Function at 0x10013bc0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10101e49
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x10167080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x78], eax
push 0
push 0
push 0
push 0x10013990
push 0
push 0
mov dword [eax], vtable.components::_ui.0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x10013c3b
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x543535
mov dword [ebp - 0x54], 0x100133a0
mov eax, dword [0x543536]
add eax, 0x54353a
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x10013c57
mov byte [eax + 1], 0
mov dword [ebp - 4], 1
cmp byte [ebp - 0x5c], 0
je 0x10013c6d
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x10013caa
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x6156ec
mov dword [ebp - 0x54], 0x10013540
mov eax, dword [0x6156ed]
add eax, 0x6156f1
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x10013cc6
mov byte [eax + 1], 0
mov dword [ebp - 4], 3
cmp byte [ebp - 0x5c], 0
je 0x10013cdc
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x10013d19
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x545bed
mov dword [ebp - 0x54], 0x10013850
mov eax, dword [0x545bee]
add eax, 0x545bf2
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x10013d35
mov byte [eax + 1], 0
mov dword [ebp - 4], 5
cmp byte [ebp - 0x5c], 0
je 0x10013d4b
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x74]
add esp, 4
push eax
push 0x40
push 6
push 0x5532a0
call esi
mov eax, 0x5532a0
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
push 6
push 0x5532a0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 6
push 0x5532a0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x10013dd3
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x5532a0
mov dword [ebp - 0x54], 0x10013590
mov eax, dword [0x5532a1]
add eax, 0x5532a5
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x10013def
mov byte [eax + 1], 0
mov dword [ebp - 4], 7
cmp byte [ebp - 0x5c], 0
je 0x10013e05
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea eax, [ebp - 0x74]
push eax
push 0x40
push 5
push 0x55329b
call esi
mov eax, 0x55329b
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
push 5
push 0x55329b
call esi
push 5
push 0x55329b
call edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0x74]
push eax
push 0x40
push 5
push 0x55335a
call esi
mov eax, 0x55335a
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
push 5
push 0x55335a
call esi
push 5
push 0x55335a
call edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0x74]
push eax
push 0x40
push 6
push 0x553394
call esi
mov eax, 0x553394
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
push 6
push 0x553394
call esi
push 6
push 0x553394
call edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x10013efd
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x553394
mov dword [ebp - 0x54], 0x10013620
mov eax, dword [0x553395]
add eax, 0x553399
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x10013f19
mov byte [eax + 1], 0
mov dword [ebp - 4], 9
cmp byte [ebp - 0x5c], 0
je 0x10013f2f
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea eax, [ebp - 0x74]
push eax
push 0x40
push 7
push 0x54b6c9
call esi
mov eax, 0x54b6c9
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
push 7
push 0x54b6c9
call esi
push 7
push 0x54b6c9
call edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x10013fae
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x54b6c9
mov dword [ebp - 0x54], 0x10013880
mov eax, dword [0x54b6ca]
add eax, 0x54b6ce
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x10013fca
mov byte [eax + 1], 0
mov dword [ebp - 4], 0xb
cmp byte [ebp - 0x5c], 0
je 0x10013fe0
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x1001401d
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x5587ff
mov dword [ebp - 0x54], 0x10013900
mov eax, dword [0x558800]
add eax, 0x558804
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x10014039
mov byte [eax + 1], 0
mov dword [ebp - 4], 0xd
cmp byte [ebp - 0x5c], 0
je 0x1001404f
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
sub esp, 0x24
mov dword [ebp - 4], 0xffffffff
mov eax, esp
mov edx, 0x1013c284
mov ecx, str.mainmenu_reload
push str.reloads_zone__xcommon_iw3xo_menu_
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__public:_void___thiscall_components::_ui::constructor_void_::_2::_lambda_1___void__class_components::command::params_.0
mov dword [eax + 0x24], eax
call fcn.10016230
add esp, 4
mov edx, str._menulist_name.txt_
mov eax, esp
mov ecx, str.menu_loadlist_raw
push str.rawfile_::_load_a_menulist__txt_file__and_add_included_menus_to_the_uicontext__menu_stack___fs_usedevdir__must_be_enabled_
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__public:_void___thiscall_components::_ui::constructor_void_::_2::_lambda_2___void__class_components::command::params_.0
mov dword [eax + 0x24], eax
call fcn.10016230
add esp, 4
mov edx, str._menu_name_
mov eax, esp
mov ecx, str.menu_open
push str.open___re_open_the_specified_menu_from_uicontext__menus
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__public:_void___thiscall_components::_ui::constructor_void_::_2::_lambda_3___void__class_components::command::params_.0
mov dword [eax + 0x24], eax
call fcn.10016230
add esp, 4
mov edx, str._menu_name_
mov eax, esp
mov ecx, str.menu_open_ingame
push 0x1013da4c
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__public:_void___thiscall_components::_ui::constructor_void_::_2::_lambda_4___void__class_components::command::params_.0
mov dword [eax + 0x24], eax
call fcn.10016230
add esp, 4
mov edx, str._menu_name_
mov eax, esp
mov ecx, str.menu_closebyname
push str.close_the_specified_menu
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__public:_void___thiscall_components::_ui::constructor_void_::_2::_lambda_5___void__class_components::command::params_.0
mov dword [eax + 0x24], eax
call fcn.10016230
add esp, 4
mov edx, 0x1013c284
mov eax, esp
mov ecx, str.iw3xo_github
push str.opens_https:__github.com_xoxor4d_iw3xo_dev
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__public:_void___thiscall_components::_ui::constructor_void_::_2::_lambda_6___void__class_components::command::params_.0
mov dword [eax + 0x24], eax
call fcn.10016230
add esp, 4
mov edx, 0x1013c284
mov eax, esp
mov ecx, str.iw3xo_radiant_github
push str.opens_https:__github.com_xoxor4d_iw3xo_radiant
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__public:_void___thiscall_components::_ui::constructor_void_::_2::_lambda_7___void__class_components::command::params_.0
mov dword [eax + 0x24], eax
call fcn.10016230
add esp, 4
mov edx, 0x1013c284
mov eax, esp
mov ecx, str.help
push str.opens_https:__xoxor4d.github.io_projects_iw3xo_in_depth
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__public:_void___thiscall_components::_ui::constructor_void_::_2::_lambda_8___void__class_components::command::params_.0
mov dword [eax + 0x24], eax
call fcn.10016230
add esp, 0x2c
push str.highlight_radius__scale_
push 1
sub esp, 0xc
mov dword [esp + 8], 0x41200000
mov dword [esp + 4], 0x38d1b717
mov dword [esp], 0x3f59999a
push str.ui_button_highlight_radius
call dword [0x10167e48]
add esp, 0x18
mov dword [0x1020d1e8], eax
push str.highlight_brightness__lerp_
push 1
sub esp, 0xc
mov dword [esp + 8], 0x40000000
mov dword [esp + 4], 0
mov dword [esp], 0x3f000000
push str.ui_button_highlight_brightness
call dword [0x10167e48]
add esp, 0x18
mov dword [0x1020d1e4], eax
push str.outline_radius__scale_
push 1
sub esp, 0xc
mov dword [esp + 8], 0x41200000
mov dword [esp + 4], 0x38d1b717
mov dword [esp], 0x3f733333
push str.ui_button_outline_radius
call dword [0x10167e48]
add esp, 0x18
mov dword [0x1020d1e0], eax
push str.outline_brightness__lerp_
push 1
sub esp, 0xc
mov dword [esp + 8], 0x40000000
mov dword [esp + 4], 0
mov dword [esp], 0x3f333333
push str.ui_button_outline_brightness
call dword [0x10167e48]
add esp, 0x10
mov dword [0x1020d1dc], eax
mov dword [esp + 4], 0x40000000
mov dword [esp], 0xc0000000
push 0
push 0
sub esp, 8
mov dword [esp + 4], 0x3cd4fdf4
mov dword [esp], 0x3f333333
push str.position_of_main_menu_eyes
push 1
push 2
push str.ui_eyes_position
call dword [0x10167eb4]
add esp, 0x28
mov dword [0x1020d1f4], eax
push str.size_of_main_menu_eyes
push 1
sub esp, 0xc
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0x38d1b717
mov dword [esp], 0x3b86594b
push str.ui_eyes_size
call dword [0x10167e48]
add esp, 0x18
mov dword [0x1020d1f0], eax
push str.alpha_of_main_menu_eyes
push 1
sub esp, 0xc
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0
mov dword [esp], 0x3f000000
push str.ui_eyes_alpha
call dword [0x10167e48]
push 0
push 0
push 0
push 0
push 0
push 0
push str.menu_helper
push 0x40
push 0
push str.ui_subnavbar
mov dword [0x1020d1ec], eax
call dword [0x10167e44]
add esp, 0x40
push 0x64
push 0
push 0
push 0
push 0
push 0
push str.menu_helper
push 0x40
push 5
push str.ui_subnavbar_item
call dword [0x10167e4c]
push 0x1e00
push 0
push 0
push 0
push 0
push 0
push str.menu_helper
push 0x40
push 5
push str.ui_renderWidth
call dword [0x10167e4c]
add esp, 0x50
mov dword [0x1020d1d8], eax
push 0x10e0
push 0
push 0
push 0
push 0
push 0
push str.menu_helper
push 0x40
push 5
push str.ui_renderHeight
call dword [0x10167e4c]
push 0
push 0
push 0
push 0
push 0
push 0
push str.menu_helper
push 1
push 0
push str.ui_devmap
mov dword [0x1020d1d4], eax
call dword [0x10167e44]
add esp, 0x50
mov dword [0x1020d1c8], eax
push 2
push 0
push 0
push 0
push 0
push 0
push str.menu_helper
push 1
push 5
push str.ui_developer
call dword [0x10167e4c]
push 0
push 0
push 0
push 0
push 0
push 0
push str.menu_helper
push 1
push 0
push str.ui_developer_script
mov dword [0x1020d1d0], eax
call dword [0x10167e44]
add esp, 0x50
mov dword [0x1020d1cc], eax
lea eax, [ebp - 0x74]
push eax
push 0x40
push 6
push 0x5f352e
call esi
mov eax, 0x5f352e
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
push 6
push 0x5f352e
call esi
push 6
push 0x5f352e
call edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x10014463
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x5f352e
mov dword [ebp - 0x54], 0x10013950
mov eax, dword [0x5f352f]
add eax, 0x5f3533
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 0xe
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x1001447f
mov byte [eax + 1], 0
mov dword [ebp - 4], 0xf
cmp byte [ebp - 0x5c], 0
je 0x10014495
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
lea eax, [ebp - 0x74]
push eax
push 0x40
push 6
push 0x5f35fa
call esi
mov eax, 0x5f35fa
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
push 6
push 0x5f35fa
call esi
push 6
push 0x5f35fa
call edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea ecx, [ebp - 0x5c]
call fcn.10004700
cmp byte [ebp - 0x5c], 0
jne 0x10014511
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x47], 1
mov dword [ebp - 0x58], 0x5f35fa
mov dword [ebp - 0x54], 0x10013970
mov eax, dword [0x5f35fb]
add eax, 0x5f35ff
mov dword [ebp - 0x50], eax
sub esp, 8
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0x5c]
call fcn.10068a70
cmp byte [eax + 1], 0
je 0x1001452d
mov byte [eax + 1], 0
mov dword [ebp - 4], 0x11
cmp byte [ebp - 0x5c], 0
je 0x10014543
push ecx
lea ecx, [ebp - 0x5c]
call fcn.10068b40
lea eax, [ebp - 0x40]
push eax
call fcn.1000ab50
add esp, 4
mov dword [ebp - 4], 0xffffffff
push str.description
push 1
sub esp, 0xc
mov dword [esp + 8], 0x41200000
mov dword [esp + 4], 0x3dcccccd
mov dword [esp], 0x40155555
push str.r_aspectRatio_custom
call dword [0x10167e48]
mov ecx, dword [0x1016f87c]
add esp, 0x18
mov dword [0x1020d1c0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1021efe8]
cmp eax, dword [ecx + 4]
jle 0x10014617
push 0x1021efe8
call fcn.100d92a4
add esp, 4
cmp dword [0x1021efe8], 0xffffffff
jne 0x10014617
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0x12
push ecx
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x70], str.auto
push eax
push ecx
mov ecx, 0x1021efec
mov dword [ebp - 0x6c], 0x1013dd60
mov dword [ebp - 0x68], str.16:10
mov dword [ebp - 0x64], str.16:9
mov dword [ebp - 0x60], str.custom
call fcn.10011dd0
push 0x10106990
call fcn.100d91ad
push 0x1021efe8
mov dword [ebp - 4], 0xffffffff
call fcn.100d9253
add esp, 8
mov eax, dword [0x1021efec]
mov ecx, dword [0x1021eff0]
push eax
sub ecx, eax
sar ecx, 2
push ecx
push 0
push 0
push 0
push 0
push str.Screen_aspect_ratio._Use__custom__and__r_aspectRatio_custom__if_your_aspect_ratio_is_not_natively_supported___21_9__2.3333_
push 1
push 6
push str.r_aspectRatio
call dword [0x10167e9c]
push 0
push 0
push 0
push 0
push 0
push 0
push str.menu_helper
push 0x40
push 0
push str.ui_ultrawide
call dword [0x10167e44]
mov dword [0x1020d1c4], eax
add esp, 0x50
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d8e9a
mov esp, ebp
pop ebp
ret