Function at 0x10002050
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x1000c6fc]
sub esp, 0xc
push ebx
push esi
push edi
cmp eax, 0x445c
ja 0x1000208d
je 0x100020af
cmp eax, 0x140
ja 0x1000207f
je 0x100020af
sub eax, 0xdc
je 0x100020af
sub eax, 0x14
jmp 0x100020a9
cmp eax, 0x1b8
je 0x100020af
cmp eax, 0x2da
jmp 0x100020a9
cmp eax, 0x5898a
ja 0x100020a4
je 0x100020af
cmp eax, 0x4470
je 0x100020af
cmp eax, 0x454c
jmp 0x100020a9
cmp eax, 0xb09be
je 0x100020af
xor eax, eax
jmp 0x100020cb
push str.get_d3d9ex_device
mov edx, str.A1_____________6A_00_56_6A_00_8B_08_6A_15_68_____________6A_00_6A_01_6A_01_50_FF_51_5C_85_C0_79_06_C7_06
mov ecx, str.shaderapidx9.dll
call fcn.10001210
add esp, 4
mov eax, dword [eax + 1]
mov eax, dword [eax]
mov dword [0x1000c69c], eax
mov eax, dword [0x1000c6fc]
cmp eax, 0x445c
ja 0x10002101
je 0x10002146
cmp eax, 0x140
ja 0x100020f3
je 0x10002146
sub eax, 0xdc
je 0x10002146
sub eax, 0x14
jmp 0x10002140
cmp eax, 0x1b8
je 0x10002146
cmp eax, 0x2da
jmp 0x10002140
cmp eax, 0x5898a
ja 0x1000213b
je 0x10002118
cmp eax, 0x4470
je 0x10002146
cmp eax, 0x454c
jmp 0x10002140
push str.engine.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.CreateInterface
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x14]
push ecx
push str.VEngineClient015
jmp 0x10002167
cmp eax, 0xb09be
je 0x10002146
xor edx, edx
jmp 0x1000216e
push str.engine.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.CreateInterface
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x10]
push ecx
push str.VEngineClient014
call eax
mov edx, eax
add esp, 8
mov ecx, dword [0x1000c6fc]
mov dword [0x1000c6ec], edx
cmp ecx, 0x445c
ja 0x100021b6
je 0x100021dc
cmp ecx, 0x140
ja 0x1000219c
je 0x100021dc
mov eax, ecx
sub eax, 0xdc
je 0x100021dc
sub eax, 0x14
jmp 0x100021d6
cmp ecx, 0x1b8
je 0x100021dc
cmp ecx, 0x2da
jne 0x100021d8
mov eax, dword [edx]
mov eax, dword [eax + 0x1b0]
jmp 0x100021e4
cmp ecx, 0x5898a
ja 0x100021d0
je 0x100021ac
cmp ecx, 0x4470
je 0x100021dc
cmp ecx, 0x454c
jmp 0x100021d6
cmp ecx, 0xb09be
je 0x100021dc
xor eax, eax
jmp 0x100021e4
mov eax, dword [edx]
mov eax, dword [eax + 0x198]
mov dword [0x1000c730], eax
cmp ecx, 0x445c
ja 0x1000223d
je 0x10002263
cmp ecx, 0x140
ja 0x1000220a
je 0x10002263
sub ecx, 0xdc
je 0x10002263
sub ecx, 0x14
jmp 0x1000225d
cmp ecx, 0x1b8
je 0x10002263
cmp ecx, 0x2da
jne 0x1000225f
push str.get_signon_state_ptr
mov edx, str.A1_____________33_D2_6A_00_6A_00_33_C9_C7_80
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
mov eax, dword [eax + 1]
mov eax, dword [eax]
add eax, 0x108
jmp 0x1000227d
cmp ecx, 0x5898a
ja 0x10002257
je 0x10002263
cmp ecx, 0x4470
je 0x10002263
cmp ecx, 0x454c
jmp 0x1000225d
cmp ecx, 0xb09be
je 0x10002263
xor eax, eax
jmp 0x1000227d
push str.get_signon_state_ptr
mov edx, str.C7_05_________________________89_87_____________89_87_____________8B_45_08
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
add eax, 2
mov dword [0x1000c738], eax
mov eax, dword [0x1000c6fc]
cmp eax, 0xf0
je 0x100022bc
cmp eax, 0x1b8
je 0x100022bc
cmp eax, 0x2da
jne 0x10002388
push str.get_local_player_ptr
mov edx, str.8B_35_____________85_F6_74_2E_8B_06_8B_CE_FF_50_28
mov ecx, str.client.dll
call fcn.10001210
add esp, 4
add eax, 2
jmp 0x100022d4
push str.get_local_player_ptr
mov edx, str.A3_____________68_____________8B_01_FF_50____8B_C8_E8
mov ecx, str.client.dll
call fcn.10001210
add esp, 4
inc eax
cmp dword [0x1000c6fc], 0x2da
mov dword [0x1000c6f4], eax
jne 0x10002306
push str.get_local_or_spec_target_fn
mov edx, str.55_8B_EC_8B_4D_04_56_57_E8_____________8B_35_____________85_F6_74_57_8B_06_8B_CE
mov ecx, str.client.dll
call fcn.10001210
add esp, 4
mov dword [0x1000c698], eax
jmp 0x10002388
mov eax, dword [0x1000c6fc]
cmp eax, 0xf0
je 0x1000232b
cmp eax, 0x1b8
je 0x1000232b
cmp eax, 0x2da
je 0x10002324
xor eax, eax
jmp 0x10002342
mov edx, str.55_8B_EC_8B_4D_04_8B_C1_83_C0_08_8B_0D_____________85_C9_74_15_8B_01_FF_90_____________85_C0_74_09_8D_48_08_8B_01_5D_FF_60_28
jmp 0x10002330
mov edx, str.E8_____________85_C0_74_16_8B_10_8B_C8_FF_92_____________85_C0_74_08_8D_48_08_8B_01_FF_60_24_33_C0_C3
push str.get_get_spec_target_fn
mov ecx, str.client.dll
call fcn.10001210
add esp, 4
mov dword [0x1000c734], eax
mov eax, dword [0x1000c6fc]
cmp eax, 0xf0
je 0x1000236c
cmp eax, 0x1b8
je 0x1000236c
cmp eax, 0x2da
je 0x10002365
xor eax, eax
jmp 0x10002383
mov edx, str.83_F9_01_7C____A1_____________3B_48____7F____56
jmp 0x10002371
mov edx, str.55_8B_EC_8B_0D_____________56_FF_75_08_E8_____________8B_F0_85_F6_74_15_8B_16_8B_CE_8B_92_____________FF_D2_84_C0_74_05_8B_C6_5E_5D_C3_33_C0_5E_5D_C3
push str.get_get_player_by_index_fn
mov ecx, str.client.dll
call fcn.10001210
add esp, 4
mov dword [0x1000c6d4], eax
mov eax, dword [0x1000c6fc]
cmp eax, 0x445c
ja 0x100023d5
je 0x100023fe
cmp eax, 0x140
ja 0x100023ab
je 0x100023fe
sub eax, 0xdc
je 0x100023fe
sub eax, 0x14
jmp 0x100023f8
cmp eax, 0x1b8
je 0x100023fe
cmp eax, 0x2da
jne 0x100023fa
push str.get_snd_paint_time_ptr
mov edx, str.66_0F_13_05_____________E8_____________51_68
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
add eax, 4
jmp 0x10002418
cmp eax, 0x5898a
ja 0x100023f3
je 0x100023ec
cmp eax, 0x4470
je 0x100023fe
cmp eax, 0x454c
jmp 0x100023f8
mov edx, str.2B_35_____________0F_48_F0
jmp 0x10002403
cmp eax, 0xb09be
je 0x100023fe
xor eax, eax
jmp 0x10002418
mov edx, str.2B_05_____________0F_48_C1_89_45_FC_85_C0
push str.get_snd_paint_time_ptr
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
add eax, 2
mov dword [0x1000c6e8], eax
mov eax, dword [0x1000c6fc]
cmp eax, 0x445c
ja 0x10002681
je 0x100026a6
cmp eax, 0x140
ja 0x1000264c
je 0x100026a6
sub eax, 0xdc
je 0x100026a6
sub eax, 0x14
je 0x100026a6
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov edx, edi
mov ecx, esi
call fcn.100063f2
mov eax, dword [esp + 0x10]
mov dword [0x1000c708], eax
mov eax, dword [0x1000c6fc]
mov dword [0x1000c700], esi
mov dword [0x1000c704], edi
cmp eax, 0x445c
ja 0x100026fe
je 0x10002723
cmp eax, 0x140
ja 0x100026c9
je 0x10002723
sub eax, 0xdc
je 0x10002723
sub eax, 0x14
je 0x10002723
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov edx, edi
mov ecx, esi
call fcn.100063f2
mov eax, dword [esp + 0x10]
mov dword [0x1000c6d0], eax
mov eax, dword [0x1000c6fc]
mov dword [0x1000c6c8], esi
mov dword [0x1000c6cc], edi
cmp eax, 0x445c
ja 0x1000277b
je 0x100027c3
cmp eax, 0x140
ja 0x10002746
je 0x100027c3
sub eax, 0xdc
je 0x100027c3
sub eax, 0x14
je 0x100027c3
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov edx, edi
mov ecx, esi
call fcn.100063f2
mov eax, dword [esp + 0x10]
mov dword [0x1000c728], eax
mov eax, dword [0x1000c6fc]
mov dword [0x1000c720], esi
mov dword [0x1000c724], edi
cmp eax, 0x445c
ja 0x1000281b
je 0x10002836
cmp eax, 0x140
ja 0x100027e6
je 0x10002836
sub eax, 0xdc
je 0x10002836
sub eax, 0x14
je 0x10002836
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov edx, edi
mov ecx, esi
call fcn.100063f2
mov eax, dword [esp + 0x10]
mov dword [0x1000c6ac], eax
mov eax, dword [0x1000c6fc]
mov dword [0x1000c6a4], esi
mov dword [0x1000c6a8], edi
cmp eax, 0x2da
jne 0x100028cb
push str.get_snd_device_tx_override
mov edx, str.53_8B_DC_83_EC_08_83_E4_F0_83_C4_04_55_8B_6B_04_89_6C_24_04_8B_EC_B8_____________E8_____________A1
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
mov dword [esp + 0x10], 0
mov esi, eax
mov edx, 0x10001550
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.100063f2
cmp dword [0x1000c6fc], 0x2da
mov eax, dword [esp + 0x10]
mov dword [0x1000c70c], esi
mov dword [0x1000c710], 0x10001550
mov dword [0x1000c714], eax
je 0x100028aa
xor eax, eax
mov dword [0x1000c6f0], eax
jmp 0x1000293c
cmp eax, 0x1b8
je 0x100026a6
cmp eax, 0x2da
jne 0x10002458
push str.get_start_movie_override
mov edx, str.55_8B_EC_83_EC_08_53_56_57_8B_7D_08_8B_1F_83_FB_02_7D_5F
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
mov esi, eax
mov edi, 0x10001b00
jmp 0x10002460
cmp eax, 0x5898a
ja 0x1000269b
je 0x100026a6
cmp eax, 0x4470
je 0x100026a6
cmp eax, 0x454c
jmp 0x10002452
cmp eax, 0xb09be
jne 0x10002458
push str.get_start_movie_override
mov edx, str.55_8B_EC_83_EC_08_83_3D________________0F_85
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
mov esi, eax
mov edi, 0x10001b00
jmp 0x10002460
cmp eax, 0x1b8
je 0x10002723
cmp eax, 0x2da
jne 0x100024c6
push str.get_end_movie_override
mov edx, str.80_3D________________75_0F_68
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
mov esi, eax
mov edi, 0x10002030
jmp 0x100024ce
cmp eax, 0x5898a
ja 0x10002718
je 0x10002723
cmp eax, 0x4470
je 0x10002723
cmp eax, 0x454c
jmp 0x100024c0
cmp eax, 0xb09be
jne 0x100024c6
push str.get_end_movie_override
mov edx, str.80_3D________________75_0F_68_____________FF_15_____________83_C4_04_C3_E8_____________68_____________FF_15_____________59_C3
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
mov esi, eax
mov edi, 0x10002030
jmp 0x100024ce
cmp eax, 0x1b8
je 0x100027c3
cmp eax, 0x2da
jne 0x10002534
push str.get_eng_filter_time_override
mov edx, str.55_8B_EC_83_EC_0C_80_3D________________56
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
mov esi, eax
mov edi, 0x10001970
jmp 0x1000253c
cmp eax, 0x5898a
ja 0x100027b8
je 0x10002795
cmp eax, 0x4470
je 0x100027c3
cmp eax, 0x454c
jmp 0x1000252e
push str.get_eng_filter_time_override
mov edx, str.55_8B_EC_83_EC_10_80_3D________________56
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
mov esi, eax
mov edi, 0x10001940
jmp 0x1000253c
cmp eax, 0xb09be
jne 0x10002534
push str.get_eng_filter_time_override
mov edx, str.55_8B_EC_51_80_3D________________56_8B_F1_74
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
mov esi, eax
mov edi, 0x10001940
jmp 0x1000253c
cmp eax, 0x1b8
je 0x10002836
cmp eax, 0x2da
jne 0x100025a2
push str.get_snd_paint_chans_override
mov edx, str.55_8B_EC_81_EC_____________A0_____________53_56_88_45____A1
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
mov esi, eax
mov edi, 0x10001420
jmp 0x100025aa
cmp eax, 0x5898a
ja 0x1000287c
je 0x10002859
cmp eax, 0x4470
je 0x10002836
cmp eax, 0x454c
jne 0x100025a2
push str.get_snd_paint_chans_override
mov edx, str.55_8B_EC_81_EC_____________8B_0D_____________53_33_DB_89_5D_D0_89_5D_D4
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
mov esi, eax
mov edi, 0x100013f0
jmp 0x100025aa
push str.get_snd_paint_chans_override
mov edx, str.55_8B_EC_81_EC_C4_01_00_00_A1_____________33_C5_89_45____8B_0D
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
mov esi, eax
mov edi, 0x100013f0
jmp 0x100025aa
cmp eax, 0xb09be
jne 0x100025a2
push str.get_snd_paint_chans_override
mov edx, str.55_8B_EC_81_EC_____________8B_0D_____________53_33_DB_89_5D_C8_89_5D_CC
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
mov esi, eax
mov edi, 0x100013f0
jmp 0x100025aa
push str.get_snd_paint_buffer
mov edx, str.8B_35_____________89_45_F8_A1_____________57_8B_3D_____________89_45_FC
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
add eax, 2
mov dword [0x1000c6f0], eax
jmp 0x1000293c
cmp eax, 0x445c
ja 0x100028f2
je case.0x100028eb.220
sub eax, 0xdc
cmp eax, 0xdc
ja case.0x100028eb.221
movzx eax, byte [eax + 0x10002a70]
jmp dword [eax*4 + 0x10002a68]
cmp eax, 0x5898a
ja 0x10002964
je case.0x100028eb.220
cmp eax, 0x4470
je case.0x100028eb.220
cmp eax, 0x454c
je case.0x100028eb.220
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov edx, edi
mov ecx, esi
call fcn.100063f2
mov eax, dword [esp + 0x10]
mov dword [0x1000c6b4], esi
mov dword [0x1000c6b8], edi
mov dword [0x1000c6bc], eax
mov eax, dword [0x1000c6fc]
cmp eax, 0x445c
ja 0x100029a0
je 0x100029c7
cmp eax, 0x140
ja 0x1000298b
je 0x100029c7
sub eax, 0xdc
je 0x100029c7
sub eax, 0x14
je 0x100029c7
jmp 0x10002a10
cmp eax, 0xb09be
jne case.0x100028eb.221
push str.get_snd_tx_stereo_override
mov edx, str.55_8B_EC_51_53_56_57_E8_____________D8_0D_____________E8_____________8B_0D
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
mov esi, eax
mov edi, 0x10001530
jmp 0x10002911
cmp eax, 0x1b8
je 0x100029c7
cmp eax, 0x2da
jne 0x10002a10
mov edx, str.68_____________8B_40_08_FF_D0_84_C0_74_5D_A1_____________83_B8
jmp 0x100029cc
cmp eax, 0x5898a
ja 0x100029c0
je 0x100029b9
cmp eax, 0x4470
je 0x100029c7
cmp eax, 0x454c
je 0x100029c7
jmp 0x10002a10
mov edx, str.68_____________8B_40_08_FF_D0_84_C0_74_52_83_3D
jmp 0x100029cc
cmp eax, 0xb09be
jne 0x10002a10
mov edx, str.68_____________8B_40_08_FF_D0_84_C0_74_58_83_3D
push str.patch_cvar_restrict
mov ecx, str.engine.dll
call fcn.10001210
add esp, 4
lea edi, [eax + 1]
test edi, edi
je 0x10002a10
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push edi
mov dword [esp + 0x20], 0
call esi
mov eax, dword [esp + 0x10]
push 0
push dword [esp + 0x18]
mov dword [edi], eax
push 4
push edi
call esi
xor esi, esi
mov ecx, 1
mov ebx, 0x1000c754
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
je 0x10002a4d
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
cmp esi, 0x20
jae 0x10002a39
push 0
jmp 0x10002a3b
push 1
call edi
inc esi
mov ecx, 1
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
jne 0x10002a30
cmp dword [0x1000c758], 0
je 0x10002a5b
call fcn.1000633c
xor eax, eax
xchg dword [ebx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret