Function at 0x10005980
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Set console window title
Spawn thread to rwx shellcode

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x450
mov eax, dword [esp + 0x468]
cmp eax, 1
je 0x100059a2
test eax, eax
jne 0x100069c1
xor ecx, ecx
int 0x29
push str.hl2.exe
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100066ef
push str.vaudio_speex.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
lea ebx, [eax + 0x2490]
lea edi, [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x40
push 1
push ebx
call ebp
mov byte [esi + 0x2490], 0xc3
push edi
push dword [esp + 0x20]
push 1
push ebx
call ebp
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push str.Segregation
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 0x1000aa42
push str.CONOUT_
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfreopen]
add esp, 0xc
push 0xfde9
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
movaps xmm0, xmmword [0x1000a200]
movups xmmword [esp + 0x1c], xmm0
mov dword [esp + 0x2c], 0x190
lea eax, [esp + 0x30]
push str.Terminal
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
add esp, 8
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 8
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
lea eax, [esp + 0x248]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov dword [esp + 0xc], 0
movsx eax, word [esp + 0x248]
movsx ecx, word [esp + 0x24a]
imul ecx, eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push eax
push ecx
push 0x2b
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
push str._____Delimit_Interface
call esi
add esp, 4
mov edi, esp
push edi
push 0x40
push 4
push 0x20173337
call ebp
mov dword [0x20173337], 0xc32c41fe
push edi
push dword [esp + 4]
push 4
push 0x20173337
call ebp
mov byte [0x2051f774], 1
push edi
push 0x40
push 1
push 0x20074c9d
call ebp
mov byte [0x20074c9d], 0xeb
push edi
push dword [esp + 4]
push 1
push 0x20074c9d
call ebp
push str._____Extend_Interface
call esi
add esp, 4
call fcn.100012b0
push str._____Events
call esi
add esp, 4
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push 0xc
call esi
add esp, 4
mov dword [0x100a81f8], eax
mov ecx, dword [0x2412aa90]
mov dword [eax], ecx
movzx ecx, word [0x2412aa94]
mov word [eax + 4], cx
mov eax, dword [0x100a81f8]
mov byte [eax + 6], 0x68
mov eax, dword [0x100a81f8]
mov dword [eax + 7], 0x2412aa96
mov eax, dword [0x100a81f8]
mov byte [eax + 0xb], 0xc3
push edi
push 0x40
push 0xc
push dword [0x100a81f8]
call ebp
push edi
push 0x40
push 6
push 0x2412aa90
call ebp
mov byte [0x2412aa90], 0x68
mov dword [0x2412aa91], 0x100018f0
mov byte [0x2412aa95], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x2412aa90
call ebp
push edi
push 0x40
push 1
push 0x2004408a
call ebp
mov byte [0x2004408a], 0xeb
push edi
push dword [esp + 4]
push 1
push 0x2004408a
call ebp
push 4
mov ebx, esi
call esi
add esp, 4
mov esi, eax
push 8
call ebx
add esp, 4
mov dword [eax + 4], 0x100019b0
mov dword [esi], eax
mov ebx, 0x200aeaf0
mov ecx, 0x203c2608
push 0
push str.player_hurt
push esi
call ebx
mov ecx, 0x203c2608
push 0
push str.player_death
push esi
call ebx
mov ecx, 0x203c2608
push 0
push str.bullet_impact
push esi
call ebx
push 0xe
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call ebx
add esp, 4
mov dword [0x100a84d4], eax
mov ecx, dword [0x200ada80]
mov dword [eax], ecx
movzx ecx, word [0x200ada84]
mov word [eax + 4], cx
mov eax, dword [0x100a84d4]
movzx ecx, word [0x200ada86]
mov word [eax + 6], cx
mov eax, dword [0x100a84d4]
mov byte [eax + 8], 0x68
mov eax, dword [0x100a84d4]
mov dword [eax + 9], 0x200ada88
mov eax, dword [0x100a84d4]
mov byte [eax + 0xd], 0xc3
push edi
push 0x40
push 0xe
push dword [0x100a84d4]
call ebp
push edi
push 0x40
push 6
push 0x200ada80
call ebp
mov byte [0x200ada80], 0x68
mov dword [0x200ada81], 0x10001bf0
mov byte [0x200ada85], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x200ada80
call ebp
push 0xc
call ebx
add esp, 4
mov dword [0x100a84d8], eax
mov ecx, dword [0x201019f0]
mov dword [eax], ecx
movzx ecx, word [0x201019f4]
mov word [eax + 4], cx
mov eax, dword [0x100a84d8]
mov byte [eax + 6], 0x68
mov eax, dword [0x100a84d8]
mov dword [eax + 7], 0x201019f6
mov eax, dword [0x100a84d8]
mov byte [eax + 0xb], 0xc3
push edi
push 0x40
push 0xc
push dword [0x100a84d8]
call ebp
push edi
push 0x40
push 6
push 0x201019f0
call ebp
mov byte [0x201019f0], 0x68
mov dword [0x201019f1], 0x10001c70
mov byte [0x201019f5], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x201019f0
call ebp
push str._____Interpolation
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
call esi
add esp, 4
push 0xc
call ebx
add esp, 4
mov dword [0x100a84dc], eax
mov ecx, dword [0x24036240]
mov dword [eax], ecx
movzx ecx, word [0x24036244]
mov word [eax + 4], cx
mov eax, dword [0x100a84dc]
mov byte [eax + 6], 0x68
mov eax, dword [0x100a84dc]
mov dword [eax + 7], 0x24036246
mov eax, dword [0x100a84dc]
mov byte [eax + 0xb], 0xc3
push edi
push 0x40
push 0xc
push dword [0x100a84dc]
call ebp
push edi
push 0x40
push 6
push 0x24036240
call ebp
mov byte [0x24036240], 0x68
mov dword [0x24036241], 0x10001c80
mov byte [0x24036245], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x24036240
call ebp
push str._____Animations
call esi
add esp, 4
push 0x10
call ebx
add esp, 4
mov dword [0x100a84e8], eax
mov ecx, dword [0x241bc740]
mov dword [eax], ecx
movzx ecx, word [0x241bc744]
mov word [eax + 4], cx
mov eax, dword [0x100a84e8]
mov ecx, dword [0x241bc746]
mov dword [eax + 6], ecx
mov eax, dword [0x100a84e8]
mov byte [eax + 0xa], 0x68
mov eax, dword [0x100a84e8]
mov dword [eax + 0xb], 0x241bc74a
mov eax, dword [0x100a84e8]
mov byte [eax + 0xf], 0xc3
push edi
push 0x40
push 0x10
push dword [0x100a84e8]
call ebp
push edi
push 0x40
push 6
push 0x241bc740
call ebp
mov byte [0x241bc740], 0x68
mov dword [0x241bc741], 0x10001ca0
mov byte [0x241bc745], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x241bc740
call ebp
push edi
push 0x40
push 1
push 0x241bc75f
call ebp
mov byte [0x241bc75f], 0xeb
push edi
push dword [esp + 4]
push 1
push 0x241bc75f
call ebp
push edi
push 0x40
push 2
push 0x2404b3ad
call ebp
mov word [0x2404b3ad], 0x9090
push edi
push dword [esp + 4]
push 2
push 0x2404b3ad
call ebp
push 0xd
call ebx
add esp, 4
mov dword [0x100a84ec], eax
mov ecx, dword [0x2400a6e0]
mov dword [eax], ecx
movzx ecx, word [0x2400a6e4]
mov word [eax + 4], cx
mov eax, dword [0x100a84ec]
movzx ecx, byte [0x2400a6e6]
mov byte [eax + 6], cl
mov eax, dword [0x100a84ec]
mov byte [eax + 7], 0x68
mov eax, dword [0x100a84ec]
mov dword [eax + 8], 0x2400a6e7
mov eax, dword [0x100a84ec]
mov byte [eax + 0xc], 0xc3
push edi
push 0x40
push 0xd
push dword [0x100a84ec]
call ebp
push edi
push 0x40
push 6
push 0x2400a6e0
call ebp
mov byte [0x2400a6e0], 0x68
mov dword [0x2400a6e1], 0x10001cd0
mov byte [0x2400a6e5], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x2400a6e0
call ebp
push edi
push 0x40
push 3
push 0x24037550
call ebp
mov word [0x24037550], 0x18c2
mov byte [0x24037552], 0
push edi
push dword [esp + 4]
push 3
push 0x24037550
call ebp
push str._____Prediction
call esi
add esp, 4
push edi
push 0x40
push 5
push 0x200464d4
call ebp
mov dword [0x200464d4], 0x90909090
mov byte [0x200464d8], 0x90
push edi
push dword [esp + 4]
push 5
push 0x200464d4
call ebp
push edi
push 0x40
push 1
push 0x2412c3fb
call ebp
mov byte [0x2412c3fb], 0xeb
push edi
push dword [esp + 4]
push 1
push 0x2412c3fb
call ebp
push 0xe
call ebx
add esp, 4
mov dword [0x100a84f0], eax
mov ecx, dword [0x2412b7c0]
mov dword [eax], ecx
movzx ecx, word [0x2412b7c4]
mov word [eax + 4], cx
mov eax, dword [0x100a84f0]
movzx ecx, word [0x2412b7c6]
mov word [eax + 6], cx
mov eax, dword [0x100a84f0]
mov byte [eax + 8], 0x68
mov eax, dword [0x100a84f0]
mov dword [eax + 9], 0x2412b7c8
mov eax, dword [0x100a84f0]
mov byte [eax + 0xd], 0xc3
push edi
push 0x40
push 0xe
push dword [0x100a84f0]
call ebp
push edi
push 0x40
push 6
push 0x2412b7c0
call ebp
mov byte [0x2412b7c0], 0x68
mov dword [0x2412b7c1], 0x10001d80
mov byte [0x2412b7c5], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x2412b7c0
call ebp
push 0xc
call ebx
add esp, 4
mov dword [0x100a8ecc], eax
mov ecx, dword [0x2412b650]
mov dword [eax], ecx
movzx ecx, word [0x2412b654]
mov word [eax + 4], cx
mov eax, dword [0x100a8ecc]
mov byte [eax + 6], 0x68
mov eax, dword [0x100a8ecc]
mov dword [eax + 7], 0x2412b656
mov eax, dword [0x100a8ecc]
mov byte [eax + 0xb], 0xc3
push edi
push 0x40
push 0xc
push dword [0x100a8ecc]
call ebp
push edi
push 0x40
push 6
push 0x2412b650
call ebp
mov byte [0x2412b650], 0x68
mov dword [0x2412b651], 0x10001e60
mov byte [0x2412b655], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x2412b650
call ebp
push 0xc
call ebx
add esp, 4
mov dword [0x100a8ed4], eax
mov ecx, dword [0x2412b8e0]
mov dword [eax], ecx
movzx ecx, word [0x2412b8e4]
mov word [eax + 4], cx
mov eax, dword [0x100a8ed4]
mov byte [eax + 6], 0x68
mov eax, dword [0x100a8ed4]
mov dword [eax + 7], 0x2412b8e6
mov eax, dword [0x100a8ed4]
mov byte [eax + 0xb], 0xc3
push edi
push 0x40
push 0xc
push dword [0x100a8ed4]
call ebp
push edi
push 0x40
push 6
push 0x2412b8e0
call ebp
mov byte [0x2412b8e0], 0x68
mov dword [0x2412b8e1], 0x10001e90
mov byte [0x2412b8e5], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x2412b8e0
call ebp
push edi
push 0x40
push 6
push 0x240ff120
call ebp
mov byte [0x240ff120], 0x68
mov dword [0x240ff121], 0x10001ef0
mov byte [0x240ff125], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x240ff120
call ebp
push 0xd
call ebx
add esp, 4
mov dword [0x100a8ed8], eax
mov ecx, dword [0x2412bb50]
mov dword [eax], ecx
movzx ecx, word [0x2412bb54]
mov word [eax + 4], cx
mov eax, dword [0x100a8ed8]
movzx ecx, byte [0x2412bb56]
mov byte [eax + 6], cl
mov eax, dword [0x100a8ed8]
mov byte [eax + 7], 0x68
mov eax, dword [0x100a8ed8]
mov dword [eax + 8], 0x2412bb57
mov eax, dword [0x100a8ed8]
mov byte [eax + 0xc], 0xc3
push edi
push 0x40
push 0xd
push dword [0x100a8ed8]
call ebp
push edi
push 0x40
push 6
push 0x2412bb50
call ebp
mov byte [0x2412bb50], 0x68
mov dword [0x2412bb51], 0x10001f10
mov byte [0x2412bb55], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x2412bb50
call ebp
push 0xc
call ebx
add esp, 4
mov dword [0x100a8edc], eax
mov ecx, dword [0x24018c20]
mov dword [eax], ecx
movzx ecx, word [0x24018c24]
mov word [eax + 4], cx
mov eax, dword [0x100a8edc]
mov byte [eax + 6], 0x68
mov eax, dword [0x100a8edc]
mov dword [eax + 7], 0x24018c26
mov eax, dword [0x100a8edc]
mov byte [eax + 0xb], 0xc3
push edi
push 0x40
push 0xc
push dword [0x100a8edc]
call ebp
push edi
push 0x40
push 6
push 0x24018c20
call ebp
mov byte [0x24018c20], 0x68
mov dword [0x24018c21], 0x10001f70
mov byte [0x24018c25], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x24018c20
call ebp
push edi
push 0x40
push 9
push 0x241e21e8
call ebp
mov dword [0x241e21e8], 0x90909090
mov dword [0x241e21ec], 0x90909090
mov byte [0x241e21f0], 0x90
push edi
push dword [esp + 4]
push 9
push 0x241e21e8
call ebp
push 0xd
call ebx
add esp, 4
mov dword [0x100a8ee4], eax
mov ecx, dword [0x241e0d40]
mov dword [eax], ecx
movzx ecx, word [0x241e0d44]
mov word [eax + 4], cx
mov eax, dword [0x100a8ee4]
movzx ecx, byte [0x241e0d46]
mov byte [eax + 6], cl
mov eax, dword [0x100a8ee4]
mov byte [eax + 7], 0x68
mov eax, dword [0x100a8ee4]
mov dword [eax + 8], 0x241e0d47
mov eax, dword [0x100a8ee4]
mov byte [eax + 0xc], 0xc3
push edi
push 0x40
push 0xd
push dword [0x100a8ee4]
call ebp
push edi
push 0x40
push 6
push 0x241e0d40
call ebp
mov byte [0x241e0d40], 0x68
mov dword [0x241e0d41], 0x10001f90
mov byte [0x241e0d45], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x241e0d40
call ebp
push 0xc
call ebx
add esp, 4
mov dword [0x100a8ee8], eax
mov ecx, dword [0x2412c1e0]
mov dword [eax], ecx
movzx ecx, word [0x2412c1e4]
mov word [eax + 4], cx
mov eax, dword [0x100a8ee8]
mov byte [eax + 6], 0x68
mov eax, dword [0x100a8ee8]
mov dword [eax + 7], 0x2412c1e6
mov eax, dword [0x100a8ee8]
mov byte [eax + 0xb], 0xc3
push edi
push 0x40
push 0xc
push dword [0x100a8ee8]
call ebp
push edi
push 0x40
push 6
push 0x2412c1e0
call ebp
mov byte [0x2412c1e0], 0x68
mov dword [0x2412c1e1], 0x10002020
mov byte [0x2412c1e5], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x2412c1e0
call ebp
push str._____Network
call esi
add esp, 4
push 0xd
call ebx
add esp, 4
mov dword [0x100a8eec], eax
mov ecx, dword [0x2003fd10]
mov dword [eax], ecx
movzx ecx, word [0x2003fd14]
mov word [eax + 4], cx
mov eax, dword [0x100a8eec]
movzx ecx, byte [0x2003fd16]
mov byte [eax + 6], cl
mov eax, dword [0x100a8eec]
mov byte [eax + 7], 0x68
mov eax, dword [0x100a8eec]
mov dword [eax + 8], 0x2003fd17
mov eax, dword [0x100a8eec]
mov byte [eax + 0xc], 0xc3
push edi
push 0x40
push 0xd
push dword [0x100a8eec]
call ebp
push edi
push 0x40
push 6
push 0x2003fd10
call ebp
mov byte [0x2003fd10], 0x68
mov dword [0x2003fd11], 0x10002100
mov byte [0x2003fd15], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x2003fd10
call ebp
push 0xc
call ebx
add esp, 4
mov dword [0x100a8ef4], eax
mov ecx, dword [0x20042510]
mov dword [eax], ecx
movzx ecx, word [0x20042514]
mov word [eax + 4], cx
mov eax, dword [0x100a8ef4]
mov byte [eax + 6], 0x68
mov eax, dword [0x100a8ef4]
mov dword [eax + 7], 0x20042516
mov eax, dword [0x100a8ef4]
mov byte [eax + 0xb], 0xc3
push edi
push 0x40
push 0xc
push dword [0x100a8ef4]
call ebp
push edi
push 0x40
push 6
push 0x20042510
call ebp
mov byte [0x20042510], 0x68
mov dword [0x20042511], 0x10002130
mov byte [0x20042515], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x20042510
call ebp
push edi
push 0x40
push 6
push 0x200423d0
call ebp
mov byte [0x200423d0], 0x68
mov dword [0x200423d1], 0x100021a0
mov byte [0x200423d5], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x200423d0
call ebp
push 0xe
call ebx
add esp, 4
mov dword [0x100a8ef8], eax
mov ecx, dword [0x2013bb90]
mov dword [eax], ecx
movzx ecx, word [0x2013bb94]
mov word [eax + 4], cx
mov eax, dword [0x100a8ef8]
movzx ecx, word [0x2013bb96]
mov word [eax + 6], cx
mov eax, dword [0x100a8ef8]
mov byte [eax + 8], 0x68
mov eax, dword [0x100a8ef8]
mov dword [eax + 9], 0x2013bb98
mov eax, dword [0x100a8ef8]
mov byte [eax + 0xd], 0xc3
push edi
push 0x40
push 0xe
push dword [0x100a8ef8]
call ebp
push edi
push 0x40
push 6
push 0x2013bb90
call ebp
mov byte [0x2013bb90], 0x68
mov dword [0x2013bb91], 0x10002290
mov byte [0x2013bb95], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x2013bb90
call ebp
push str._____Input
call esi
add esp, 4
push edi
push 0x40
push 3
push 0x240f7920
call ebp
mov word [0x240f7920], 0x9090
mov byte [0x240f7922], 0x90
push edi
push dword [esp + 4]
push 3
push 0x240f7920
call ebp
push 0xc
call ebx
add esp, 4
mov dword [0x100aa29c], eax
mov ecx, dword [0x240d4920]
mov dword [eax], ecx
movzx ecx, word [0x240d4924]
mov word [eax + 4], cx
mov eax, dword [0x100aa29c]
mov byte [eax + 6], 0x68
mov eax, dword [0x100aa29c]
mov dword [eax + 7], 0x240d4926
mov eax, dword [0x100aa29c]
mov byte [eax + 0xb], 0xc3
push edi
push 0x40
push 0xc
push dword [0x100aa29c]
call ebp
push edi
push 0x40
push 6
push 0x240d4920
call ebp
mov byte [0x240d4920], 0x68
mov dword [0x240d4921], 0x100023e0
mov byte [0x240d4925], 0xc3
push edi
push dword [esp + 4]
push 6
push 0x240d4920
call ebp
push str._____View_Effects
call esi
add esp, 4
push edi
push 0x40
push 0x22
push 0x240192d2
call ebp
movaps xmm0, xmmword [0x1000a210]
movups xmmword [0x240192d2], xmm0
movups xmmword [0x240192e2], xmm0
mov word [0x240192f2], 0x9090
push edi
push dword [esp + 4]
push 0x22
push 0x240192d2
call ebp
push str.vgui2.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.CreateInterface
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push str.VGUI_Panel009
call eax
add esp, 8
mov edi, eax
mov dword [0x100aa2dc], eax
push 0x10
call fcn.10008450
add esp, 4
mov esi, eax
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], edi
mov ebp, dword [edi]
cmp dword [ebp], 0
je 0x100067b8
xor eax, eax
nop word [eax + eax]
mov ecx, eax
inc eax
mov dword [esi + 0xc], eax
mov ebp, dword [edi]
cmp dword [ebp + ecx*4 + 4], 0
jne 0x100066c0
lea ecx, [eax*4]
mov dword [esi + 8], ebp
cmp eax, 0x40000000
mov eax, 0xffffffff
mov dword [esp + 4], ecx
cmovb eax, ecx
jmp 0x100067c5
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x1c], 0x22c
lea edi, [esp + 0x40]
lea ebp, [esp + 0x1c]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
push ebp
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x100069c1
push str.hl2.exe
push edi
call ebx
add esp, 8
test eax, eax
jne 0x10006710
push dword [esp + 0x24]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
sub esp, 0x14
movaps xmm0, xmmword [0x1000a220]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
lea ebx, [esp + 0x248]
push 0x208
push ebx
push dword [esp + 0x46c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x208
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push edi
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x100069c1
mov dword [esi + 8], ebp
mov dword [esp + 4], 0
xor eax, eax
mov dword [esp + 8], eax
push eax
call fcn.100084b6
add esp, 4
mov ebx, eax
push dword [esp + 8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], ebx
push dword [esp + 4]
push ebp
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [edi], ebx
mov edi, dword [0x100aa2e0]
mov dword [0x100aa2e0], esi
test edi, edi
je 0x1000682b
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [eax], ecx
mov eax, dword [edi]
test eax, eax
je 0x1000681c
push eax
call fcn.100084bf
add esp, 4
push edi
call fcn.10008480
add esp, 4
mov esi, dword [0x100aa2e0]
cmp dword [esi + 0xc], 0x28
jb 0x1000683d
mov eax, dword [esi]
mov dword [eax + 0xa0], 0x10005900
push str._____Crosshair
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
call esi
add esp, 4
mov ebp, esp
push ebp
push 0x40
push 6
push 0x241e1600
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
mov byte [0x241e1600], 0x68
mov dword [0x241e1601], 0x10004ce0
mov byte [0x241e1605], 0xc3
push ebp
push dword [esp + 4]
push 6
push 0x241e1600
call ebx
push str._____Materials
call esi
add esp, 4
push str.MaterialSystem.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
lea edi, [eax + 0x55e0]
push 0x11
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x100aa2d4], eax
mov ecx, dword [esi + 0x55e0]
mov dword [eax], ecx
movzx ecx, word [esi + 0x55e4]
mov word [eax + 4], cx
mov eax, dword [0x100aa2d4]
mov ecx, dword [esi + 0x55e6]
mov dword [eax + 6], ecx
movzx ecx, byte [esi + 0x55ea]
mov byte [eax + 0xa], cl
mov byte [eax + 0xb], 0x68
lea eax, [esi + 0x55eb]
mov ecx, dword [0x100aa2d4]
mov dword [ecx + 0xc], eax
mov eax, dword [0x100aa2d4]
mov byte [eax + 0x10], 0xc3
push ebp
push 0x40
push 0x11
push dword [0x100aa2d4]
call ebx
push ebp
push 0x40
push 6
push edi
call ebx
mov byte [esi + 0x55e0], 0x68
mov dword [esi + 0x55e1], 0x100053d0
mov byte [esi + 0x55e5], 0xc3
push ebp
push dword [esp + 4]
push 6
push edi
call ebx
push ebp
push 0x40
push 2
push 0x24169ec8
call ebx
mov word [0x24169ec8], 0x9090
push ebp
push dword [esp + 4]
push 2
push 0x24169ec8
call ebx
push ebp
push 0x40
push 1
push 0x24176e19
call ebx
mov byte [0x24176e19], 0xeb
push ebp
push dword [esp + 4]
push 1
push 0x24176e19
call ebx
push ebp
push 0x40
push 3
push 0x2418e270
call ebx
mov word [0x2418e270], 0x8c2
mov byte [0x2418e272], 0
push ebp
push dword [esp + 4]
push 3
push 0x2418e270
call ebx
push ebp
push 0x40
push 1
push 0x241bea10
call ebx
mov byte [0x241bea10], 0xc3
push ebp
push dword [esp + 4]
push 1
push 0x241bea10
call ebx
mov eax, 1
add esp, 0x450
pop esi
pop edi
pop ebx
pop ebp
ret 0xc