9b0
mov eax, dword [0x100ae168]
movss xmm0, dword [eax + 0xfb4]
mulss xmm0, dword [0x100a0f48]
call fcn.10021ab0
sub esp, 0x10
call fcn.1003d260
add esp, 0x10
call fcn.10021b10
call fcn.10019700
test al, al
je 0x1000c9bb
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
mov ecx, dword [0x100ae168]
movss xmm0, dword [ecx + 0xba8]
mov eax, dword [ecx + 0x124c]
addss xmm0, xmm0
movss xmm1, dword [eax + 0x24]
addss xmm0, dword [ecx + 0xfb4]
addss xmm0, dword [ecx + 0xbb8]
mov byte [eax + 0xb0], 1
mov eax, dword [ecx + 0x124c]
subss xmm1, xmm0
movss xmm0, dword [eax + 0x1c]
subss xmm0, dword [eax + 0x80]
mov byte [eax + 0x139], 1
addss xmm0, xmm1
movss dword [eax + 0xfc], xmm0
cmp dword [0x100ae5c8], 3
jne 0x1000cb0b
mov edx, 0x100acf56
mov ecx, str.Enable
call fcn.1003ae10
test al, al
je 0x1000ca5c
cmp byte [0x100acf56], 0
je 0x1000ca49
call fcn.1000a170
jmp 0x1000ca4e
call fcn.1000a240
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x40a00000
call fcn.1003b9b0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100ac4b4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100aee90]
cmp eax, dword [ecx + 4]
jg 0x1000d621
mov eax, dword [0x100ae168]
movss xmm0, dword [eax + 0xfb4]
mulss xmm0, dword [0x100a0f48]
call fcn.10021ab0
push ecx
push str.Timewarp_Scale:__.2lf
push 0x100abd08
push 0x100abd00
push 0x100aee88
mov edx, 9
mov ecx, str.timewarp_scale
call fcn.1003cda0
add esp, 0x14
test al, al
je 0x1000caef
movsd xmm0, qword [0x100aee88]
mulsd xmm0, qword [0x100a0f00]
movsd qword [0x100ab968], xmm0
call fcn.10021b10
call fcn.10019700
test al, al
je 0x1000cb0b
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
cmp dword [0x100ae5c8], 4
jne 0x1000ce41
push str.Open_Replay_Preview_in_game_to_Select_a_Replay
push 0x1009f1d4
call fcn.10039460
add esp, 8
mov ecx, 0x400
call fcn.10016c50
test al, al
je 0x1000cb45
push str.Selected_Replay
call fcn.100227e0
add esp, 4
movss xmm0, dword [0x100abc04]
push str.Mods
push dword [0x100abc08]
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push str.Replay_Author
push str._s____.2f______ux____s
call fcn.10039460
add esp, 0x18
mov ecx, 0x400
call fcn.10016c50
test al, al
je 0x1000cb90
push str.Player__Accuracy__Mods
call fcn.100227e0
add esp, 4
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x40000000
call fcn.1003b9b0
mov edx, 0x100acf52
mov ecx, str.Enable
call fcn.1003ae10
test al, al
je 0x1000cc77
cmp byte [0x100acf52], 0
je 0x1000cc64
cmp byte [0x100ae280], 0
jne 0x1000cc11
mov eax, dword [0x100ae26c]
test eax, eax
je 0x1000cc11
push eax
push dword [0x100ae260]
push 0x100ae270
call fcn.1004f070
mov edx, dword [0x100ae264]
add esp, 0xc
mov ecx, dword [0x100ae260]
push dword [0x100ae26c]
call fcn.10002f40
add esp, 4
mov byte [0x100ae280], 1
mov ecx, 0x100ae2a8
call fcn.100010c0
cmp byte [0x100ae47c], 0
jne 0x1000cc69
mov eax, dword [0x100ae468]
test eax, eax
je 0x1000cc69
push eax
push dword [0x100ae45c]
push 0x100ae46c
call fcn.1004f070
mov edx, dword [0x100ae460]
add esp, 0xc
mov ecx, dword [0x100ae45c]
push dword [0x100ae468]
call fcn.10002f40
add esp, 4
mov byte [0x100ae47c], 1
jmp 0x1000cc69
call fcn.1000a030
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
mov ecx, 0x400
call fcn.10016c50
test al, al
je 0x1000cc92
push str.Usage:_Open_Replay_Preview_in_game_to_Select_a_Replay
call fcn.100227e0
add esp, 4
mov eax, dword [0x100ae168]
movss xmm1, dword [0x100a0fe4]
movss xmm0, dword [eax + 0xfb4]
mulss xmm0, dword [0x100a0f30]
call fcn.10021a00
cmp byte [0x100acf52], 0
jne 0x1000ccc2
call fcn.1001f2c0
mov edx, 0x100acf53
mov ecx, str.Hardrock
call fcn.1003ae10
test al, al
je 0x1000cd68
cmp byte [0x100abaa0], 0
je 0x1000cd68
mov ecx, dword [0x100aba8c]
mov eax, dword [0x100aba88]
cmp eax, ecx
je 0x1000cd68
movss xmm5, dword [0x100ace88]
movss xmm6, dword [0x100a1110]
movss xmm7, dword [0x100a0f88]
nop dword [eax]
movss xmm1, dword [eax + 0xc]
movaps xmm0, xmm7
subss xmm1, dword [0x100ace7c]
movss xmm4, dword [eax + 8]
subss xmm4, dword [0x100ace78]
divss xmm1, xmm5
divss xmm4, xmm5
subss xmm0, xmm1
movaps xmm1, xmm5
mulss xmm4, xmm5
addss xmm4, dword [0x100ace78]
andps xmm0, xmm6
mulss xmm1, xmm0
addss xmm1, dword [0x100ace7c]
movss dword [eax + 8], xmm4
movss dword [eax + 0xc], xmm1
add eax, 0x18
cmp eax, ecx
jne 0x1000cd10
mov ecx, 0x400
call fcn.10016c50
test al, al
je 0x1000cd83
push str.Convert_Replay_to_from_Hardrock
call fcn.100227e0
add esp, 4
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x40000000
call fcn.1003b9b0
mov edx, 0x100ab979
mov ecx, str.Replay_Aim
call fcn.1003ae10
test al, al
je 0x1000cdba
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
mov ecx, 0x400
call fcn.10016c50
test al, al
je 0x1000cdd5
push str.Aim_According_to_Replay_Data
call fcn.100227e0
add esp, 4
mov eax, dword [0x100ae168]
movss xmm1, dword [0x100a0fe4]
movss xmm0, dword [eax + 0xfb4]
mulss xmm0, dword [0x100a0f30]
call fcn.10021a00
mov edx, 0x100ab978
mov ecx, str.Replay_Keys
call fcn.1003ae10
test al, al
je 0x1000ce18
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
mov ecx, 0x400
call fcn.10016c50
test al, al
je 0x1000ce33
push str.Press_Keys_According_to_Replay_Data
call fcn.100227e0
add esp, 4
cmp byte [0x100acf52], 0
jne 0x1000ce41
call fcn.1001f320
cmp dword [0x100ae5c8], 5
jne 0x1000d0bb
mov esi, dword [0x100acf4c]
test esi, esi
jne 0x1000ce5d
call fcn.1001f2c0
mov edx, 0x100acf54
mov ecx, str.Unmod_Flashlight
call fcn.1003ae10
test al, al
je 0x1000ce93
cmp byte [0x100acf54], 0
je 0x1000ce80
call fcn.1000a370
jmp 0x1000ce85
call fcn.1000a410
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
test esi, esi
jne 0x1000ce9c
call fcn.1001f320
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x40a00000
call fcn.1003b9b0
mov esi, dword [0x100aceec]
test esi, esi
jne 0x1000cec1
call fcn.1001f2c0
mov edx, 0x100acf55
mov ecx, str.Unmod_Hidden
call fcn.1003ae10
test al, al
je 0x1000cf4d
cmp byte [0x100acf55], 0
je 0x1000cf3a
cmp byte [0x100ae280], 0
jne 0x1000cf24
mov eax, dword [0x100ae26c]
test eax, eax
je 0x1000cf24
push eax
push dword [0x100ae260]
push 0x100ae270
call fcn.1004f070
mov edx, dword [0x100ae264]
add esp, 0xc
mov ecx, dword [0x100ae260]
push dword [0x100ae26c]
call fcn.10002f40
add esp, 4
mov byte [0x100ae280], 1
mov ecx, 0x100ae2a8
call fcn.100010c0
mov ecx, 0x100ae434
call fcn.100010c0
jmp 0x1000cf3f
call fcn.10009bd0
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
test esi, esi
jne 0x1000cf56
call fcn.1001f320
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x40a00000
call fcn.1003b9b0
mov esi, dword [0x100acf20]
test esi, esi
jne 0x1000cf7b
call fcn.1001f2c0
push str.Score_Multiplier
call fcn.10039460
add esp, 4
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x20], 0x40a00000
call fcn.1003b9b0
mov ecx, 0x46
call fcn.1001f8a0
mov edx, 0x100ae159
mov ecx, str.Enable
call fcn.1003ae10
test al, al
je 0x1000cfde
cmp byte [0x100ae159], 0
je 0x1000cfcb
call fcn.1000a0b0
jmp 0x1000cfd0
call fcn.1000a100
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
mov eax, dword [0x100ae168]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x40a00000
mov eax, dword [eax + 0x124c]
dec dword [eax + 0xec]
call fcn.1003b9b0
cmp byte [0x100ae159], 0
jne 0x1000d028
call fcn.1001f290
movaps xmm0, xmmword [0x100a10e0]
lea edx, [ebp - 0x2c]
xor ecx, ecx
movups xmmword [ebp - 0x2c], xmm0
call fcn.10014860
movss xmm3, dword [0x100a0f6c]
xorps xmm2, xmm2
push ecx
push str.Score_Multiplier:__.0f
mov edx, 0x100ab97c
mov ecx, str.score_multiplier
call fcn.1000bfc0
add esp, 8
mov ecx, 0x400
call fcn.10016c50
test al, al
je 0x1000d066
push str.Hold_Ctrl_To_Set_a_Custom_Value
call fcn.100227e0
add esp, 4
call fcn.10019700
test al, al
je 0x1000d07d
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
cmp byte [0x100ae159], 0
jne 0x1000d0b2
mov ecx, 1
call fcn.100148c0
mov edx, dword [0x100ae168]
dec dword [edx + 0x1ca8]
mov eax, dword [edx + 0x1cb0]
mov ecx, dword [edx + 0x1ca8]
mov eax, dword [eax + ecx*4 - 4]
mov dword [edx + 0x1b98], eax
test esi, esi
jne 0x1000d0bb
call fcn.1001f320
cmp dword [0x100ae5c8], 6
jne 0x1000d596
push str.Discord_RPC_Settings
call fcn.10039460
add esp, 4
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x20], 0x40a00000
call fcn.1003b9b0
mov edx, 0x100acf57
mov ecx, str.Enable
call fcn.1003ae10
test al, al
je 0x1000d121
cmp byte [0x100acf57], 0
je 0x1000d10e
call fcn.10009af0
jmp 0x1000d113
call fcn.10009b40
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x40a00000
call fcn.1003b9b0
cmp byte [0x100acf57], 0
jne 0x1000d15a
call fcn.1001f290
movaps xmm0, xmmword [0x100a10e0]
lea edx, [ebp - 0x2c]
xor ecx, ecx
movups xmmword [ebp - 0x2c], xmm0
call fcn.10014860
mov eax, dword [0x100ae168]
movss xmm0, dword [eax + 0xfb4]
mulss xmm0, dword [0x100a0f48]
call fcn.10021ab0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
push 0x200
push 0x100adb58
mov edx, str.State
mov dword [ebp - 0x20], 0
mov ecx, str.rpc_state
call fcn.1003f710
add esp, 0x18
test al, al
je 0x1000d1d1
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
push 0x100aced8
mov edx, 0x100adb58
mov ecx, 0x100ad758
call fcn.10009a70
add esp, 4
push 0
push 0
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
push 0x200
push 0x100ad158
mov edx, str.Large_Text
mov dword [ebp - 0x20], 0
mov ecx, str.rpc_large_text
call fcn.1003f710
add esp, 0x18
test al, al
je 0x1000d22e
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
push 0x100acee4
mov edx, 0x100ad158
mov ecx, 0x100add58
call fcn.10009a70
add esp, 4
push 0
push 0
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
push 0x200
push 0x100acf58
mov edx, str.Small_Text
mov dword [ebp - 0x20], 0
mov ecx, str.rpc_small_text
call fcn.1003f710
add esp, 0x18
test al, al
je 0x1000d28b
mov ecx, dword [0x100ae168]
mov ecx, dword [ecx + 0x20]
call fcn.10027810
push 0x100acedc
mov edx, 0x100acf58
mov ecx, 0x100ad358
call fcn.10009a70
add esp, 4
cmp byte [0x100acf57], 0
jne 0x1000d2c0
mov ecx, 1
call fcn.100148c0
mov edx, dword [0x100ae168]
dec dword [edx + 0x1ca8]
mov eax, dword [edx + 0x1cb0]
mov ecx, dword [edx + 0x1ca8]
mov eax, dword [eax + ecx*4 - 4]
mov dword [edx + 0x1b98], eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x41200000
call fcn.1003b9b0
mov eax, dword [0x100ae168]
cvttss2si eax, dword [eax + 0xfb4]
push eax
push str.Font_Size:__dpx
push 0x10
push 0x100ae594
call fcn.10012f40
push 0x10
mov edx, 0x100ae594
mov ecx, str.font_size
call fcn.1003bc50
add esp, 0x14
test al, al
je 0x1000d3ed
mov eax, dword [0x100ae168]
mov dword [ebp - 0x20], eax
mov eax, dword [eax + 0x2c]
mov esi, dword [eax + 0x44]
mov eax, dword [eax + 0x3c]
lea edi, [esi + eax*4]
cmp esi, edi
je 0x1000d3df
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
nop dword [eax + eax]
mov eax, dword [esi]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov eax, dword [eax + 0x34]
cvttss2si eax, dword [eax + 0x10]
push eax
push 0x1009f5b4
lea eax, [ebp - 0x1c]
push 4
push eax
call fcn.10012f40
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
cmp eax, dword [0x100ae15c]
push ecx
sete al
lea ecx, [ebp - 0x1c]
push 0
mov dl, al
mov byte [ebp - 0x2d], al
call fcn.10042f60
add esp, 0x18
test al, al
je 0x1000d3c1
mov eax, dword [esi]
mov ecx, dword [0x100ae168]
mov dword [0x100ae15c], eax
mov eax, dword [eax + 0x34]
cvttss2si eax, dword [eax + 0x10]
mov dword [0x100ab980], eax
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x100a0e54]
movss dword [ecx + 0xbdc], xmm0
mov ecx, dword [ecx + 0x20]
call fcn.10027810
cmp byte [ebp - 0x2d], 0
je 0x1000d3cc
call fcn.1001f7a0
add esi, 4
cmp esi, edi
jne 0x1000d340
mov esi, dword [0x100ae168]
jmp 0x1000d3e2
mov esi, dword [ebp - 0x20]
call fcn.10022c50
dec dword [esi + 0x2f48]
mov ecx, dword [0x100ae168]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x41200000
mov eax, dword [ecx + 0x124c]
mov byte [eax + 0xb0], 1
mov edx, dword [ecx + 0x124c]
mov ecx, dword [edx + 0x1b4]
mov eax, dword [edx + 0x1bc]
mov eax, dword [eax + ecx*4 - 4]
mov dword [edx + 0x1ac], eax
lea eax, [ecx - 1]
lea ecx, [ebp - 0x24]
mov dword [edx + 0x1b4], eax
call fcn.1003b9b0
push ecx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov ecx, str.Rescan_Memory
mov dword [ebp - 0x20], 0
call fcn.10039d00
add esp, 4
test al, al
je 0x1000d47f
call fcn.10008110
push 0
push 0
push 0
push 0x10007e60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x100ae168]
xorps xmm0, xmm0
movss xmm1, dword [eax + 0xfb4]
call fcn.10021a00
push ecx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov ecx, str.Unload_DLL
mov dword [ebp - 0x20], 0
call fcn.10039d00
add esp, 4
test al, al
je 0x1000d580
push dword [0x100ae160]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp byte [0x100ae2a4], 0
je 0x1000d513
mov edi, dword [0x100ae290]
lea ecx, [ebp - 0x18]
mov eax, dword [0x100ae284]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ecx
push 0x40
push edi
push eax
mov dword [ebp - 0x20], eax
call esi
push edi
push 0x100ae294
push dword [ebp - 0x20]
call fcn.1004f070
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x20]
call esi
mov byte [0x100ae2a4], 0
call fcn.10008110
push 4
call fcn.1004d2ca
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [eax], 0x100011e0
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x10001690
push 0
push 0
call fcn.10050d02
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x1000d60e
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1000d665
push ecx
push eax
call fcn.1004d0b2
add esp, 8
test eax, eax
jne 0x1000d665
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x40a00000
call fcn.1003b9b0
cmp dword [0x100ae5c8], 7
jne 0x1000d5dc
push str.Ciremuns_Freedom_v0.94.2_DEV__6c0ebbc_
call fcn.10039460
add esp, 4
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x20], 0x40a00000
call fcn.1003b9b0
push str.Special_Thanks_to_Maple_Syrup
call fcn.10039460
add esp, 4
push str._mrflashstudio
call fcn.10039460
add esp, 4
call fcn.1001ead0
call fcn.10022c50
call fcn.1001ead0
call fcn.1001f220
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1004d2bc
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 6
mov dword [ebp - 0x18], 0
call fcn.1004ced9
call fcn.1004d826
push 0x100aee90
call fcn.1004d6a0
add esp, 4
cmp dword [0x100aee90], 0xffffffff
jne 0x1000ca92
movsd xmm0, qword [0x100ab968]
divsd xmm0, qword [0x100a0f00]
push 0x100aee90
movsd qword [0x100aee88], xmm0
call fcn.1004d64f
add esp, 4
jmp 0x1000ca92
push 1
call fcn.1004ced9
int3