Function at 0x10060220
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
mov eax, dword [0x10106040]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov byte [esp + 0x14], 0x68
push 0
mov byte [esp + 0x1d], 0
mov ebx, dword [esi + 8]
mov edi, dword [esi + 4]
push ebx
push edi
push str.ScreenFade
call fcn.100612c0
push 0
push ebx
mov dword [esp + 0x1d], eax
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.100612c0
cmp edi, ebx
mov ebp, dword [eax + 0x13]
mov eax, ebx
cmovbe eax, edi
cmp ebp, eax
jb 0x10060d71
cmp edi, ebx
cmovbe edi, ebx
cmp ebp, edi
ja 0x10060d71
mov dword [0x1010eb84], ebp
test ebp, ebp
je 0x10060d8d
mov ebx, dword [esi + 0x18]
mov edi, dword [esi + 0x14]
push 0
push ebx
push edi
push str.sprites_voiceicon.spr
mov byte [esp + 0x24], 0x68
mov byte [esp + 0x29], 0
call fcn.100612c0
push 0
push ebx
mov dword [esp + 0x1d], eax
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.100612c0
cmp edi, ebx
mov ecx, dword [eax + 7]
mov eax, ebx
cmovbe eax, edi
cmp ecx, eax
jb 0x10060d56
cmp edi, ebx
cmovbe edi, ebx
cmp ecx, edi
ja 0x10060d56
mov dword [0x1010eacc], ecx
test ecx, ecx
je 0x10060d8d
mov ecx, dword [esi + 0x18]
mov eax, ecx
mov edx, dword [esi + 0x14]
cmp edx, ecx
mov ebx, dword [ebp + 0x9c]
cmovbe eax, edx
mov edi, dword [ebx + 0x30]
cmp edi, eax
jb 0x10060313
cmp edx, ecx
mov eax, edx
cmovbe eax, ecx
cmp edi, eax
jbe 0x10060330
mov edi, dword [ebx + 0x1a]
cmp edx, ecx
jbe 0x10060320
mov eax, ecx
mov ecx, edx
mov edx, eax
cmp edi, edx
jb 0x10060d3b
cmp edi, ecx
ja 0x10060d3b
mov dword [0x1010e9e0], edi
test edi, edi
je 0x10060d8d
mov ebx, dword [esi + 0x18]
mov edi, dword [esi + 0x14]
push 2
push ebx
push edi
push str.x_____xxx____x____xx____xx
push 0x100f1744
call fcn.10061230
cmp edi, ebx
mov ecx, ebx
cmovbe ecx, edi
cmp eax, ecx
jb 0x10060d20
cmp edi, ebx
cmovbe edi, ebx
cmp eax, edi
ja 0x10060d20
mov eax, dword [eax]
mov dword [0x1010e96c], eax
test eax, eax
je 0x10060d8d
mov edi, dword [esi + 0x14]
push 0xa
push ebx
push edi
push str.xxxx____xx
push 0x100f18c8
call fcn.10061230
cmp edi, ebx
mov ecx, dword [eax]
mov eax, ebx
cmovbe eax, edi
cmp ecx, eax
jb 0x10060d05
cmp edi, ebx
cmovbe edi, ebx
cmp ecx, edi
ja 0x10060d05
mov dword [0x1010ead4], ecx
test ecx, ecx
je 0x10060d8d
mov ebx, dword [esi + 8]
mov edi, dword [esi + 4]
push 0
push ebx
push edi
push str.ScreenFade
mov byte [esp + 0x24], 0x68
mov byte [esp + 0x29], 0
call fcn.100612c0
push 0
push ebx
mov dword [esp + 0x1d], eax
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.100612c0
cmp edi, ebx
mov ecx, dword [eax + 0x18]
mov eax, ebx
cmovbe eax, edi
cmp ecx, eax
jb 0x10060ce7
cmp edi, ebx
cmovbe edi, ebx
cmp ecx, edi
ja 0x10060ce7
mov dword [0x1010e968], ecx
test ecx, ecx
je 0x10060d8d
push 0
mov edi, ebx
mov byte [esp + 0x18], 0x68
mov ebx, dword [esi + 4]
push edi
push ebx
push str.CL_Parse_Sound:_ent___i__cl.max_edicts__i
mov byte [esp + 0x29], 0
call fcn.100612c0
push 0
push edi
mov dword [esp + 0x1d], eax
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.100612c0
mov ecx, dword [eax - 0x10]
add eax, 0xfffffff4
add ecx, eax
cmp ebx, edi
mov eax, edi
cmovbe eax, ebx
cmp ecx, eax
jb 0x1006046e
cmp ebx, edi
mov eax, ebx
cmovbe eax, edi
cmp ecx, eax
jbe 0x100604bd
push 0
push edi
push ebx
push str.CL_Parse_Sound:_ent___i__cl.max_edicts__i
mov byte [esp + 0x24], 0x68
mov byte [esp + 0x29], 0
call fcn.100612c0
push 0
push edi
mov dword [esp + 0x1d], eax
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.100612c0
mov ecx, dword [eax - 0x11]
sub eax, 0x11
add ecx, 4
add ecx, eax
cmp ebx, edi
jbe 0x100604ad
mov eax, edi
mov edi, ebx
mov ebx, eax
cmp ecx, ebx
jb 0x10060cc9
cmp ecx, edi
ja 0x10060cc9
mov dword [0x10110300], ecx
test ecx, ecx
je 0x10060d8d
mov ebx, dword [esi + 8]
mov edi, dword [esi + 4]
push 0
push ebx
push edi
push str.UserMsg:_Not_Present_on_Client__d_n
mov byte [esp + 0x24], 0x68
mov byte [esp + 0x29], 0
call fcn.100612c0
push 0
push ebx
mov dword [esp + 0x1d], eax
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.100612c0
push ecx
push edi
push eax
push ecx
call fcn.10061140
cmp edi, ebx
mov ecx, ebx
cmovbe ecx, edi
cmp eax, ecx
jb 0x10060cab
cmp edi, ebx
cmovbe edi, ebx
cmp eax, edi
ja 0x10060cab
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [0x1010ebc4], eax
test eax, eax
je 0x10060d8d
mov ecx, esi
call fcn.10060f50
mov dword [0x1010eabc], eax
test eax, eax
je 0x10060d8d
mov ebx, dword [esi + 8]
mov edi, dword [esi + 4]
push 0
push ebx
push edi
push str.xxx____xxxxxxxxxxxxxxxxx
push 0x100f1b64
call fcn.10061230
cmp edi, ebx
mov ecx, ebx
cmovbe ecx, edi
cmp eax, ecx
jb 0x10060c8d
cmp edi, ebx
cmovbe edi, ebx
cmp eax, edi
ja 0x10060c8d
mov eax, dword [eax + 3]
sub eax, 0x135da8
mov dword [0x1010e748], eax
je 0x10060d8d
mov edi, dword [esi + 4]
push 0
push ebx
push edi
push str.in_:___i__.2f_k_s
mov byte [esp + 0x24], 0x68
mov byte [esp + 0x29], 0
call fcn.100612c0
push 0
push ebx
mov dword [esp + 0x1d], eax
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.100612c0
push ecx
push edi
push eax
push str.x____xxx
push 0x100f1b24
call fcn.100611a0
cmp edi, ebx
mov ecx, ebx
cmovbe ecx, edi
cmp eax, ecx
jb 0x10060c6f
cmp edi, ebx
cmovbe edi, ebx
cmp eax, edi
ja 0x10060c6f
mov eax, dword [eax + 1]
sub eax, 0x40
mov dword [0x1010e9f0], eax
je 0x10060d8d
mov edi, dword [esi + 4]
push 0
push ebx
push edi
push str.ex_interp_forced_down_to__i_msec_n
mov byte [esp + 0x24], 0x68
mov byte [esp + 0x29], 0
call fcn.100612c0
push 0
push ebx
mov dword [esp + 0x1d], eax
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.100612c0
push 2
push ebx
push eax
push 0x100f19a4
call fcn.100612c0
mov ecx, dword [eax]
add eax, 4
add ecx, eax
cmp edi, ebx
mov eax, ebx
cmovbe eax, edi
cmp ecx, eax
jb 0x10060c51
cmp edi, ebx
cmovbe edi, ebx
cmp ecx, edi
ja 0x10060c51
mov dword [0x101102f0], ecx
test ecx, ecx
je 0x10060d8d
push 0
mov edi, ebx
mov ebx, dword [esi + 4]
push edi
push ebx
push str.xxxxxxxx
push 0x100f1934
call fcn.10061230
cmp ebx, edi
mov ecx, edi
mov edx, eax
cmovbe ecx, ebx
cmp edx, ecx
jb 0x10060695
cmp ebx, edi
mov ecx, ebx
cmovbe ecx, edi
cmp edx, ecx
jbe 0x100606c4
push 0
push edi
push ebx
push str.xxxxxxxxx____xx
push 0x100f1950
call fcn.10061230
mov edx, eax
cmp ebx, edi
jbe 0x100606b4
mov eax, edi
mov edi, ebx
mov ebx, eax
cmp edx, ebx
jb 0x10060c33
cmp edx, edi
ja 0x10060c33
mov dword [0x101102fc], edx
test edx, edx
je 0x10060d8d
mov ecx, esi
call fcn.10060db0
mov dword [0x10110304], eax
test eax, eax
je 0x10060d8d
mov ebx, dword [esi + 8]
mov edi, dword [esi + 4]
push 0
push ebx
push edi
push str._c_c_c_cconnect__i__i___s____s__n
mov byte [esp + 0x24], 0x68
mov byte [esp + 0x29], 0
call fcn.100612c0
push 0
push ebx
mov dword [esp + 0x1d], eax
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.100612c0
push ecx
push edi
push eax
push str.x____xxxxx
push 0x100f17a4
call fcn.100611a0
cmp edi, ebx
mov ecx, ebx
mov edx, eax
cmovbe ecx, edi
cmp edx, ecx
jb 0x10060c15
cmp edi, ebx
cmovbe edi, ebx
cmp edx, edi
ja 0x10060c15
mov eax, dword [edx + 1]
add eax, 5
add eax, edx
mov dword [0x101101f4], eax
je 0x10060d8d
mov eax, dword [0x1010eb84]
mov ecx, dword [eax + 0xa4]
test ecx, ecx
jne 0x1006076e
mov ecx, dword [eax + 0xa0]
push 0
push dword [eax + 0xa8]
push ecx
push str.xxx_____x
push 0x100f1900
call fcn.10061230
mov edi, dword [esi + 0x18]
mov ecx, edi
mov edx, dword [esi + 0x14]
cmp edx, edi
cmovbe ecx, edx
cmp eax, ecx
jb 0x10060bf7
cmp edx, edi
cmovbe edx, edi
cmp eax, edx
ja 0x10060bf7
mov eax, dword [eax + 4]
sub eax, 4
mov dword [0x10110324], eax
je 0x10060d8d
mov eax, dword [0x1010eacc]
mov eax, dword [eax + 0x198]
call eax
mov edi, eax
test edi, edi
je 0x10060807
nop dword [eax]
mov edx, dword [edi + 4]
mov ecx, str.version
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x100607f8
test al, al
je 0x100607f4
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x100607f8
add edx, 2
add ecx, 2
test al, al
jne 0x100607d8
xor eax, eax
jmp 0x100607fd
sbb eax, eax
or eax, 1
test eax, eax
je 0x1006082a
mov edi, dword [edi]
test edi, edi
jne 0x100607d0
push str.COffsets::GetGameBuild
push str._s:_not_found._n
call fcn.100a17e0
mov eax, dword [0x10115328]
mov dword [eax + 0x90], 0
jmp 0x10060d8a
mov ecx, dword [edi + 8]
add ecx, 0x17
mov eax, dword [ecx]
add eax, 4
add eax, ecx
je 0x10060807
call eax
mov ecx, dword [0x10115328]
mov dword [ecx + 0x90], eax
test eax, eax
je 0x10060d8d
mov ebx, dword [esi + 0x18]
mov edi, dword [esi + 0x14]
push 0
push ebx
push edi
push 0x100f187c
call fcn.100612c0
cmp edi, ebx
mov ecx, ebx
mov edx, eax
cmovbe ecx, edi
cmp edx, ecx
jb 0x10060bd4
cmp edi, ebx
cmovbe edi, ebx
cmp edx, edi
ja 0x10060bd4
mov eax, dword [0x10115328]
mov dword [eax + 0x9c], edx
test edx, edx
je 0x10060d8d
mov edi, dword [esi + 8]
mov esi, dword [esi + 4]
push 2
push edi
push esi
push 0x100f16f4
call fcn.100612c0
cmp esi, edi
mov ecx, edi
cmovbe ecx, esi
cmp eax, ecx
jb 0x100608c1
cmp esi, edi
cmovbe esi, edi
cmp eax, esi
ja 0x100608c1
mov ecx, dword [eax + 2]
jmp 0x100608d5
push str.COffsets::AllowCheats
push str._s:_not_found._n
call fcn.100a17e0
add esp, 8
xor ecx, ecx
mov eax, dword [0x10115328]
push dword [0x1010eb84]
push str.COffsets::FindGameOffsets
mov dword [eax + 0xf4], ecx
mov eax, dword [0x1010e74c]
push str.___s:_g_pClient:_0x_X_n
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
push dword [0x1010eacc]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pEngine:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
push dword [0x1010e9e0]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pStudio:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
push dword [0x1010e96c]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pStudioAPI:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
add esp, 0x40
push dword [0x1010e968]
mov ecx, dword [eax]
push str.COffsets::FindGameOffsets
push str.___s:_pmove:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
push dword [0x10110300]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pPreS_DynamicSound:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
push dword [0x1010ebc4]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pClientUserMsgs:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
push dword [0x1010e748]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_client_state:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
add esp, 0x40
push dword [0x1010e9f0]
mov ecx, dword [eax]
push str.COffsets::FindGameOffsets
push str.___s:_client_static:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
push dword [0x101102f4]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pIN_MouseMove:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
push dword [0x101102f0]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pCL_DriftInterpolationAmount:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
push dword [0x101102fc]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pCL_RecordHUDCommand:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
add esp, 0x40
push dword [0x101102f8]
mov ecx, dword [eax]
push str.COffsets::FindGameOffsets
push str.___s:_g_pHost_FilterTime:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
push dword [0x10110244]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pSCR_UpdateScreen:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
push dword [0x1010ead4]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pStudioModelRenderer:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
push dword [0x10110304]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pR_DrawEntitiesOnList:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
add esp, 0x40
push dword [0x101101f4]
mov ecx, dword [eax]
push str.COffsets::FindGameOffsets
push str.___s:_g_pInitiateGameConnection:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
push dword [0x1010fdb4]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pCL_RunUsercmd:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e74c]
push dword [0x10110308]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pNET_SendPacket:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x10115328]
mov ecx, dword [0x1010e74c]
push dword [eax + 0x90]
mov edx, dword [ecx]
push str.COffsets::FindGameOffsets
push str.___s:_g_pGlobals__m_iGameBuild:__i_n
push ecx
call dword [edx + 0x1c]
mov eax, dword [0x10115328]
add esp, 0x40
mov ecx, dword [0x1010e74c]
push dword [eax + 0x9c]
mov edx, dword [ecx]
push str.COffsets::FindGameOffsets
push str.___s:_g_pGlobals__m_dwInitPoint:_0x_X_n
push ecx
call dword [edx + 0x1c]
mov esi, dword [0x1010eb84]
mov ecx, 0x2b
mov edi, 0x1010ead8
add esp, 0x10
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x86
mov esi, dword [0x1010eacc]
mov edi, 0x1010e750
mov eax, dword [0x1010e96c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [0x1010e9e0]
mov ecx, 0x2e
mov edi, 0x1010ea00
rep movsd dword es:[edi], dword [esi]
movq xmm0, qword [eax]
mov ecx, 0x1c
movq qword [0x1010e9e4], xmm0
mov edi, 0x1010e970
mov eax, dword [eax + 8]
mov dword [0x1010e9ec], eax
mov eax, dword [0x1010ead4]
mov esi, eax
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 0x70
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10060bbf
push str.COffsets::FindGameOffsets
push str._s:_g_pStudioModelRenderer_memory_protected._n
call fcn.100a17e0
jmp 0x10060d8a
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.100a9d10
add esp, 0x10
ret
push str.COffsets::InitPoint
push str._s:_not_found._n
call fcn.100a17e0
mov eax, dword [0x10115328]
mov dword [eax + 0x9c], 0
jmp 0x10060d8a
push str.COffsets::PlayerExtraInfo
push str._s:_not_found._n
call fcn.100a17e0
mov dword [0x10110324], 0
jmp 0x10060d8a
push str.COffsets::InitiateGameConnection
push str._s:_not_found._n
call fcn.100a17e0
mov dword [0x101101f4], 0
jmp 0x10060d8a
push str.COffsets::CL_RecordHUDCommand
push str._s:_not_found._n
call fcn.100a17e0
mov dword [0x101102fc], 0
jmp 0x10060d8a
push str.COffsets::CL_DriftInterpolationAmount
push str._s:_not_found._n
call fcn.100a17e0
mov dword [0x101102f0], 0
jmp 0x10060d8a
push str.COffsets::ClientStatic
push str._s:_not_found._n
call fcn.100a17e0
mov dword [0x1010e9f0], 0
jmp 0x10060d8a
push str.COffsets::ClientState
push str._s:_not_found._n
call fcn.100a17e0
mov dword [0x1010e748], 0
jmp 0x10060d8a
push str.COffsets::ClientUserMsgs
push str._s:_not_found._n
call fcn.100a17e0
mov dword [0x1010ebc4], 0
jmp 0x10060d8a
push str.COffsets::PreS_DynamicSound
push str._s:_not_found._n
call fcn.100a17e0
mov dword [0x10110300], 0
jmp 0x10060d8a
push str.COffsets::PlayerMove
push str._s:_not_found._n
call fcn.100a17e0
mov dword [0x1010e968], 0
jmp 0x10060d8a
push str.COffsets::StudioModelRenderer
push str._s:_not_found._n
call fcn.100a17e0
mov dword [0x1010ead4], 0
jmp 0x10060d8a
push str.COffsets::StudioAPI
push str._s:_not_found._n
call fcn.100a17e0
mov dword [0x1010e96c], 0
jmp 0x10060d8a
push str.COffsets::Studio
push str._s:_not_found._n
call fcn.100a17e0
mov dword [0x1010e9e0], 0
jmp 0x10060d8a
push str.COffsets::Engine
push str._s:_not_found._n
call fcn.100a17e0
mov dword [0x1010eacc], 0
jmp 0x10060d8a
push str.COffsets::Client
push str._s:_not_found._n
call fcn.100a17e0
mov dword [0x1010eb84], 0
add esp, 8
mov ecx, dword [esp + 0x1c]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100a9d10
add esp, 0x10
ret