Function at 0x10085850
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1013b3dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x1018c9ec]
push edi
mov edi, dword [0x1018c9f4]
push 0
push edi
push esi
push str.ScreenFade
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 7], 0
call fcn.10086650
push 0
push edi
mov dword [ebp - 0xb], eax
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.10086650
cmp esi, edi
mov ecx, dword [eax + 0x13]
mov eax, edi
cmovbe eax, esi
mov dword [ebp - 0x1c], ecx
cmp ecx, eax
jb 0x10086417
cmp esi, edi
mov eax, esi
cmovbe eax, edi
cmp ecx, eax
ja 0x10086417
mov dword [0x1018bbcc], ecx
test ecx, ecx
je 0x10086433
mov ebx, dword [0x1018c9fc]
push 0
push dword [0x1018ca04]
mov byte [ebp - 0xc], 0x68
push ebx
push str.sprites_voiceicon.spr
mov byte [ebp - 7], 0
call fcn.10086650
push 0
push dword [0x1018ca04]
mov dword [ebp - 0xb], eax
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.10086650
mov ecx, dword [0x1018ca04]
cmp ebx, ecx
mov edx, dword [eax + 7]
mov eax, ecx
cmovbe eax, ebx
mov dword [ebp - 0xc], edx
cmp edx, eax
jb 0x100863fc
cmp ebx, ecx
mov eax, ebx
cmovbe eax, ecx
cmp edx, eax
ja 0x100863fc
mov dword [0x1018baf4], edx
test edx, edx
je 0x10086433
mov eax, dword [ebp - 0x1c]
cmp ebx, ecx
mov eax, dword [eax + 0x9c]
mov dword [ebp - 0x14], eax
mov edx, dword [eax + 0x30]
mov eax, ecx
cmovbe eax, ebx
mov dword [ebp - 0x1c], eax
cmp edx, eax
jb 0x10085960
cmp ebx, ecx
mov eax, ebx
cmovbe eax, ecx
cmp edx, eax
jbe 0x1008597b
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 0x1a]
cmp edx, eax
jb 0x100863e1
cmp ebx, ecx
cmovbe ebx, ecx
cmp edx, ebx
ja 0x100863e1
mov dword [0x1018b74c], edx
test edx, edx
je 0x10086433
mov ebx, dword [0x1018c9fc]
push 0
push dword [0x1018ca04]
push ebx
push str.xxxx____xx____xx_____xxxx
push 0x10125094
call fcn.100865c0
mov edx, eax
mov eax, dword [0x1018ca04]
cmp ebx, eax
mov ecx, eax
cmovbe ecx, ebx
cmp edx, ecx
jb 0x100863c6
cmp ebx, eax
cmovbe ebx, eax
cmp edx, ebx
ja 0x100863c6
mov eax, dword [edx + 0xa]
mov dword [0x1018bb0c], eax
test eax, eax
je 0x10086433
push 0
push edi
push esi
push str.ScreenFade
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0xf], 0
call fcn.10086650
push 0
push edi
mov dword [ebp - 0x13], eax
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.10086650
cmp esi, edi
mov ecx, dword [eax + 0x18]
mov eax, edi
cmovbe eax, esi
cmp ecx, eax
jb 0x100863ab
cmp esi, edi
mov eax, esi
cmovbe eax, edi
cmp ecx, eax
ja 0x100863ab
mov dword [0x1018b6e0], ecx
test ecx, ecx
je 0x10086433
push 0
push edi
push esi
push str.CL_Parse_Sound:_ent___i__cl.max_edicts__i
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0xf], 0
call fcn.10086650
push 0
push edi
mov dword [ebp - 0x13], eax
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.10086650
mov ecx, dword [eax - 0x10]
sub eax, 0x10
add ecx, 4
mov ebx, edi
add ecx, eax
cmp esi, edi
cmovbe ebx, esi
cmp ecx, ebx
jb 0x10085a76
cmp esi, edi
mov eax, esi
cmovbe eax, edi
cmp ecx, eax
jbe 0x10085abe
push 0
push edi
push esi
push str.CL_Parse_Sound:_ent___i__cl.max_edicts__i
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0xf], 0
call fcn.10086650
push 0
push edi
mov dword [ebp - 0x13], eax
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.10086650
mov ecx, dword [eax - 0x11]
sub eax, 0x11
add ecx, 4
add ecx, eax
cmp ecx, ebx
jb 0x1008638d
cmp esi, edi
mov eax, esi
cmovbe eax, edi
cmp ecx, eax
ja 0x1008638d
mov dword [0x1018bab0], ecx
test ecx, ecx
je 0x10086433
mov ecx, dword [ebp - 0xc]
push 3
mov ecx, dword [ecx + 0x48]
lea eax, [ecx + 0x32]
push eax
push ecx
push str.xxx____x
push 0x10125038
call fcn.100865c0
push 7
mov ecx, dword [eax]
add eax, 4
add ecx, eax
lea eax, [ecx + 0x32]
push eax
push ecx
push str.___xxxx____x
push 0x10125060
call fcn.100865c0
cmp esi, edi
mov ecx, edi
cmovbe ecx, esi
cmp eax, ecx
jb 0x1008636f
cmp esi, edi
mov ecx, esi
cmovbe ecx, edi
cmp eax, ecx
ja 0x1008636f
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [0x1018d18c], eax
test eax, eax
je 0x10086433
push 1
push edi
push esi
push str.x____xxx____xxx_xx____xxxxxx
push 0x10124ed0
call fcn.100865c0
mov edx, dword [eax]
sub edx, 4
je 0x10085bf6
mov ecx, dword [edx + 0x188]
lea ebx, [ecx + 5]
add ebx, dword [ecx + 1]
mov ecx, dword [edx + 0x38]
mov dword [0x1018cbac], ebx
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
mov ecx, dword [edx + 0x68]
mov dword [0x1018cba4], eax
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
mov ecx, dword [edx + 0xe0]
mov dword [0x1018cba8], eax
mov eax, dword [ecx + 1]
cmp byte [ecx + eax + 0x18], 0xe8
je 0x10085bb5
cmp byte [ecx + eax + 0x1a], 0xe8
je 0x10085bb5
cmp byte [ecx + eax + 0x13], 0xe8
je 0x10085bb5
cmp byte [ecx + eax + 0x10], 0xe8
je 0x10085bb5
push str.COffsets::EngineMsgs
push str._s:_MSG_ReadCoord_not_found._n
jmp 0x10085c00
mov eax, dword [ebx + 1]
mov dword [0x1018cba0], eax
mov eax, dword [edx + 0x50]
cmp byte [eax + 0xe], 0xe8
je 0x10085bd8
cmp byte [eax + 0xc], 0xe8
je 0x10085bd8
push str.COffsets::EngineMsgs
push str._s:_MSG_StartBitReading_not_found._n
jmp 0x10085c00
cmp byte [eax + 0xd6], 0xe8
je 0x10085c16
cmp byte [eax + 0xe2], 0xe8
je 0x10085c16
push str.COffsets::EngineMsgs
push str._s:_MSG_EndBitReading_not_found._n
jmp 0x10085c00
push str.COffsets::EngineMsgs
push str._s:_not_found._n
call fcn.100a6550
mov esi, dword [0x1018c9ec]
add esp, 8
mov edi, dword [0x1018c9f4]
xor edx, edx
push 0
push edi
push esi
push str.xxx____xxxxxxxxxxxxxxxxx
push 0x10125170
mov dword [0x1018cfb4], edx
call fcn.100865c0
mov ecx, dword [eax + 3]
mov eax, edi
add ecx, 0xffeca258
cmp esi, edi
cmovbe eax, esi
cmp ecx, eax
jb 0x10086351
cmp esi, edi
mov eax, esi
cmovbe eax, edi
cmp ecx, eax
ja 0x10086351
mov dword [0x1018b4c4], ecx
test ecx, ecx
je 0x10086433
push 0
push edi
push esi
push str.in_:___i__.2f_k_s
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 7], 0
call fcn.10086650
push 0
push edi
mov dword [ebp - 0xb], eax
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.10086650
push ecx
push esi
push eax
push str.x____xxx
push 0x10124fa4
call fcn.10086530
mov ecx, dword [eax + 1]
mov eax, edi
add ecx, 0xffffffc0
cmp esi, edi
cmovbe eax, esi
cmp ecx, eax
jb 0x10086333
cmp esi, edi
mov eax, esi
cmovbe eax, edi
cmp ecx, eax
ja 0x10086333
mov dword [0x1018b978], ecx
test ecx, ecx
je 0x10086433
push 0
push edi
push esi
push str.unbind__key__:_remove_commands_from_a_key
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 7], 0
call fcn.10086650
push 0
push edi
mov dword [ebp - 0xb], eax
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.10086650
push ecx
push esi
push eax
push str.xx_____
push 0x10124ec8
call fcn.10086530
cmp esi, edi
mov ecx, dword [eax + 3]
mov eax, edi
cmovbe eax, esi
cmp ecx, eax
jb 0x10086315
cmp esi, edi
mov eax, esi
cmovbe eax, edi
cmp ecx, eax
ja 0x10086315
mov dword [0x1018ba50], ecx
test ecx, ecx
je 0x10086433
push 0
push edi
push esi
push str.progs_flame.mdl
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 7], 0
call fcn.10086650
push 0
push edi
mov dword [ebp - 0xb], eax
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.10086650
push 0
push edi
push eax
push 0x10124df8
call fcn.10086650
mov ebx, eax
cmp byte [ebx], 0x90
jne 0x10085d76
inc ebx
cmp byte [ebx], 0x90
je 0x10085d70
cmp esi, edi
mov eax, edi
cmovbe eax, esi
mov dword [ebp - 0x1c], eax
cmp ebx, eax
jb 0x100862f7
cmp esi, edi
mov eax, esi
cmovbe eax, edi
cmp ebx, eax
ja 0x100862f7
push 0
push edi
push ebx
push 0x10124c8c
call fcn.10086650
mov edx, eax
mov dword [ebp - 0x14], edx
cmp edx, dword [ebp - 0x1c]
jb 0x100862d9
cmp esi, edi
mov ecx, esi
cmovbe ecx, edi
cmp edx, ecx
ja 0x100862d9
mov eax, dword [edx + 2]
push 0
mov dword [0x10189d4c], eax
lea eax, [edx + 0x18]
push eax
push edx
push 0x10124e50
mov dword [ebp - 0xc], eax
call fcn.10086650
cmp eax, dword [ebp - 0x1c]
jb 0x10085df8
cmp esi, edi
mov ecx, esi
cmovbe ecx, edi
cmp eax, ecx
ja 0x10085df8
mov eax, dword [eax + 3]
mov dword [0x10189d50], eax
jmp 0x10085e30
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push 0x10124e4c
call fcn.10086650
push str.COffsets::R_DrawEntitiesOnList
push str.___s:_find_cl_visedicts_old_version._n
mov eax, dword [eax + 1]
mov dword [0x10189d50], eax
call fcn.100a6550
mov edi, dword [0x1018c9f4]
add esp, 8
mov esi, dword [0x1018c9ec]
mov dword [0x1018baf0], ebx
test ebx, ebx
je 0x10086433
mov ebx, dword [0x1018c9fc]
push 0
push dword [0x1018ca04]
push ebx
push 0x10124dec
call fcn.10086650
mov edx, eax
mov eax, dword [0x1018ca04]
cmp ebx, eax
mov ecx, eax
cmovbe ecx, ebx
cmp edx, ecx
jb 0x100862bb
cmp ebx, eax
cmovbe ebx, eax
cmp edx, ebx
ja 0x100862bb
mov dword [0x1018ca60], edx
test edx, edx
je 0x10086433
push 0
push edi
push esi
push 0x10124d70
call fcn.10086650
mov ecx, eax
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x10085ef0
test esi, esi
je 0x10085ef0
lea eax, [esi - 2]
mov ebx, ecx
cmp ecx, eax
jbe 0x10085ef0
mov edx, ecx
sub edx, 0x10124d9c
nop dword [eax]
nop dword [eax + eax]
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
mov al, byte [ecx + 0x10124d9c]
cmp al, byte [edx + ecx + 0x10124d9c]
jne 0x10085ee7
inc ecx
cmp ecx, 2
jb 0x10085ed0
jmp 0x10085ef2
dec ebx
lea eax, [esi - 2]
dec edx
cmp ebx, eax
ja 0x10085ec0
xor ebx, ebx
push 0xb
push dword [ebp - 0xc]
push ebx
push str.x____x____xx
push 0x10124dc4
call fcn.100865c0
cmp esi, edi
mov ecx, edi
mov ebx, eax
cmovbe ecx, esi
cmp ebx, ecx
jb 0x100862a7
cmp esi, edi
cmovbe esi, edi
cmp ebx, esi
ja 0x100862a7
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x1018ca64], ebx
movzx eax, byte [ebx]
mov byte [0x1018ca68], al
movzx eax, byte [ebx + 1]
mov byte [0x1018ca69], al
movzx eax, byte [ebx + 2]
push 0x10190e60
mov byte [0x1018ca6a], al
movzx eax, byte [ebx + 3]
push 0x40
mov byte [0x1018ca6b], al
movzx eax, byte [ebx + 4]
push 5
push ebx
mov byte [0x1018ca6c], al
mov dword [ebp - 0xc], 0x90909090
mov byte [ebp - 0x15], 0x90
call esi
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
mov al, byte [ebp - 0x15]
push 0x10190e60
mov byte [ebx + 4], al
push dword [0x10190e60]
push 5
push ebx
call esi
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edi, dword [0x1018c9f4]
mov esi, dword [0x1018c9ec]
push 0
push edi
push esi
push str.Texture_load:__6.1fms
call fcn.10086650
push 0
push edi
mov ebx, eax
mov byte [ebp - 0xc], 0x68
push esi
lea eax, [ebp - 0xc]
mov byte [ebp - 7], 0
push eax
mov dword [ebp - 0xb], ebx
call fcn.10086650
cmp esi, edi
mov ecx, dword [eax - 7]
mov eax, edi
cmovbe eax, esi
cmp ebx, eax
jb 0x10086289
cmp esi, edi
mov eax, esi
cmovbe eax, edi
cmp ebx, eax
ja 0x10086289
mov dword [0x1018ca5c], ecx
test ecx, ecx
je 0x10086433
push 0
push edi
push esi
push str.xxxxxxxxxxx____xx
push 0x10124cf0
call fcn.100865c0
cmp esi, edi
mov ebx, edi
mov edx, eax
cmovbe ebx, esi
cmp edx, ebx
jb 0x1008602d
cmp esi, edi
mov ecx, esi
cmovbe ecx, edi
cmp edx, ecx
jbe 0x10086059
push 0
push edi
push esi
push str.xxxxxxxxx____xx
push 0x10124d24
call fcn.100865c0
mov edx, eax
cmp edx, ebx
jb 0x1008626b
cmp esi, edi
mov eax, esi
cmovbe eax, edi
cmp edx, eax
ja 0x1008626b
mov dword [0x1018baa8], edx
test edx, edx
je 0x10086433
push 0
push edi
push esi
push str._particles
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 7], 0
call fcn.10086650
push 0
push edi
mov dword [ebp - 0xb], eax
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.10086650
push 0xfffffffffffffff6
push edi
push eax
push 0x10124d60
call fcn.10086650
cmp esi, edi
mov ecx, edi
cmovbe ecx, esi
cmp eax, ecx
jb 0x1008624d
cmp esi, edi
mov ecx, esi
cmovbe ecx, edi
cmp eax, ecx
ja 0x1008624d
mov eax, dword [eax + 1]
mov dword [0x1018bac4], eax
test eax, eax
je 0x10086433
mov eax, dword [0x1018baf4]
cmp dword [eax + 0xdc], 0
je 0x10086433
mov eax, dword [0x1018bbcc]
cmp dword [eax + 0x4c], 0
je 0x10086433
mov eax, dword [0x1018bb0c]
cmp dword [eax + 0x34], 0
je 0x10086433
mov eax, dword [0x1018b74c]
cmp dword [eax + 0x74], 0
je 0x10086433
push 0
push edi
push esi
push str._c_c_c_cconnect__i__i___s____s__n
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 7], 0
call fcn.10086650
push 0
push edi
mov dword [ebp - 0xb], eax
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.10086650
push ecx
push esi
push eax
push str.x____xxxxx
push 0x10124c74
call fcn.10086530
cmp esi, edi
mov ecx, edi
mov edx, eax
cmovbe ecx, esi
cmp edx, ecx
jb 0x1008622f
cmp esi, edi
cmovbe esi, edi
cmp edx, esi
ja 0x1008622f
mov eax, dword [edx + 1]
add eax, 5
add eax, edx
mov dword [0x1018b994], eax
je 0x10086433
call fcn.10086450
mov dword [0x10189d80], eax
test eax, eax
je 0x10086433
mov esi, dword [0x1018bbcc]
mov ecx, 0x2b
mov edi, 0x1018bb10
rep movsd dword es:[edi], dword [esi]
mov esi, dword [0x1018baf4]
mov ecx, 0x86
mov edi, 0x1018b4c8
rep movsd dword es:[edi], dword [esi]
mov esi, dword [0x1018b74c]
mov ecx, 0x2e
mov eax, dword [0x1018b620]
mov edi, 0x1018b998
rep movsd dword es:[edi], dword [esi]
mov esi, dword [0x1018bb0c]
mov ecx, 0x19
mov edi, 0x1018b6e8
rep movsd dword es:[edi], dword [esi]
mov esi, dword [0x1018c9f4]
push 0
push esi
push dword [eax + 8]
push 0x10124c8c
call fcn.10086650
mov edx, dword [0x1018c9ec]
mov ecx, esi
cmp edx, esi
cmovbe ecx, edx
cmp eax, ecx
jb 0x1008621b
cmp edx, esi
cmovbe edx, esi
cmp eax, edx
ja 0x1008621b
mov eax, dword [eax + 2]
mov dword [0x10189d78], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c55b5
mov esp, ebp
pop ebp
ret
push str.COffsets::GlobalTime
push str._s:_not_found._n
call fcn.100a6550
jmp 0x10086430
push str.COffsets::InitiateGameConnection
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018b994], 0
jmp 0x10086430
push str.COffsets::Particles
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018bac4], 0
jmp 0x10086430
push str.COffsets::CL_RecordHUDCommand
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018baa8], 0
jmp 0x10086430
push str.COffsets::FindSpeed
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018ca5c], 0
jmp 0x10086430
push str.COffsets::PatchInterpolationTime
push str._s:_not_found._n
call fcn.100a6550
jmp 0x10086430
push str.COffsets::FindInitPoint
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018ca60], 0
jmp 0x10086430
push str.COffsets::R_DrawEntitiesOnList
push str._s:_cl_numvisedicts_not_found._n
call fcn.100a6550
mov dword [0x1018baf0], 0
jmp 0x10086430
push str.COffsets::R_DrawEntitiesOnList
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018baf0], 0
jmp 0x10086430
push str.COffsets::KeyBindings
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018ba50], 0
jmp 0x10086430
push str.COffsets::ClientStatic
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018b978], 0
jmp 0x10086430
push str.COffsets::ClientState
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018b4c4], 0
jmp 0x10086430
push str.COffsets::ClientUserMsgs
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018d18c], 0
jmp 0x10086430
push str.COffsets::PreS_DynamicSound
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018bab0], 0
jmp 0x10086430
push str.COffsets::PlayerMove
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018b6e0], 0
jmp 0x10086430
push str.COffsets::StudioRenderModel
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018bb0c], 0
jmp 0x10086430
push str.COffsets::Studio
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018b74c], 0
jmp 0x10086430
push str.COffsets::Engine
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018baf4], 0
jmp 0x10086430
push str.COffsets::Client
push str._s:_not_found._n
call fcn.100a6550
mov dword [0x1018bbcc], 0
add esp, 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c55b5
mov esp, ebp
pop ebp
ret