Function at 0x10005cf0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Set console window title
Spawn thread to rwx shellcode

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x450
mov eax, dword [esp + 0x468]
cmp eax, 1
je 0x10005d12
test eax, eax
jne 0x10006e71
xor ecx, ecx
int 0x29
push str.hl2.exe
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10006aff
push 0xd
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x100fb0e8], eax
mov ecx, dword [0x241cf422]
mov dword [eax], ecx
movzx ecx, word [0x241cf426]
mov word [eax + 4], cx
mov eax, dword [0x100fb0e8]
movzx ecx, byte [0x241cf428]
mov byte [eax + 6], cl
mov eax, dword [0x100fb0e8]
mov byte [eax + 7], 0x68
mov eax, dword [0x100fb0e8]
mov dword [eax + 8], 0x241cf429
mov eax, dword [0x100fb0e8]
mov byte [eax + 0xc], 0xc3
lea edi, [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x40
push 0xd
push dword [0x100fb0e8]
call ebp
push edi
push 0x40
push 6
push 0x241cf422
call ebp
mov byte [0x241cf422], 0x68
mov dword [0x241cf423], 0x10002430
mov byte [0x241cf427], 0xc3
push edi
push dword [esp + 0x20]
push 6
push 0x241cf422
call ebp
push str.vaudio_speex.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
lea ebx, [eax + 0x2490]
push edi
push 0x40
push 1
push ebx
call ebp
mov byte [esi + 0x2490], 0xc3
push edi
push dword [esp + 0x20]
push 1
push ebx
call ebp
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push str.Duckware
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 0x1000acfc
push str.CONOUT_
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfreopen]
add esp, 0xc
push 0xfde9
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
movaps xmm0, xmmword [0x1000a240]
movups xmmword [esp + 0x1c], xmm0
mov dword [esp + 0x2c], 0x190
lea eax, [esp + 0x30]
push str.Terminal
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
add esp, 8
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 8
push 0x1f
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
lea eax, [esp + 0x248]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov dword [esp + 0xc], 0
movsx eax, word [esp + 0x248]
movsx ecx, word [esp + 0x24a]
imul ecx, eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push eax
push ecx
push 0x1f
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
push str._____Delimit_Interface
call esi
add esp, 4
mov ebx, esp
push ebx
push 0x40
push 4
push 0x20173337
call ebp
mov dword [0x20173337], 0xc32c41fe
push ebx
push dword [esp + 4]
push 4
push 0x20173337
call ebp
mov byte [0x2051f774], 1
push ebx
push 0x40
push 1
push 0x20074c9d
call ebp
mov byte [0x20074c9d], 0xeb
push ebx
push dword [esp + 4]
push 1
push 0x20074c9d
call ebp
push str._____Extend_Interface
call esi
add esp, 4
call fcn.100012b0
push str._____Events
call esi
add esp, 4
push 0xc
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call edi
add esp, 4
mov dword [0x100fa3d8], eax
mov ecx, dword [0x2412aa90]
mov dword [eax], ecx
movzx ecx, word [0x2412aa94]
mov word [eax + 4], cx
mov eax, dword [0x100fa3d8]
mov byte [eax + 6], 0x68
mov eax, dword [0x100fa3d8]
mov dword [eax + 7], 0x2412aa96
mov eax, dword [0x100fa3d8]
mov byte [eax + 0xb], 0xc3
push ebx
push 0x40
push 0xc
push dword [0x100fa3d8]
call ebp
push ebx
push 0x40
push 6
push 0x2412aa90
call ebp
mov byte [0x2412aa90], 0x68
mov dword [0x2412aa91], 0x10001840
mov byte [0x2412aa95], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x2412aa90
call ebp
push ebx
push 0x40
push 1
push 0x2004408a
call ebp
mov byte [0x2004408a], 0xeb
push ebx
push dword [esp + 4]
push 1
push 0x2004408a
call ebp
push 4
call edi
add esp, 4
mov esi, eax
push 8
call edi
add esp, 4
mov dword [eax + 4], 0x10001b30
mov dword [esi], eax
mov edi, 0x200aeaf0
mov ecx, 0x203c2608
push 0
push str.round_start
push esi
call edi
mov ecx, 0x203c2608
push 0
push str.player_hurt
push esi
call edi
mov ecx, 0x203c2608
push 0
push str.player_death
push esi
call edi
mov ecx, 0x203c2608
push 0
push str.bullet_impact
push esi
call edi
push 0xe
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call esi
add esp, 4
mov dword [0x100fa6b8], eax
mov ecx, dword [0x200ada80]
mov dword [eax], ecx
movzx ecx, word [0x200ada84]
mov word [eax + 4], cx
mov eax, dword [0x100fa6b8]
movzx ecx, word [0x200ada86]
mov word [eax + 6], cx
mov eax, dword [0x100fa6b8]
mov byte [eax + 8], 0x68
mov eax, dword [0x100fa6b8]
mov dword [eax + 9], 0x200ada88
mov eax, dword [0x100fa6b8]
mov byte [eax + 0xd], 0xc3
push ebx
push 0x40
push 0xe
push dword [0x100fa6b8]
call ebp
push ebx
push 0x40
push 6
push 0x200ada80
call ebp
mov byte [0x200ada80], 0x68
mov dword [0x200ada81], 0x10001dc0
mov byte [0x200ada85], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x200ada80
call ebp
push 0xc
call esi
add esp, 4
mov dword [0x100fa6bc], eax
mov ecx, dword [0x201019f0]
mov dword [eax], ecx
movzx ecx, word [0x201019f4]
mov word [eax + 4], cx
mov eax, dword [0x100fa6bc]
mov byte [eax + 6], 0x68
mov eax, dword [0x100fa6bc]
mov dword [eax + 7], 0x201019f6
mov eax, dword [0x100fa6bc]
mov byte [eax + 0xb], 0xc3
push ebx
push 0x40
push 0xc
push dword [0x100fa6bc]
call ebp
push ebx
push 0x40
push 6
push 0x201019f0
call ebp
mov byte [0x201019f0], 0x68
mov dword [0x201019f1], 0x10001e40
mov byte [0x201019f5], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x201019f0
call ebp
push str._____Interpolation
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
call edi
add esp, 4
push 0xc
call esi
add esp, 4
mov dword [0x100fa6c0], eax
mov ecx, dword [0x24036240]
mov dword [eax], ecx
movzx ecx, word [0x24036244]
mov word [eax + 4], cx
mov eax, dword [0x100fa6c0]
mov byte [eax + 6], 0x68
mov eax, dword [0x100fa6c0]
mov dword [eax + 7], 0x24036246
mov eax, dword [0x100fa6c0]
mov byte [eax + 0xb], 0xc3
push ebx
push 0x40
push 0xc
push dword [0x100fa6c0]
call ebp
push ebx
push 0x40
push 6
push 0x24036240
call ebp
mov byte [0x24036240], 0x68
mov dword [0x24036241], 0x10001e50
mov byte [0x24036245], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x24036240
call ebp
push str._____Animations
call edi
add esp, 4
push 0x10
call esi
add esp, 4
mov dword [0x100fa6d0], eax
mov ecx, dword [0x241bc740]
mov dword [eax], ecx
movzx ecx, word [0x241bc744]
mov word [eax + 4], cx
mov eax, dword [0x100fa6d0]
mov ecx, dword [0x241bc746]
mov dword [eax + 6], ecx
mov eax, dword [0x100fa6d0]
mov byte [eax + 0xa], 0x68
mov eax, dword [0x100fa6d0]
mov dword [eax + 0xb], 0x241bc74a
mov eax, dword [0x100fa6d0]
mov byte [eax + 0xf], 0xc3
push ebx
push 0x40
push 0x10
push dword [0x100fa6d0]
call ebp
push ebx
push 0x40
push 6
push 0x241bc740
call ebp
mov byte [0x241bc740], 0x68
mov dword [0x241bc741], 0x10001e70
mov byte [0x241bc745], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x241bc740
call ebp
push ebx
push 0x40
push 1
push 0x241bc75f
call ebp
mov byte [0x241bc75f], 0xeb
push ebx
push dword [esp + 4]
push 1
push 0x241bc75f
call ebp
push ebx
push 0x40
push 2
push 0x2404b3ad
call ebp
mov word [0x2404b3ad], 0x9090
push ebx
push dword [esp + 4]
push 2
push 0x2404b3ad
call ebp
push 0xd
call esi
add esp, 4
mov dword [0x100fa6d4], eax
mov ecx, dword [0x2400a6e0]
mov dword [eax], ecx
movzx ecx, word [0x2400a6e4]
mov word [eax + 4], cx
mov eax, dword [0x100fa6d4]
movzx ecx, byte [0x2400a6e6]
mov byte [eax + 6], cl
mov eax, dword [0x100fa6d4]
mov byte [eax + 7], 0x68
mov eax, dword [0x100fa6d4]
mov dword [eax + 8], 0x2400a6e7
mov eax, dword [0x100fa6d4]
mov byte [eax + 0xc], 0xc3
push ebx
push 0x40
push 0xd
push dword [0x100fa6d4]
call ebp
push ebx
push 0x40
push 6
push 0x2400a6e0
call ebp
mov byte [0x2400a6e0], 0x68
mov dword [0x2400a6e1], 0x10001ea0
mov byte [0x2400a6e5], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x2400a6e0
call ebp
push ebx
push 0x40
push 3
push 0x24037550
call ebp
mov word [0x24037550], 0x18c2
mov byte [0x24037552], 0
push ebx
push dword [esp + 4]
push 3
push 0x24037550
call ebp
push str._____Prediction
call edi
add esp, 4
push ebx
push 0x40
push 5
push 0x200464d4
call ebp
mov dword [0x200464d4], 0x90909090
mov byte [0x200464d8], 0x90
push ebx
push dword [esp + 4]
push 5
push 0x200464d4
call ebp
push ebx
push 0x40
push 1
push 0x2412c3fb
call ebp
mov byte [0x2412c3fb], 0xeb
push ebx
push dword [esp + 4]
push 1
push 0x2412c3fb
call ebp
push 0xe
call esi
add esp, 4
mov dword [0x100fa6d8], eax
mov ecx, dword [0x2412b7c0]
mov dword [eax], ecx
movzx ecx, word [0x2412b7c4]
mov word [eax + 4], cx
mov eax, dword [0x100fa6d8]
movzx ecx, word [0x2412b7c6]
mov word [eax + 6], cx
mov eax, dword [0x100fa6d8]
mov byte [eax + 8], 0x68
mov eax, dword [0x100fa6d8]
mov dword [eax + 9], 0x2412b7c8
mov eax, dword [0x100fa6d8]
mov byte [eax + 0xd], 0xc3
push ebx
push 0x40
push 0xe
push dword [0x100fa6d8]
call ebp
push ebx
push 0x40
push 6
push 0x2412b7c0
call ebp
mov byte [0x2412b7c0], 0x68
mov dword [0x2412b7c1], 0x10001f50
mov byte [0x2412b7c5], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x2412b7c0
call ebp
push 0xc
call esi
add esp, 4
mov dword [0x100fb0b4], eax
mov ecx, dword [0x2412b650]
mov dword [eax], ecx
movzx ecx, word [0x2412b654]
mov word [eax + 4], cx
mov eax, dword [0x100fb0b4]
mov byte [eax + 6], 0x68
mov eax, dword [0x100fb0b4]
mov dword [eax + 7], 0x2412b656
mov eax, dword [0x100fb0b4]
mov byte [eax + 0xb], 0xc3
push ebx
push 0x40
push 0xc
push dword [0x100fb0b4]
call ebp
push ebx
push 0x40
push 6
push 0x2412b650
call ebp
mov byte [0x2412b650], 0x68
mov dword [0x2412b651], 0x10002010
mov byte [0x2412b655], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x2412b650
call ebp
push 0xc
call esi
add esp, 4
mov dword [0x100fb0bc], eax
mov ecx, dword [0x2412b8e0]
mov dword [eax], ecx
movzx ecx, word [0x2412b8e4]
mov word [eax + 4], cx
mov eax, dword [0x100fb0bc]
mov byte [eax + 6], 0x68
mov eax, dword [0x100fb0bc]
mov dword [eax + 7], 0x2412b8e6
mov eax, dword [0x100fb0bc]
mov byte [eax + 0xb], 0xc3
push ebx
push 0x40
push 0xc
push dword [0x100fb0bc]
call ebp
push ebx
push 0x40
push 6
push 0x2412b8e0
call ebp
mov byte [0x2412b8e0], 0x68
mov dword [0x2412b8e1], 0x10002040
mov byte [0x2412b8e5], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x2412b8e0
call ebp
push ebx
push 0x40
push 6
push 0x240ff120
call ebp
mov byte [0x240ff120], 0x68
mov dword [0x240ff121], 0x100020a0
mov byte [0x240ff125], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x240ff120
call ebp
push 0xd
call esi
add esp, 4
mov dword [0x100fb0c0], eax
mov ecx, dword [0x2412bb50]
mov dword [eax], ecx
movzx ecx, word [0x2412bb54]
mov word [eax + 4], cx
mov eax, dword [0x100fb0c0]
movzx ecx, byte [0x2412bb56]
mov byte [eax + 6], cl
mov eax, dword [0x100fb0c0]
mov byte [eax + 7], 0x68
mov eax, dword [0x100fb0c0]
mov dword [eax + 8], 0x2412bb57
mov eax, dword [0x100fb0c0]
mov byte [eax + 0xc], 0xc3
push ebx
push 0x40
push 0xd
push dword [0x100fb0c0]
call ebp
push ebx
push 0x40
push 6
push 0x2412bb50
call ebp
mov byte [0x2412bb50], 0x68
mov dword [0x2412bb51], 0x100020c0
mov byte [0x2412bb55], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x2412bb50
call ebp
push 0xc
call esi
add esp, 4
mov dword [0x100fb0c4], eax
mov ecx, dword [0x24018c20]
mov dword [eax], ecx
movzx ecx, word [0x24018c24]
mov word [eax + 4], cx
mov eax, dword [0x100fb0c4]
mov byte [eax + 6], 0x68
mov eax, dword [0x100fb0c4]
mov dword [eax + 7], 0x24018c26
mov eax, dword [0x100fb0c4]
mov byte [eax + 0xb], 0xc3
push ebx
push 0x40
push 0xc
push dword [0x100fb0c4]
call ebp
push ebx
push 0x40
push 6
push 0x24018c20
call ebp
mov byte [0x24018c20], 0x68
mov dword [0x24018c21], 0x10002120
mov byte [0x24018c25], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x24018c20
call ebp
push ebx
push 0x40
push 9
push 0x241e21e8
call ebp
mov dword [0x241e21e8], 0x90909090
mov dword [0x241e21ec], 0x90909090
mov byte [0x241e21f0], 0x90
push ebx
push dword [esp + 4]
push 9
push 0x241e21e8
call ebp
push 0xd
call esi
add esp, 4
mov dword [0x100fb0cc], eax
mov ecx, dword [0x241e0d40]
mov dword [eax], ecx
movzx ecx, word [0x241e0d44]
mov word [eax + 4], cx
mov eax, dword [0x100fb0cc]
movzx ecx, byte [0x241e0d46]
mov byte [eax + 6], cl
mov eax, dword [0x100fb0cc]
mov byte [eax + 7], 0x68
mov eax, dword [0x100fb0cc]
mov dword [eax + 8], 0x241e0d47
mov eax, dword [0x100fb0cc]
mov byte [eax + 0xc], 0xc3
push ebx
push 0x40
push 0xd
push dword [0x100fb0cc]
call ebp
push ebx
push 0x40
push 6
push 0x241e0d40
call ebp
mov byte [0x241e0d40], 0x68
mov dword [0x241e0d41], 0x10002140
mov byte [0x241e0d45], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x241e0d40
call ebp
push 0xc
call esi
add esp, 4
mov dword [0x100fb0d0], eax
mov ecx, dword [0x2412c1e0]
mov dword [eax], ecx
movzx ecx, word [0x2412c1e4]
mov word [eax + 4], cx
mov eax, dword [0x100fb0d0]
mov byte [eax + 6], 0x68
mov eax, dword [0x100fb0d0]
mov dword [eax + 7], 0x2412c1e6
mov eax, dword [0x100fb0d0]
mov byte [eax + 0xb], 0xc3
push ebx
push 0x40
push 0xc
push dword [0x100fb0d0]
call ebp
push ebx
push 0x40
push 6
push 0x2412c1e0
call ebp
mov byte [0x2412c1e0], 0x68
mov dword [0x2412c1e1], 0x10002180
mov byte [0x2412c1e5], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x2412c1e0
call ebp
push str._____Network
call edi
add esp, 4
push 0xd
call esi
add esp, 4
mov dword [0x100fb0d4], eax
mov ecx, dword [0x2003fd10]
mov dword [eax], ecx
movzx ecx, word [0x2003fd14]
mov word [eax + 4], cx
mov eax, dword [0x100fb0d4]
movzx ecx, byte [0x2003fd16]
mov byte [eax + 6], cl
mov eax, dword [0x100fb0d4]
mov byte [eax + 7], 0x68
mov eax, dword [0x100fb0d4]
mov dword [eax + 8], 0x2003fd17
mov eax, dword [0x100fb0d4]
mov byte [eax + 0xc], 0xc3
push ebx
push 0x40
push 0xd
push dword [0x100fb0d4]
call ebp
push ebx
push 0x40
push 6
push 0x2003fd10
call ebp
mov byte [0x2003fd10], 0x68
mov dword [0x2003fd11], 0x10002230
mov byte [0x2003fd15], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x2003fd10
call ebp
push 0xc
call esi
add esp, 4
mov dword [0x100fb0dc], eax
mov ecx, dword [0x20042510]
mov dword [eax], ecx
movzx ecx, word [0x20042514]
mov word [eax + 4], cx
mov eax, dword [0x100fb0dc]
mov byte [eax + 6], 0x68
mov eax, dword [0x100fb0dc]
mov dword [eax + 7], 0x20042516
mov eax, dword [0x100fb0dc]
mov byte [eax + 0xb], 0xc3
push ebx
push 0x40
push 0xc
push dword [0x100fb0dc]
call ebp
push ebx
push 0x40
push 6
push 0x20042510
call ebp
mov byte [0x20042510], 0x68
mov dword [0x20042511], 0x10002260
mov byte [0x20042515], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x20042510
call ebp
push ebx
push 0x40
push 6
push 0x200423d0
call ebp
mov byte [0x200423d0], 0x68
mov dword [0x200423d1], 0x100022d0
mov byte [0x200423d5], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x200423d0
call ebp
push 0xe
call esi
add esp, 4
mov dword [0x100fb0e0], eax
mov ecx, dword [0x2013bb90]
mov dword [eax], ecx
movzx ecx, word [0x2013bb94]
mov word [eax + 4], cx
mov eax, dword [0x100fb0e0]
movzx ecx, word [0x2013bb96]
mov word [eax + 6], cx
mov eax, dword [0x100fb0e0]
mov byte [eax + 8], 0x68
mov eax, dword [0x100fb0e0]
mov dword [eax + 9], 0x2013bb98
mov eax, dword [0x100fb0e0]
mov byte [eax + 0xd], 0xc3
push ebx
push 0x40
push 0xe
push dword [0x100fb0e0]
call ebp
push ebx
push 0x40
push 6
push 0x2013bb90
call ebp
mov byte [0x2013bb90], 0x68
mov dword [0x2013bb91], 0x100023c0
mov byte [0x2013bb95], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x2013bb90
call ebp
push 0x1000ad00
call edi
add esp, 4
push ebx
push 0x40
push 3
push 0x240f7920
call ebp
mov word [0x240f7920], 0x9090
mov byte [0x240f7922], 0x90
push ebx
push dword [esp + 4]
push 3
push 0x240f7920
call ebp
push 0xc
call esi
add esp, 4
mov dword [0x100fff7c], eax
mov ecx, dword [0x240d4920]
mov dword [eax], ecx
movzx ecx, word [0x240d4924]
mov word [eax + 4], cx
mov eax, dword [0x100fff7c]
mov byte [eax + 6], 0x68
mov eax, dword [0x100fff7c]
mov dword [eax + 7], 0x240d4926
mov eax, dword [0x100fff7c]
mov byte [eax + 0xb], 0xc3
push ebx
push 0x40
push 0xc
push dword [0x100fff7c]
call ebp
push ebx
push 0x40
push 6
push 0x240d4920
call ebp
mov byte [0x240d4920], 0x68
mov dword [0x240d4921], 0x100029a0
mov byte [0x240d4925], 0xc3
push ebx
push dword [esp + 4]
push 6
push 0x240d4920
call ebp
push str._____View_Effects
call edi
add esp, 4
push ebx
push 0x40
push 0x22
push 0x240192d2
call ebp
movaps xmm0, xmmword [0x1000a250]
movups xmmword [0x240192d2], xmm0
movups xmmword [0x240192e2], xmm0
mov word [0x240192f2], 0x9090
push ebx
push dword [esp + 4]
push 0x22
push 0x240192d2
call ebp
push str.vgui2.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.CreateInterface
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push str.VGUI_Panel009
call eax
add esp, 8
mov edi, eax
mov dword [0x100fffbc], eax
push 0x10
call fcn.10008980
add esp, 4
mov esi, eax
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], edi
mov ebp, dword [edi]
cmp dword [ebp], 0
je 0x10006bc8
xor eax, eax
nop word cs:[eax + eax]
mov ecx, eax
inc eax
mov dword [esi + 0xc], eax
mov ebp, dword [edi]
cmp dword [ebp + ecx*4 + 4], 0
jne 0x10006ad0
lea ecx, [eax*4]
mov dword [esi + 8], ebp
cmp eax, 0x40000000
mov eax, 0xffffffff
mov dword [esp + 4], ecx
cmovb eax, ecx
jmp 0x10006bd5
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x1c], 0x22c
lea edi, [esp + 0x40]
lea ebp, [esp + 0x1c]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
push ebp
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x10006e71
push str.hl2.exe
push edi
call ebx
add esp, 8
test eax, eax
jne 0x10006b20
push dword [esp + 0x24]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
sub esp, 0x14
movaps xmm0, xmmword [0x1000a260]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
lea ebx, [esp + 0x248]
push 0x208
push ebx
push dword [esp + 0x46c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x208
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push edi
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x10006e71
mov dword [esi + 8], ebp
mov dword [esp + 4], 0
xor eax, eax
mov dword [esp + 8], eax
push eax
call fcn.100089e6
add esp, 4
mov ebx, eax
push dword [esp + 8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], ebx
push dword [esp + 4]
push ebp
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [edi], ebx
mov edi, dword [0x100fffc0]
mov dword [0x100fffc0], esi
test edi, edi
je 0x10006c3b
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [eax], ecx
mov eax, dword [edi]
test eax, eax
je 0x10006c2c
push eax
call fcn.100089ef
add esp, 4
push edi
call fcn.100089b0
add esp, 4
mov esi, dword [0x100fffc0]
cmp dword [esi + 0xc], 0x28
jb 0x10006c4d
mov eax, dword [esi]
mov dword [eax + 0xa0], 0x10005850
push str._____Crosshair
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
call esi
add esp, 4
mov eax, esp
push eax
mov edi, eax
push 0x40
push 6
push 0x241e1600
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
mov byte [0x241e1600], 0x68
mov dword [0x241e1601], 0x10005100
mov byte [0x241e1605], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x241e1600
call ebx
push str._____Materials
call esi
add esp, 4
push str.MaterialSystem.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
lea edi, [eax + 0x55e0]
push 0x11
mov ebp, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call ebp
add esp, 4
mov dword [0x100fffb4], eax
mov ecx, dword [esi + 0x55e0]
mov dword [eax], ecx
movzx ecx, word [esi + 0x55e4]
mov word [eax + 4], cx
mov eax, dword [0x100fffb4]
mov ecx, dword [esi + 0x55e6]
mov dword [eax + 6], ecx
movzx ecx, byte [esi + 0x55ea]
mov byte [eax + 0xa], cl
mov byte [eax + 0xb], 0x68
lea eax, [esi + 0x55eb]
mov ecx, dword [0x100fffb4]
mov dword [ecx + 0xc], eax
mov eax, dword [0x100fffb4]
mov byte [eax + 0x10], 0xc3
mov ebp, esp
push ebp
push 0x40
push 0x11
push dword [0x100fffb4]
call ebx
push ebp
push 0x40
push 6
push edi
call ebx
mov byte [esi + 0x55e0], 0x68
mov dword [esi + 0x55e1], 0x10005390
mov byte [esi + 0x55e5], 0xc3
push ebp
push dword [esp + 4]
push 6
push edi
call ebx
push 0xf
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x100fffec], eax
mov ecx, dword [0x2c002d40]
mov dword [eax], ecx
movzx ecx, word [0x2c002d44]
mov word [eax + 4], cx
mov eax, dword [0x100fffec]
movzx ecx, word [0x2c002d46]
mov word [eax + 6], cx
movzx ecx, byte [0x2c002d48]
mov byte [eax + 8], cl
mov eax, dword [0x100fffec]
mov byte [eax + 9], 0x68
mov eax, dword [0x100fffec]
mov dword [eax + 0xa], 0x2c002d49
mov eax, dword [0x100fffec]
mov byte [eax + 0xe], 0xc3
push ebp
push 0x40
push 0xf
push dword [0x100fffec]
call ebx
push ebp
push 0x40
push 6
push 0x2c002d40
call ebx
mov byte [0x2c002d40], 0x68
mov dword [0x2c002d41], 0x10005ae0
mov byte [0x2c002d45], 0xc3
push ebp
push dword [esp + 4]
push 6
push 0x2c002d40
call ebx
push ebp
push 0x40
push 2
push 0x24169ec8
call ebx
mov word [0x24169ec8], 0x9090
push ebp
push dword [esp + 4]
push 2
push 0x24169ec8
call ebx
push ebp
push 0x40
push 1
push 0x24176e19
call ebx
mov byte [0x24176e19], 0xeb
push ebp
push dword [esp + 4]
push 1
push 0x24176e19
call ebx
push ebp
push 0x40
push 3
push 0x2418e270
call ebx
mov word [0x2418e270], 0x8c2
mov byte [0x2418e272], 0
push ebp
push dword [esp + 4]
push 3
push 0x2418e270
call ebx
push ebp
push 0x40
push 1
push 0x241bea10
call ebx
mov byte [0x241bea10], 0xc3
push ebp
push dword [esp + 4]
push 1
push 0x241bea10
call ebx
mov eax, 1
add esp, 0x450
pop esi
pop edi
pop ebx
pop ebp
ret 0xc