Function at 0x10004890
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Execute shellcode via indirect call
Inject thread
Set console window title
Spawn thread to rwx shellcode

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x448
mov eax, dword [esp + 0x460]
cmp eax, 1
je 0x100048b2
test eax, eax
jne 0x100058d3
xor ecx, ecx
int 0x29
push str.hl2.exe
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10005804
push str.vaudio_speex.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
lea ebp, [eax + 0x1ab0]
lea ebx, [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push 0x40
push 1
push ebp
call edi
mov byte [esi + 0x1ab0], 0xc3
push ebx
push dword [esp + 0x18]
push 1
push ebp
call edi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push str.Segregation
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 0x10008648
push str.CONOUT_
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfreopen]
add esp, 0xc
push 0xfde9
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
movaps xmm0, xmmword [0x10008140]
movups xmmword [esp + 0x14], xmm0
mov dword [esp + 0x24], 0x190
lea eax, [esp + 0x28]
push str.Terminal
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
add esp, 8
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 8
push 0x4f
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
lea eax, [esp + 0x240]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov dword [esp + 4], 0
movsx eax, word [esp + 0x240]
movsx ecx, word [esp + 0x242]
imul ecx, eax
mov eax, dword [esp + 4]
lea edx, [esp + 0x10]
push edx
push eax
push ecx
push 0x4f
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
push str.engine.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x100f7660], eax
push str._____Delimit_Interface
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
add esp, 4
mov ebp, dword [0x100f7660]
lea esi, [ebp + 0x14bd34]
mov eax, esp
push eax
mov edi, eax
push 0x40
push 5
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
mov dword [ebp + 0x14bd34], 0x903040fe
mov byte [ebp + 0x14bd38], 0xeb
push edi
push dword [esp + 4]
push 5
push esi
call ebx
mov eax, dword [0x100f7660]
mov byte [eax + 0x616a70], 1
mov ebp, dword [0x100f7660]
lea esi, [ebp + 0x17e14c]
push edi
push 0x40
push 1
push esi
call ebx
mov byte [ebp + 0x17e14c], 0xeb
push edi
push dword [esp + 4]
push 1
push esi
call ebx
push str._____Extend_Interface
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
call eax
add esp, 4
mov ebp, dword [0x100f7660]
lea esi, [ebp + 0x247d09]
push edi
push 0x40
push 2
push esi
call ebx
mov word [ebp + 0x247d09], _execute_onexit_table
push edi
push dword [esp + 4]
push 2
push esi
call ebx
mov edi, ebx
call fcn.100012d0
push str._____Events
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
add esp, 4
mov ebp, dword [0x100f76ac]
lea ebx, [ebp + 0x17a7b0]
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x100f81d4], eax
mov ecx, dword [ebp + 0x17a7b0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x17a7b4]
mov word [eax + 4], cx
mov eax, dword [0x100f81d4]
lea ecx, [ebp + 0x17a7b6]
mov byte [eax + 6], 0x68
mov eax, dword [0x100f81d4]
mov dword [eax + 7], ecx
mov eax, dword [0x100f81d4]
mov byte [eax + 0xb], 0xc3
mov esi, esp
push esi
push 0x40
push 0xc
push dword [0x100f81d4]
call edi
push esi
push 0x40
push 6
push ebx
call edi
mov byte [ebp + 0x17a7b0], 0x68
mov dword [ebp + 0x17a7b1], 0x10001720
mov byte [ebp + 0x17a7b5], 0xc3
push esi
mov edi, esi
push dword [esp + 4]
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebp, dword [0x100f7660]
lea esi, [ebp + 0xbfc6c]
push edi
push 0x40
push 1
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
mov byte [ebp + 0xbfc6c], 0xeb
push edi
push dword [esp + 4]
push 1
push esi
call ebx
push 4
mov ebp, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call ebp
add esp, 4
mov esi, eax
push 8
call ebp
add esp, 4
mov dword [eax + 4], 0x100017f0
mov dword [esi], eax
mov ecx, dword [0x100f7660]
lea eax, [ecx + 0x196840]
add ecx, 0x636138
push 0
push str.player_hurt
push esi
call eax
mov ecx, dword [0x100f7660]
lea eax, [ecx + 0x196840]
add ecx, 0x636138
push 0
push str.player_death
push esi
call eax
mov ecx, dword [0x100f7660]
lea eax, [ecx + 0x196840]
add ecx, 0x636138
push 0
push str.bullet_impact
push esi
call eax
mov ebp, dword [0x100f7660]
lea esi, [ebp + 0x198400]
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x100f84b0], eax
mov ecx, dword [ebp + 0x198400]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x198404]
mov word [eax + 4], cx
mov eax, dword [0x100f84b0]
lea ecx, [ebp + 0x198406]
mov byte [eax + 6], 0x68
mov eax, dword [0x100f84b0]
mov dword [eax + 7], ecx
mov eax, dword [0x100f84b0]
mov byte [eax + 0xb], 0xc3
push edi
push 0x40
push 0xc
push dword [0x100f84b0]
call ebx
push edi
push 0x40
push 6
push esi
call ebx
mov edi, ebx
mov byte [ebp + 0x198400], 0x68
mov dword [ebp + 0x198401], 0x10001a30
mov byte [ebp + 0x198405], 0xc3
mov eax, esp
push eax
mov ebx, eax
push dword [esp + 4]
push 6
push esi
call edi
push str._____Interpolation
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
call eax
add esp, 4
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x85c20]
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x100f84b4], eax
mov ecx, dword [ebp + 0x85c20]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x85c24]
mov word [eax + 4], cx
mov eax, dword [0x100f84b4]
lea ecx, [ebp + 0x85c26]
mov byte [eax + 6], 0x68
mov eax, dword [0x100f84b4]
mov dword [eax + 7], ecx
mov eax, dword [0x100f84b4]
mov byte [eax + 0xb], 0xc3
push ebx
push 0x40
push 0xc
push dword [0x100f84b4]
call edi
push ebx
push 0x40
push 6
push esi
call edi
mov byte [ebp + 0x85c20], 0x68
mov dword [ebp + 0x85c21], 0x10001ac0
mov byte [ebp + 0x85c25], 0xc3
push ebx
push dword [esp + 4]
push 6
push esi
call edi
push str._____Animations
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
add esp, 4
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x1d39c0]
push 0x10
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x100f84c0], eax
mov ecx, dword [ebp + 0x1d39c0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x1d39c4]
mov word [eax + 4], cx
mov eax, dword [0x100f84c0]
mov ecx, dword [ebp + 0x1d39c6]
mov dword [eax + 6], ecx
mov eax, dword [0x100f84c0]
mov byte [eax + 0xa], 0x68
lea eax, [ebp + 0x1d39ca]
mov ecx, dword [0x100f84c0]
mov dword [ecx + 0xb], eax
mov eax, dword [0x100f84c0]
mov byte [eax + 0xf], 0xc3
push ebx
push 0x40
push 0x10
push dword [0x100f84c0]
call edi
push ebx
push 0x40
push 6
push esi
call edi
mov byte [ebp + 0x1d39c0], 0x68
mov dword [ebp + 0x1d39c1], 0x10001ae0
mov byte [ebp + 0x1d39c5], 0xc3
push ebx
push dword [esp + 4]
push 6
push esi
call edi
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x1d39e5]
push ebx
push 0x40
push 1
push esi
call edi
mov byte [ebp + 0x1d39e5], 0xeb
push ebx
push dword [esp + 4]
push 1
push esi
call edi
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x92f30]
push ebx
push 0x40
push 2
push esi
call edi
mov word [ebp + 0x92f30], _execute_onexit_table
push ebx
push dword [esp + 4]
push 2
push esi
call edi
mov esi, edi
mov ebp, dword [0x100f76ac]
lea edi, [ebp + 0x5bcf0]
push 0xc
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call eax
add esp, 4
mov dword [0x100f84c4], eax
mov ecx, dword [ebp + 0x5bcf0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x5bcf4]
mov word [eax + 4], cx
mov eax, dword [0x100f84c4]
lea ecx, [ebp + 0x5bcf6]
mov byte [eax + 6], 0x68
mov eax, dword [0x100f84c4]
mov dword [eax + 7], ecx
mov eax, dword [0x100f84c4]
mov byte [eax + 0xb], 0xc3
push ebx
push 0x40
push 0xc
push dword [0x100f84c4]
call esi
push ebx
push 0x40
push 6
push edi
call esi
mov byte [ebp + 0x5bcf0], 0x68
mov dword [ebp + 0x5bcf1], fcn.10001b10
mov byte [ebp + 0x5bcf5], 0xc3
push ebx
push dword [esp + 4]
push 6
push edi
call esi
mov edi, esi
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x860d0]
push ebx
push 0x40
push 3
push esi
call edi
mov word [ebp + 0x860d0], 0x10c2
mov byte [ebp + 0x860d2], 0
push ebx
push dword [esp + 4]
push 3
push esi
call edi
push str._____Prediction
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
add esp, 4
mov eax, dword [0x100f76ac]
movups xmm0, xmmword [eax + 0x498974]
movups xmmword [0x100f8ae8], xmm0
movsd xmm0, qword [eax + 0x498984]
movsd qword [0x100f8af8], xmm0
mov dword [eax + 0x498974], 0x100f751c
mov dword [eax + 0x498978], 1
mov dword [eax + 0x498980], 0x100f8ae8
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x17a1f0]
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x100f84c8], eax
mov ecx, dword [ebp + 0x17a1f0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x17a1f4]
mov word [eax + 4], cx
mov eax, dword [0x100f84c8]
lea ecx, [ebp + 0x17a1f6]
mov byte [eax + 6], 0x68
mov eax, dword [0x100f84c8]
mov dword [eax + 7], ecx
mov eax, dword [0x100f84c8]
mov byte [eax + 0xb], 0xc3
push ebx
push 0x40
push 0xc
push dword [0x100f84c8]
call edi
push ebx
push 0x40
push 6
push esi
call edi
mov byte [ebp + 0x17a1f0], 0x68
mov dword [ebp + 0x17a1f1], 0x10001c40
mov byte [ebp + 0x17a1f5], 0xc3
push ebx
push dword [esp + 4]
push 6
push esi
call edi
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x17a205]
push ebx
push 0x40
push 8
push esi
call edi
mov dword [ebp + 0x17a209], 0x90909090
mov dword [ebp + 0x17a205], 0x90909090
push ebx
push dword [esp + 4]
push 8
push esi
call edi
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x17bb71]
push ebx
push 0x40
push 1
push esi
call edi
mov byte [ebp + 0x17bb71], 0xeb
push ebx
push dword [esp + 4]
push 1
push esi
call edi
mov esi, edi
mov ebp, dword [0x100f76ac]
lea edi, [ebp + 0x17b090]
push 0xc
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call eax
add esp, 4
mov dword [0x100f8a6c], eax
mov ecx, dword [ebp + 0x17b090]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x17b094]
mov word [eax + 4], cx
mov eax, dword [0x100f8a6c]
lea ecx, [ebp + 0x17b096]
mov byte [eax + 6], 0x68
mov eax, dword [0x100f8a6c]
mov dword [eax + 7], ecx
mov eax, dword [0x100f8a6c]
mov byte [eax + 0xb], 0xc3
push ebx
push 0x40
push 0xc
push dword [0x100f8a6c]
call esi
push ebx
push 0x40
push 6
push edi
call esi
mov byte [ebp + 0x17b090], 0x68
mov dword [ebp + 0x17b091], 0x10001cc0
mov byte [ebp + 0x17b095], 0xc3
push ebx
push dword [esp + 4]
push 6
push edi
mov edi, esi
call esi
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x17b5a0]
push 0xe
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x100f8a74], eax
mov ecx, dword [ebp + 0x17b5a0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x17b5a4]
mov word [eax + 4], cx
mov eax, dword [0x100f8a74]
movzx ecx, word [ebp + 0x17b5a6]
mov word [eax + 6], cx
mov eax, dword [0x100f8a74]
mov byte [eax + 8], 0x68
lea eax, [ebp + 0x17b5a8]
mov ecx, dword [0x100f8a74]
mov dword [ecx + 9], eax
mov eax, dword [0x100f8a74]
mov byte [eax + 0xd], 0xc3
push ebx
push 0x40
push 0xe
push dword [0x100f8a74]
call edi
push ebx
push 0x40
push 6
push esi
call edi
mov byte [ebp + 0x17b5a0], 0x68
mov dword [ebp + 0x17b5a1], 0x10001cf0
mov byte [ebp + 0x17b5a5], 0xc3
push ebx
push dword [esp + 4]
push 6
push esi
call edi
mov ebp, dword [0x100f76ac]
lea edi, [ebp + 0x1db0b0]
push 0xd
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call eax
add esp, 4
mov dword [0x100f8a78], eax
mov ecx, dword [ebp + 0x1db0b0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x1db0b4]
mov word [eax + 4], cx
mov eax, dword [0x100f8a78]
movzx ecx, byte [ebp + 0x1db0b6]
mov byte [eax + 6], cl
mov eax, dword [0x100f8a78]
mov byte [eax + 7], 0x68
lea eax, [ebp + 0x1db0b7]
mov ecx, dword [0x100f8a78]
mov dword [ecx + 8], eax
mov eax, dword [0x100f8a78]
mov byte [eax + 0xc], 0xc3
push ebx
push 0x40
push 0xd
push dword [0x100f8a78]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
push ebx
push 0x40
push 6
push edi
call esi
mov byte [ebp + 0x1db0b0], 0x68
mov dword [ebp + 0x1db0b1], 0x10001d20
mov byte [ebp + 0x1db0b5], 0xc3
push ebx
push dword [esp + 4]
push 6
push edi
mov edi, esi
call esi
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x17a310]
push 0xd
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x100f8a7c], eax
mov ecx, dword [ebp + 0x17a310]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x17a314]
mov word [eax + 4], cx
mov eax, dword [0x100f8a7c]
movzx ecx, byte [ebp + 0x17a316]
mov byte [eax + 6], cl
mov eax, dword [0x100f8a7c]
mov byte [eax + 7], 0x68
lea eax, [ebp + 0x17a317]
mov ecx, dword [0x100f8a7c]
mov dword [ecx + 8], eax
mov eax, dword [0x100f8a7c]
mov byte [eax + 0xc], 0xc3
push ebx
push 0x40
push 0xd
push dword [0x100f8a7c]
call edi
push ebx
push 0x40
push 6
push esi
call edi
mov byte [ebp + 0x17a310], 0x68
mov dword [ebp + 0x17a311], 0x10001ec0
mov byte [ebp + 0x17a315], 0xc3
push ebx
push dword [esp + 4]
push 6
push esi
call edi
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x69a10]
push 0xc
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call eax
add esp, 4
mov dword [0x100f8a80], eax
mov ecx, dword [ebp + 0x69a10]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x69a14]
mov word [eax + 4], cx
mov eax, dword [0x100f8a80]
lea ecx, [ebp + 0x69a16]
mov byte [eax + 6], 0x68
mov eax, dword [0x100f8a80]
mov dword [eax + 7], ecx
mov eax, dword [0x100f8a80]
mov byte [eax + 0xb], 0xc3
push ebx
push 0x40
push 0xc
push dword [0x100f8a80]
call edi
push ebx
push 0x40
push 6
push esi
call edi
mov byte [ebp + 0x69a10], 0x68
mov dword [ebp + 0x69a11], 0x10001f20
mov byte [ebp + 0x69a15], 0xc3
push ebx
push dword [esp + 4]
push 6
push esi
call edi
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x17b9c0]
push 0x10
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x100f8a84], eax
mov ecx, dword [ebp + 0x17b9c0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x17b9c4]
mov word [eax + 4], cx
mov eax, dword [0x100f8a84]
mov ecx, dword [ebp + 0x17b9c6]
mov dword [eax + 6], ecx
mov eax, dword [0x100f8a84]
mov byte [eax + 0xa], 0x68
lea eax, [ebp + 0x17b9ca]
mov ecx, dword [0x100f8a84]
mov dword [ecx + 0xb], eax
mov eax, dword [0x100f8a84]
mov byte [eax + 0xf], 0xc3
push ebx
push 0x40
push 0x10
push dword [0x100f8a84]
call edi
push ebx
push 0x40
push 6
push esi
call edi
mov byte [ebp + 0x17b9c0], 0x68
mov dword [ebp + 0x17b9c1], 0x10001f40
mov byte [ebp + 0x17b9c5], 0xc3
push ebx
push dword [esp + 4]
push 6
push esi
call edi
push str._____Network
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
add esp, 4
mov ebp, dword [0x100f7660]
lea ebx, [ebp + 0xbc690]
push 0xc
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call eax
add esp, 4
mov dword [0x100f8a88], eax
mov ecx, dword [ebp + 0xbc690]
mov dword [eax], ecx
movzx ecx, word [ebp + 0xbc694]
mov word [eax + 4], cx
mov eax, dword [0x100f8a88]
lea ecx, [ebp + 0xbc696]
mov byte [eax + 6], 0x68
mov eax, dword [0x100f8a88]
mov dword [eax + 7], ecx
mov eax, dword [0x100f8a88]
mov byte [eax + 0xb], 0xc3
mov esi, esp
push esi
push 0x40
push 0xc
push dword [0x100f8a88]
call edi
push esi
push 0x40
push 6
push ebx
call edi
mov byte [ebp + 0xbc690], 0x68
mov dword [ebp + 0xbc691], 0x10001fc0
mov byte [ebp + 0xbc695], 0xc3
push esi
push dword [esp + 4]
push 6
push ebx
call edi
mov ebx, edi
mov ebp, dword [0x100f7660]
lea esi, [ebp + 0xbc1e0]
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x100f8a90], eax
mov ecx, dword [ebp + 0xbc1e0]
mov dword [eax], ecx
movzx ecx, word [ebp + 0xbc1e4]
mov word [eax + 4], cx
mov eax, dword [0x100f8a90]
lea ecx, [ebp + 0xbc1e6]
mov byte [eax + 6], 0x68
mov eax, dword [0x100f8a90]
mov dword [eax + 7], ecx
mov eax, dword [0x100f8a90]
mov byte [eax + 0xb], 0xc3
mov edi, esp
push edi
push 0x40
push 0xc
push dword [0x100f8a90]
call ebx
push edi
push 0x40
push 6
push esi
call ebx
mov byte [ebp + 0xbc1e0], 0x68
mov dword [ebp + 0xbc1e1], 0x10001ff0
mov byte [ebp + 0xbc1e5], 0xc3
push edi
push dword [esp + 4]
push 6
push esi
call ebx
mov ebp, dword [0x100f7660]
lea esi, [ebp + 0xbcb40]
push edi
push 0x40
push 6
push esi
call ebx
mov byte [ebp + 0xbcb40], 0x68
mov dword [ebp + 0xbcb41], 0x10002070
mov byte [ebp + 0xbcb45], 0xc3
push edi
push dword [esp + 4]
push 6
push esi
call ebx
mov ebp, dword [0x100f7660]
lea esi, [ebp + 0x1efd60]
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x100f8a94], eax
mov ecx, dword [ebp + 0x1efd60]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x1efd64]
mov word [eax + 4], cx
mov eax, dword [0x100f8a94]
lea ecx, [ebp + 0x1efd66]
mov byte [eax + 6], 0x68
mov eax, dword [0x100f8a94]
mov dword [eax + 7], ecx
mov eax, dword [0x100f8a94]
mov byte [eax + 0xb], 0xc3
mov ebx, edi
push edi
push 0x40
push 0xc
push dword [0x100f8a94]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
push ebx
push 0x40
push 6
push esi
call edi
mov byte [ebp + 0x1efd60], 0x68
mov dword [ebp + 0x1efd61], 0x10002170
mov byte [ebp + 0x1efd65], 0xc3
push ebx
push dword [esp + 4]
push 6
push esi
call edi
push 0x1000864c
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
add esp, 4
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x147fa3]
push ebx
push 0x40
push 3
push esi
call edi
mov word [ebp + 0x147fa3], _execute_onexit_table
mov byte [ebp + 0x147fa5], 0x90
push ebx
push dword [esp + 4]
push 3
push esi
call edi
mov ebx, edi
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x11f820]
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x100f8ab0], eax
mov ecx, dword [ebp + 0x11f820]
mov dword [eax], ecx
movzx ecx, word [ebp + 0x11f824]
mov word [eax + 4], cx
mov eax, dword [0x100f8ab0]
lea ecx, [ebp + 0x11f826]
mov byte [eax + 6], 0x68
mov eax, dword [0x100f8ab0]
mov dword [eax + 7], ecx
mov eax, dword [0x100f8ab0]
mov byte [eax + 0xb], 0xc3
mov edi, esp
push edi
push 0x40
push 0xc
push dword [0x100f8ab0]
call ebx
push edi
push 0x40
push 6
push esi
call ebx
mov byte [ebp + 0x11f820], 0x68
mov dword [ebp + 0x11f821], 0x100021c0
mov byte [ebp + 0x11f825], 0xc3
push edi
push dword [esp + 4]
push 6
push esi
call ebx
push str._____View_Effects
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
call eax
add esp, 4
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x68fc6]
push edi
push 0x40
push 0x34
push esi
call ebx
movaps xmm0, xmmword [0x10008150]
movups xmmword [ebp + 0x68fc6], xmm0
movups xmmword [ebp + 0x68fd6], xmm0
movups xmmword [ebp + 0x68fe6], xmm0
mov dword [ebp + 0x68ff6], 0x90909090
push edi
push dword [esp + 4]
push 0x34
push esi
call ebx
push str._____Crosshair
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
add esp, 4
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x20e5f0]
push edi
push 0x40
push 6
push esi
call ebx
mov byte [ebp + 0x20e5f0], 0x68
mov dword [ebp + 0x20e5f1], 0x10004350
mov byte [ebp + 0x20e5f5], 0xc3
push edi
push dword [esp + 4]
push 6
push esi
call ebx
push str._____Materials
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
add esp, 4
push str.MaterialSystem.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
lea ebp, [eax + 0x3a7c0]
push 0x11
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x100f8ae0], eax
mov ecx, dword [esi + 0x3a7c0]
mov dword [eax], ecx
movzx ecx, word [esi + 0x3a7c4]
mov word [eax + 4], cx
mov eax, dword [0x100f8ae0]
mov ecx, dword [esi + 0x3a7c6]
mov dword [eax + 6], ecx
movzx ecx, byte [esi + 0x3a7ca]
mov byte [eax + 0xa], cl
mov byte [eax + 0xb], 0x68
lea eax, [esi + 0x3a7cb]
mov ecx, dword [0x100f8ae0]
mov dword [ecx + 0xc], eax
mov eax, dword [0x100f8ae0]
mov byte [eax + 0x10], 0xc3
push edi
push 0x40
push 0x11
push dword [0x100f8ae0]
call ebx
push edi
push 0x40
push 6
push ebp
call ebx
mov byte [esi + 0x3a7c0], 0x68
mov dword [esi + 0x3a7c1], 0x10004810
mov byte [esi + 0x3a7c5], 0xc3
push edi
push dword [esp + 4]
push 6
push ebp
call ebx
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x8e490]
push edi
push 0x40
push 6
push esi
call ebx
mov byte [ebp + 0x8e490], 0x68
mov dword [ebp + 0x8e491], 0x10004870
mov byte [ebp + 0x8e495], 0xc3
push edi
push dword [esp + 4]
push 6
push esi
call ebx
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x1a98e4]
push edi
push 0x40
push 1
push esi
call ebx
mov byte [ebp + 0x1a98e4], 0
push edi
push dword [esp + 4]
push 1
push esi
call ebx
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x1c1ed8]
push edi
push 0x40
push 1
push esi
call ebx
mov byte [ebp + 0x1c1ed8], 0xeb
push edi
push dword [esp + 4]
push 1
push esi
call ebx
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x2344f0]
push edi
push 0x40
push 3
push esi
call ebx
mov word [ebp + 0x2344f0], 0x8c2
mov byte [ebp + 0x2344f2], 0
push edi
push dword [esp + 4]
push 3
push esi
call ebx
mov ebp, dword [0x100f76ac]
lea esi, [ebp + 0x1d3160]
push edi
push 0x40
push 1
push esi
call ebx
mov byte [ebp + 0x1d3160], 0xc3
push edi
push dword [esp + 4]
push 1
push esi
call ebx
jmp 0x100058d3
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x14], 0x22c
lea edi, [esp + 0x38]
lea ebp, [esp + 0x14]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
nop word cs:[eax + eax]
push ebp
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x100058d3
push str.hl2.exe
push edi
call ebx
add esp, 8
test eax, eax
jne 0x10005830
push dword [esp + 0x1c]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
sub esp, 0x14
movaps xmm0, xmmword [0x10008160]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
lea ebx, [esp + 0x240]
push 0x208
push ebx
push dword [esp + 0x464]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x208
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push edi
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, 1
add esp, 0x448
pop esi
pop edi
pop ebx
pop ebp
ret 0xc