Function at 0x100abe70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8314
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x102a100c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.100c13a0
mov ecx, str.replay_rewind_testing
mov dword [ebp - 0x18], eax
call fcn.1005ac10
test al, al
je 0x100abf29
mov edx, dword [0x102a1b70]
mov ecx, dword [edx + 0x17fc]
mov byte [ecx + 0x8e], 1
mov ecx, dword [edx + 0x17fc]
mov byte [ecx + 0x8e], 1
mov eax, dword [edx + 0x17fc]
movss xmm0, dword [eax + 0x194]
subss xmm0, dword [edx + 0x1440]
movss dword [eax + 0x194], xmm0
addss xmm0, dword [eax + 0x14]
addss xmm0, dword [eax + 0x19c]
movss dword [eax + 0xd8], xmm0
dec dword [ecx + 0x10c]
mov eax, dword [edx + 0x17fc]
dec dword [eax + 0x1a4]
mov ecx, str.snapshot_testing
call fcn.1005ac10
test al, al
je 0x100ac606
cmp dword [0x102b46c0], 0
jne 0x100abf71
push 0x10
call fcn.1001f0e8
add esp, 4
mov dword [ebp - 0x24], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0
mov ecx, eax
movups xmmword [eax], xmm0
call fcn.1008b640
mov dword [ebp - 4], 0xffffffff
mov dword [0x102b46c0], eax
push 0
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
mov ecx, str.Save_snapshot
mov dword [ebp - 0x2c], 0
call fcn.1005c770
add esp, 4
test al, al
je 0x100abfa1
push ecx
mov ecx, dword [0x102b46c0]
call fcn.1008b5a0
push 0
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
mov ecx, str.Load_snapshot
mov dword [ebp - 0x2c], 0
call fcn.1005c770
add esp, 4
test al, al
je 0x100abfd1
push ecx
mov ecx, dword [0x102b46c0]
call fcn.1008b480
mov ecx, str.Netcode_stuff
call fcn.1005ac10
test al, al
je 0x100ac5a1
call fcn.100c13a0
mov edi, eax
mov ecx, dword [edi + 0x65bd08]
lea eax, [edi + 0x65bd08]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], ecx
xor ecx, ecx
lea eax, [edi + 0x612718]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x34], ecx
test eax, eax
je 0x100ac017
mov ecx, dword [eax + 0x170]
mov dword [ebp - 0x34], ecx
lea esi, [edi + 0x383dd0]
push 0x1c
mov dword [ebp - 0x54], esi
call fcn.1001f0e8
add esp, 4
mov dword [ebp - 0x1c], eax
push eax
call esi
mov eax, dword [ebp - 0x18]
add esp, 4
cmp dword [eax + 0x612888], 0
jne 0x100ac1a4
movq xmm0, qword [0x10243364]
lea eax, [ebp - 0x18]
mov cl, byte [0x1024336c]
lea esi, [edi + 0xe5701]
mov di, word [esi]
push eax
push 0x40
push 2
push esi
movq qword [ebp - 0x44], xmm0
mov byte [ebp - 0x3c], cl
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ax, word [ebp - 0x44]
push 0
push dword [ebp - 0x18]
mov word [esi], ax
push 2
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x18]
push ecx
add eax, 0xe577d
push 0x40
push 2
push eax
mov si, word [eax]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 0x28]
mov ax, word [ebp - 0x44]
add ecx, 0xe577d
push 0
push dword [ebp - 0x18]
push 2
push ecx
mov word [ecx], ax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 0x28]
add ecx, 0xe5a9c
mov eax, dword [ecx]
mov dword [ebp - 0x4c], eax
mov ax, word [ecx + 4]
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 6
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
add ecx, 0xe5a9c
push 0
push dword [ebp - 0x20]
mov dword [ecx], eax
movzx eax, word [ebp - 0x40]
push 6
push ecx
mov word [ecx + 4], ax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 0x28]
push dword [ecx + 0x8929b4]
lea eax, [ecx + 0xe56f0]
call eax
add esp, 4
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x28]
push 0x40
push 2
add eax, 0xe5701
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x28]
push 0
push dword [ebp - 0x20]
add eax, 0xe5701
push 2
push eax
mov word [eax], di
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
add edi, 0xe577d
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push dword [ebp - 0x20]
mov word [edi], si
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 2
push edi
call esi
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 6
add edi, 0xe5a9c
push edi
call esi
mov eax, dword [ebp - 0x4c]
push 0
push dword [ebp - 0x20]
mov dword [edi], eax
mov ax, word [ebp - 0x16]
push 6
push edi
mov word [edi + 4], ax
call esi
mov edi, dword [ebp - 0x28]
push 0
lea edx, [ebp - 0x50]
mov dword [ebp - 0x50], 0
mov ecx, str.maybe_ggpo_start_session_with_SteamPeer2PeerBackend
mov dword [ebp - 0x4c], 0
call fcn.1005c770
add esp, 4
test al, al
je 0x100ac1f3
push 0x1c
add edi, 0x37c7a0
call fcn.1001f0e8
add esp, 4
mov esi, eax
push esi
call dword [ebp - 0x54]
add esp, 4
push 2
push 2
push str.BBCF
push esi
push dword [ebp - 0x2c]
call edi
add esp, 0x14
push 0
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
mov ecx, str.maybe_network_stuff_init
mov dword [ebp - 0x2c], 0
call fcn.1005c770
mov edi, dword [ebp - 0x28]
add esp, 4
test al, al
je 0x100ac22b
push dword [edi + 0x8929b4]
lea eax, [edi + 0xe56f0]
call eax
add esp, 4
mov esi, dword [ebp - 0x34]
test esi, esi
je 0x100ac3a8
push dword [0x102b46b4]
push str.savegame_count:__d
call fcn.1005da60
push dword [esi + 0x2d0]
push str._counter_of_some_sort:__d
call fcn.1005da60
push 0
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
mov ecx, str.save_state_no_backend
mov dword [ebp - 0x2c], 0
call fcn.1005c770
add esp, 0x14
test al, al
je 0x100ac2e8
mov ecx, dword [0x102b46b4]
mov eax, 0x66666667
imul ecx
mov dword [0x102a6234], 1
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
add eax, eax
sub ecx, eax
lea eax, [ecx + ecx*8]
lea esi, [esi + eax*8]
mov eax, dword [ebp - 0x1c]
add esi, 4
mov eax, dword [eax + 0x10]
push dword [esi]
call eax
mov eax, dword [ebp - 0x1c]
add esp, 4
mov eax, dword [eax + 4]
push 0x102b46b8
push 0x102a6234
push esi
call eax
mov eax, dword [0x102b46bc]
mov ecx, 0xa
inc eax
add esp, 0xc
cdq
idiv ecx
inc dword [0x102b46b4]
mov dword [0x102b46bc], edx
push 0
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
mov ecx, str.load_state_no_backend
mov dword [ebp - 0x2c], 0
call fcn.1005c770
add esp, 4
test al, al
je 0x100ac3a8
mov al, byte [0x1024336c]
lea edx, [ebp - 0x18]
movq xmm0, qword [0x10243364]
lea ecx, [edi + 0x383f63]
mov byte [ebp - 0x3c], al
movzx eax, word [0x10243370]
mov word [ebp - 0x18], ax
mov al, byte [0x10243372]
mov byte [ebp - 0x16], al
movzx eax, word [edi + 0x383f63]
mov word [ebp - 0x28], ax
mov al, byte [edi + 0x383f65]
push 2
movq qword [ebp - 0x44], xmm0
mov byte [ebp - 0x26], al
call fcn.100c1340
add esp, 4
lea ecx, [edi + 0x383f65]
lea edx, [ebp - 0x44]
push 1
call fcn.100c1340
mov eax, dword [0x102b46b4]
mov ecx, 0xa
dec eax
add esp, 4
cdq
idiv ecx
mov ecx, dword [ebp - 0x34]
lea eax, [edx + edx*8]
push dword [ecx + eax*8 + 4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
call eax
add esp, 4
lea edx, [ebp - 0x28]
lea ecx, [edi + 0x383f63]
push 3
call fcn.100c1340
add esp, 4
mov edi, dword [ebp - 0x24]
test edi, edi
je 0x100ac52d
push edi
push str.SteamPeer2PeerBackend_addr:__x
call fcn.1005da60
lea esi, [edi + 0x53c]
push esi
push str.Sync_addr:__x
call fcn.1005da60
push 0
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
mov ecx, str.ggpo_advance_frame
mov dword [ebp - 0x2c], 0
call fcn.1005c770
add esp, 0x14
test al, al
je 0x100ac3f8
mov eax, dword [edi + 0x20]
call eax
mov ecx, str.Netcode_details
call fcn.1005ac10
test al, al
je 0x100ac53a
test esi, esi
je 0x100ac519
push 0
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
mov ecx, str.save_frame_state
mov dword [ebp - 0x2c], 0
lea esi, [edi + 0x55c]
call fcn.1005c770
add esp, 4
test al, al
je 0x100ac460
lea eax, [esi + 0xc]
mov dword [esi + 4], 0x8536f8
push eax
lea ecx, [esi + 4]
mov dword [eax], 0
mov eax, dword [edi + 0x10]
push ecx
push esi
call eax
add esp, 0xc
inc dword [0x102b46b4]
push 0
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
mov ecx, str.Load_frames_in_rollback_2
mov dword [ebp - 0x2c], 0
call fcn.1005c770
add esp, 4
test al, al
je 0x100ac48e
push dword [esi]
mov eax, dword [edi + 0x14]
call eax
add esp, 4
mov edi, 0xa
movups xmm0, xmmword [esi]
push str._________________________
movups xmmword [ebp - 0x48], xmm0
call fcn.1005da60
mov eax, dword [ebp - 0x48]
add esp, 4
push eax
push str.buf_addr:__x
call fcn.1005da60
movups xmm0, xmmword [ebp - 0x48]
psrldq xmm0, 4
movd eax, xmm0
push eax
push str.cbuf:__d
call fcn.1005da60
movups xmm0, xmmword [ebp - 0x48]
psrldq xmm0, 8
movd eax, xmm0
push eax
push str.frame:__d
call fcn.1005da60
movups xmm0, xmmword [ebp - 0x48]
psrldq xmm0, 0xc
movd eax, xmm0
push eax
push str.checksum:__d
call fcn.1005da60
push str._________________________
call fcn.1005da60
add esp, 0x24
lea esi, [esi + 0x10]
sub edi, 1
jne 0x100ac493
call fcn.100480c0
jmp 0x100ac53a
push str.must_have_bckend___sync_initialized
call fcn.1005da60
add esp, 4
call fcn.100480c0
jmp 0x100ac53a
push str.must_have_SteamPeer2PeerBackend_initialized
call fcn.1005da60
add esp, 4
mov edx, dword [0x102a1b70]
mov eax, dword [edx + 0x17fc]
mov byte [eax + 0x8e], 1
mov ecx, dword [edx + 0x17fc]
mov byte [ecx + 0x8e], 1
mov eax, dword [edx + 0x17fc]
movss xmm0, dword [eax + 0x194]
subss xmm0, dword [edx + 0x1440]
movss dword [eax + 0x194], xmm0
addss xmm0, dword [eax + 0x14]
addss xmm0, dword [eax + 0x19c]
movss dword [eax + 0xd8], xmm0
dec dword [ecx + 0x10c]
mov eax, dword [edx + 0x17fc]
dec dword [eax + 0x1a4]
jmp 0x100ac5a7
mov edx, dword [0x102a1b70]
mov eax, dword [edx + 0x17fc]
mov byte [eax + 0x8e], 1
mov ecx, dword [edx + 0x17fc]
mov byte [ecx + 0x8e], 1
mov eax, dword [edx + 0x17fc]
movss xmm0, dword [eax + 0x194]
subss xmm0, dword [edx + 0x1440]
movss dword [eax + 0x194], xmm0
addss xmm0, dword [eax + 0x14]
addss xmm0, dword [eax + 0x19c]
movss dword [eax + 0xd8], xmm0
dec dword [ecx + 0x10c]
mov eax, dword [edx + 0x17fc]
dec dword [eax + 0x1a4]
mov ecx, str.Game_values
call fcn.1005afc0
test al, al
je 0x100aca21
mov ecx, str.Character_data
call fcn.1005ac10
test al, al
je 0x100ac835
mov ecx, dword [0x102ac214]
test ecx, ecx
je 0x100ac671
mov eax, dword [ecx]
test eax, eax
je 0x100ac64e
push eax
push str.pP1CharData_0x_p
call fcn.1005da60
mov ecx, dword [0x102ac214]
add esp, 8
test ecx, ecx
je 0x100ac671
mov eax, dword [ecx]
test eax, eax
je 0x100ac671
push dword [eax + 0x1320]
push str.pP1CurrentScriptActionLocationInMemory_0x_p
call fcn.1005da60
mov ecx, dword [0x102ac214]
add esp, 8
mov eax, dword [0x102b0344]
test eax, eax
je 0x100ac6e9
mov edx, dword [eax]
test edx, edx
je 0x100ac699
push edx
push str.pP2CharData_0x_p
call fcn.1005da60
mov eax, dword [0x102b0344]
add esp, 8
mov ecx, dword [0x102ac214]
test eax, eax
je 0x100ac6e9
mov edx, dword [eax]
test edx, edx
je 0x100ac6c1
push dword [edx + 0x1320]
push str.pP2CurrentScriptActionLocationInMemory_0x_p
call fcn.1005da60
mov eax, dword [0x102b0344]
add esp, 8
mov ecx, dword [0x102ac214]
test eax, eax
je 0x100ac6e9
mov edx, dword [eax]
test edx, edx
je 0x100ac6e9
push dword [edx + 0x1e9c0]
push str.pP2slot2_or_slot4_0x_x
call fcn.1005da60
mov eax, dword [0x102b0344]
add esp, 8
mov ecx, dword [0x102ac214]
test ecx, ecx
je 0x100ac708
mov ecx, dword [ecx]
test ecx, ecx
je 0x100ac708
push dword [ecx + 0x34]
push str.P1CharIndex__d
call fcn.1005da60
mov eax, dword [0x102b0344]
add esp, 8
test eax, eax
je 0x100ac722
mov eax, dword [eax]
test eax, eax
je 0x100ac722
push dword [eax + 0x34]
push str.P2CharIndex__d
call fcn.1005da60
add esp, 8
push dword [0x102a892c]
push str.g_gameVals.isP1CPU:__d
call fcn.1005da60
call fcn.100499a0
push dword [0x102ac218]
push str.pP1PalIndex_0x_p
call fcn.1005da60
push dword [0x102b0348]
push str.pP2PalIndex_0x_p
call fcn.1005da60
mov edi, dword [0x102ac218]
add esp, 0x18
movss xmm1, dword [0x10294494]
test edi, edi
je 0x100ac7b0
movd xmm0, dword [edi]
lea edx, [ebp - 0x1c]
cvtdq2ps xmm0, xmm0
push ecx
mov dword [esp], 0x3f800000
mov ecx, str.P1PalIndex
push str._.0f
movaps xmm3, xmm1
xorps xmm2, xmm2
movss dword [ebp - 0x1c], xmm0
call fcn.10059360
cvttss2si eax, dword [ebp - 0x1c]
add esp, 8
movss xmm1, dword [0x10294494]
mov dword [edi], eax
mov edi, dword [0x102ac218]
mov esi, dword [0x102b0348]
test esi, esi
je 0x100ac7fc
movd xmm0, dword [esi]
lea edx, [ebp - 0x1c]
cvtdq2ps xmm0, xmm0
push ecx
mov dword [esp], 0x3f800000
mov ecx, str.P2PalIndex
push str._.0f
movaps xmm3, xmm1
xorps xmm2, xmm2
movss dword [ebp - 0x1c], xmm0
call fcn.10059360
cvttss2si eax, dword [ebp - 0x1c]
add esp, 8
mov dword [esi], eax
mov esi, dword [0x102b0348]
mov edi, dword [0x102ac218]
test edi, edi
je 0x100ac819
push dword [0x102ac21c]
push str.P1OrigPalIndex__d
call fcn.1005da60
mov esi, dword [0x102b0348]
add esp, 8
test esi, esi
je 0x100ac830
push dword [0x102b034c]
push str.P2OrigPalIndex__d
call fcn.1005da60
add esp, 8
call fcn.100480c0
mov ecx, str.Game_and_Match_variables
call fcn.1005ac10
test al, al
je 0x100ac9a6
push 0x24978
push str.sizeof_chardata:_0x_d
call fcn.1005da60
push 0xa10000
push str.sizeof_snapshot:_0x_d
call fcn.1005da60
mov eax, dword [0x102a8900]
add esp, 0x10
test eax, eax
je 0x100ac875
mov ecx, dword [eax]
jmp 0x100ac877
xor ecx, ecx
push ecx
push eax
push str.pGameState:_0x_p_:__d
call fcn.1005da60
mov eax, dword [0x102a8908]
add esp, 0xc
test eax, eax
je 0x100ac893
mov ecx, dword [eax]
jmp 0x100ac895
xor ecx, ecx
push ecx
push eax
push str.pGameMode:_0x_p_:__d
call fcn.1005da60
mov eax, dword [0x102a890c]
add esp, 0xc
test eax, eax
je 0x100ac8b1
mov ecx, dword [eax]
jmp 0x100ac8b3
xor ecx, ecx
push ecx
push eax
push str.pMatchState:_0x_p_:__d
call fcn.1005da60
mov eax, dword [0x102a8910]
add esp, 0xc
test eax, eax
je 0x100ac8cf
mov ecx, dword [eax]
jmp 0x100ac8d1
xor ecx, ecx
push ecx
push eax
push str.pMatchTimer:_0x_p_:__d
call fcn.1005da60
mov eax, dword [0x102a8914]
add esp, 0xc
test eax, eax
je 0x100ac8ed
mov ecx, dword [eax]
jmp 0x100ac8ef
xor ecx, ecx
push ecx
push eax
push str.pMatchRounds:_0x_p_:__d
call fcn.1005da60
mov eax, dword [0x102a8950]
add esp, 0xc
test eax, eax
je 0x100ac90b
mov ecx, dword [eax]
jmp 0x100ac90d
xor ecx, ecx
push ecx
push eax
push str.pFrameCount:_0x_p_:__d
call fcn.1005da60
add esp, 0xc
push dword [0x102a8944]
push str.pIsHUDHidden:_0x_p
call fcn.1005da60
mov edx, dword [0x102a8944]
mov ecx, str.pIsHUDHidden
call fcn.100566f0
push dword [0x102a8960]
push str.entityCount:__d
call fcn.1005da60
push dword [0x102a895c]
push str.pEntityList:_0x_p
call fcn.1005da60
push dword [0x102a8954]
push str.viewMatrix:_0x_p
call fcn.1005da60
push dword [0x102a8958]
push str.projMatrix:_0x_p
call fcn.1005da60
push dword [0x102a8964]
push str.pRoom:_0x_p
call fcn.1005da60
movzx eax, byte [0x102a1bb4]
push eax
push str.enableForeignPalettes:__d
call fcn.1005da60
add esp, 0x38
call fcn.100480c0
mov ecx, str.Hitbox_overlay
call fcn.1005ac10
test al, al
je 0x100aca21
mov eax, dword [0x102a8988]
test eax, eax
jne 0x100ac9da
push 0xc
call fcn.1001f0e8
xorps xmm0, xmm0
mov dword [0x102a8988], eax
add esp, 4
movq qword [eax], xmm0
mov dword [eax + 8], 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 5
push ecx
mov ecx, dword [eax + 4]
call fcn.10018220
movss xmm3, dword [0x102943b0]
movss xmm2, dword [0x102943a8]
push ecx
mov edx, dword [eax]
mov ecx, str.Hitbox_overlay_projection_scale
mov dword [esp], 0x3f800000
add edx, 0x2c
push str._.3f
call fcn.10059360
add esp, 8
call fcn.100480c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001e823
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret