Function at 0x1005f280
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x24
mov eax, dword [0x10106024]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov byte [esp + 0x20], 0x68
push 0
mov byte [esp + 0x29], 0
mov ebx, dword [edi + 8]
mov esi, dword [edi + 4]
push ebx
push esi
push str.ScreenFade
call fcn.100602b0
push 0
push ebx
mov dword [esp + 0x29], eax
lea eax, [esp + 0x28]
push esi
push eax
call fcn.100602b0
cmp esi, ebx
mov ecx, dword [eax + 0x13]
mov eax, ebx
cmovbe eax, esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
cmp ecx, eax
jb 0x1005fd69
cmp esi, ebx
mov eax, esi
cmovbe eax, ebx
mov dword [esp + 0x1c], eax
cmp ecx, eax
ja 0x1005fd69
mov dword [0x1010e928], ecx
test ecx, ecx
je 0x1005fd85
mov ebp, dword [edi + 0x18]
push 0
push ebp
push dword [edi + 0x14]
mov byte [esp + 0x34], 0x68
push str.sprites_voiceicon.spr
mov byte [esp + 0x3d], 0
call fcn.100602b0
push 0
mov dword [esp + 0x2d], eax
mov eax, dword [edi + 0x14]
push ebp
push eax
lea eax, [esp + 0x34]
push eax
call fcn.100602b0
mov ecx, ebp
mov edx, dword [eax + 7]
mov eax, dword [edi + 0x14]
cmp eax, ebp
mov dword [esp + 0x28], edx
cmovbe ecx, eax
mov dword [esp + 0x14], ecx
cmp edx, ecx
jb 0x1005fd4e
mov ecx, dword [esp + 0x28]
cmp eax, ebp
mov edx, eax
cmovbe edx, ebp
mov dword [esp + 0x18], edx
cmp ecx, edx
ja 0x1005fd4e
mov dword [0x1010e86c], ecx
test ecx, ecx
je 0x1005fd85
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x9c]
mov dword [esp + 0x20], ecx
mov ecx, dword [ecx + 0x30]
cmp ecx, dword [esp + 0x14]
jb 0x1005f38e
cmp ecx, edx
jbe 0x1005f3a7
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x1a]
cmp ecx, dword [esp + 0x14]
jb 0x1005fd33
cmp ecx, edx
ja 0x1005fd33
mov dword [0x1010e868], ecx
test ecx, ecx
je 0x1005fd85
push 2
push ebp
push eax
push str.x_____xxx____x____xx____xx
push 0x100f4e1c
call fcn.10060220
cmp eax, dword [esp + 0x14]
jb 0x1005fd18
cmp eax, dword [esp + 0x18]
ja 0x1005fd18
mov eax, dword [eax]
mov dword [0x1010e858], eax
test eax, eax
je 0x1005fd85
mov eax, dword [edi + 0x14]
push 0xa
push ebp
push eax
push str.xxxx____xx
push 0x100f4fa0
call fcn.10060220
mov eax, dword [eax]
cmp eax, dword [esp + 0x14]
jb 0x1005fcfd
cmp eax, dword [esp + 0x18]
ja 0x1005fcfd
mov dword [0x1010e7e4], eax
test eax, eax
je 0x1005fd85
push 0
push ebx
push esi
push str.ScreenFade
mov byte [esp + 0x30], 0x68
mov byte [esp + 0x35], 0
call fcn.100602b0
push 0
push ebx
mov dword [esp + 0x29], eax
lea eax, [esp + 0x28]
push esi
push eax
call fcn.100602b0
mov eax, dword [eax + 0x18]
cmp eax, dword [esp + 0x10]
jb 0x1005fcdf
mov ebp, dword [esp + 0x1c]
cmp eax, ebp
ja 0x1005fcdf
mov dword [0x1010e7e0], eax
test eax, eax
je 0x1005fd85
push 0
push ebx
push esi
push str.CL_Parse_Sound:_ent___i__cl.max_edicts__i
mov byte [esp + 0x30], 0x68
mov byte [esp + 0x35], 0
call fcn.100602b0
push 0
push ebx
mov dword [esp + 0x29], eax
lea eax, [esp + 0x28]
push esi
push eax
call fcn.100602b0
mov ecx, dword [eax - 0x10]
add eax, 0xfffffff4
add eax, ecx
cmp eax, dword [esp + 0x10]
jb 0x1005f4b0
cmp eax, ebp
jbe 0x1005f4f4
push 0
push ebx
push esi
push str.CL_Parse_Sound:_ent___i__cl.max_edicts__i
mov byte [esp + 0x30], 0x68
mov byte [esp + 0x35], 0
call fcn.100602b0
push 0
push ebx
mov dword [esp + 0x29], eax
lea eax, [esp + 0x28]
push esi
push eax
call fcn.100602b0
mov ecx, dword [eax - 0x11]
add eax, 0xfffffff3
add eax, ecx
cmp eax, dword [esp + 0x10]
jb 0x1005fcc1
cmp eax, ebp
ja 0x1005fcc1
mov dword [0x10110150], eax
test eax, eax
je 0x1005fd85
push 0
push ebx
push esi
push str.UserMsg:_Not_Present_on_Client__d_n
mov byte [esp + 0x30], 0x68
mov byte [esp + 0x35], 0
call fcn.100602b0
push 0
push ebx
mov dword [esp + 0x29], eax
lea eax, [esp + 0x28]
push esi
push eax
call fcn.100602b0
push ecx
push esi
push eax
push ecx
call fcn.10060130
cmp eax, dword [esp + 0x10]
jb 0x1005fca3
cmp eax, ebp
ja 0x1005fca3
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [0x10110154], eax
test eax, eax
je 0x1005fd85
mov ecx, edi
call fcn.1005ff40
mov dword [0x1010e7d4], eax
test eax, eax
je 0x1005fd85
mov ebx, dword [edi + 8]
mov esi, dword [edi + 4]
push 0
push ebx
push esi
push str.xxx____xxxxxxxxxxxxxxxxx
push 0x100f523c
call fcn.10060220
mov ecx, eax
cmp esi, ebx
mov eax, ebx
cmovbe eax, esi
mov dword [esp + 0x10], eax
cmp ecx, eax
jb 0x1005fc85
cmp esi, ebx
mov ebp, esi
cmovbe ebp, ebx
cmp ecx, ebp
ja 0x1005fc85
mov eax, dword [ecx + 3]
sub eax, 0x135da8
mov dword [0x1010e514], eax
je 0x1005fd85
push 0
push ebx
push esi
push str.in_:___i__.2f_k_s
mov byte [esp + 0x30], 0x68
mov byte [esp + 0x35], 0
call fcn.100602b0
push 0
push ebx
mov dword [esp + 0x29], eax
lea eax, [esp + 0x28]
push esi
push eax
call fcn.100602b0
push ecx
push esi
push eax
push str.x____xxx
push 0x100f51fc
call fcn.10060190
cmp eax, dword [esp + 0x10]
jb 0x1005fc67
cmp eax, ebp
ja 0x1005fc67
mov eax, dword [eax + 1]
sub eax, 0x40
mov dword [0x1010e7dc], eax
je 0x1005fd85
push 0
push ebx
push esi
push str.ex_interp_forced_down_to__i_msec_n
mov byte [esp + 0x30], 0x68
mov byte [esp + 0x35], 0
call fcn.100602b0
push 0
push ebx
mov dword [esp + 0x29], eax
lea eax, [esp + 0x28]
push esi
push eax
call fcn.100602b0
push 2
push ebx
push eax
push 0x100f507c
call fcn.100602b0
mov ecx, dword [eax]
add eax, 4
add eax, ecx
cmp eax, dword [esp + 0x10]
jb 0x1005fc49
cmp eax, ebp
ja 0x1005fc49
mov dword [0x1011014c], eax
test eax, eax
je 0x1005fd85
push 0
push ebx
push esi
push str.xxxxxxxx
push 0x100f500c
call fcn.10060220
cmp eax, dword [esp + 0x10]
jb 0x1005f695
cmp eax, ebp
jbe 0x1005f6ba
push 0
push ebx
push esi
push str.xxxxxxxxx____xx
push 0x100f5028
call fcn.10060220
cmp eax, dword [esp + 0x10]
jb 0x1005fc2b
cmp eax, ebp
ja 0x1005fc2b
mov dword [0x10110148], eax
test eax, eax
je 0x1005fd85
mov ecx, edi
call fcn.1005fda0
mov dword [0x1011013c], eax
test eax, eax
je 0x1005fd85
mov ebx, dword [edi + 8]
mov esi, dword [edi + 4]
push 0
push ebx
push esi
push str._c_c_c_cconnect__i__i___s____s__n
mov byte [esp + 0x30], 0x68
mov byte [esp + 0x35], 0
call fcn.100602b0
push 0
push ebx
mov dword [esp + 0x29], eax
lea eax, [esp + 0x28]
push esi
push eax
call fcn.100602b0
push ecx
push esi
push eax
push str.x____xxxxx
push 0x100f4e7c
call fcn.10060190
cmp esi, ebx
mov ecx, ebx
mov edx, eax
cmovbe ecx, esi
cmp edx, ecx
jb 0x1005fc0d
cmp esi, ebx
cmovbe esi, ebx
cmp edx, esi
ja 0x1005fc0d
mov eax, dword [edx + 1]
add eax, 5
add eax, edx
mov dword [0x1010fcfc], eax
je 0x1005fd85
mov eax, dword [0x1010e928]
mov ecx, dword [eax + 0xa4]
test ecx, ecx
jne 0x1005f763
mov ecx, dword [eax + 0xa0]
push 0
push dword [eax + 0xa8]
push ecx
push str.xxx_____x
push 0x100f4fd8
call fcn.10060220
mov esi, dword [edi + 0x18]
mov ecx, esi
mov edx, dword [edi + 0x14]
cmp edx, esi
cmovbe ecx, edx
cmp eax, ecx
jb 0x1005fbef
cmp edx, esi
cmovbe edx, esi
cmp eax, edx
ja 0x1005fbef
mov eax, dword [eax + 4]
sub eax, 4
mov dword [0x10110170], eax
je 0x1005fd85
mov eax, dword [0x1010e86c]
mov eax, dword [eax + 0x198]
call eax
mov esi, eax
test esi, esi
je 0x1005f7ff
mov edx, dword [esi + 4]
mov ecx, str.version
nop dword [eax]
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x1005f7f0
test al, al
je 0x1005f7ec
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x1005f7f0
add edx, 2
add ecx, 2
test al, al
jne 0x1005f7d0
xor eax, eax
jmp 0x1005f7f5
sbb eax, eax
or eax, 1
test eax, eax
je 0x1005f822
mov esi, dword [esi]
test esi, esi
jne 0x1005f7c1
push str.COffsets::GetGameBuild
push str._s:_not_found._n
call fcn.100a0980
mov eax, dword [0x101149e4]
mov dword [eax + 0x90], 0
jmp 0x1005fd82
mov ecx, dword [esi + 8]
add ecx, 0x17
mov eax, dword [ecx]
add eax, 4
add eax, ecx
je 0x1005f7ff
call eax
mov ecx, dword [0x101149e4]
mov dword [ecx + 0x90], eax
test eax, eax
je 0x1005fd85
mov ebx, dword [edi + 0x18]
mov esi, dword [edi + 0x14]
push 0
push ebx
push esi
push 0x100f4f54
call fcn.100602b0
cmp esi, ebx
mov ecx, ebx
mov edx, eax
cmovbe ecx, esi
cmp edx, ecx
jb 0x1005fbcc
cmp esi, ebx
cmovbe esi, ebx
cmp edx, esi
ja 0x1005fbcc
mov eax, dword [0x101149e4]
mov dword [eax + 0x9c], edx
test edx, edx
je 0x1005fd85
mov ebx, dword [edi + 8]
mov esi, dword [edi + 4]
push 2
push ebx
push esi
push 0x100f4dcc
call fcn.100602b0
cmp esi, ebx
mov ecx, ebx
cmovbe ecx, esi
cmp eax, ecx
jb 0x1005f8b9
cmp esi, ebx
cmovbe esi, ebx
cmp eax, esi
ja 0x1005f8b9
mov ecx, dword [eax + 2]
jmp 0x1005f8cd
push str.COffsets::AllowCheats
push str._s:_not_found._n
call fcn.100a0980
add esp, 8
xor ecx, ecx
mov eax, dword [0x101149e4]
push dword [0x1010e928]
push str.COffsets::FindGameOffsets
mov dword [eax + 0xf4], ecx
mov eax, dword [0x1010e7b0]
push str.___s:_g_pClient:_0x_X_n
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
push dword [0x1010e86c]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pEngine:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
push dword [0x1010e868]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pStudio:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
push dword [0x1010e858]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pStudioAPI:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
add esp, 0x40
push dword [0x1010e7e0]
mov ecx, dword [eax]
push str.COffsets::FindGameOffsets
push str.___s:_pmove:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
push dword [0x10110150]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pPreS_DynamicSound:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
push dword [0x10110154]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pClientUserMsgs:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
push dword [0x1010e514]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_client_state:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
add esp, 0x40
push dword [0x1010e7dc]
mov ecx, dword [eax]
push str.COffsets::FindGameOffsets
push str.___s:_client_static:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
push dword [0x1010e92c]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pIN_MouseMove:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
push dword [0x1011014c]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pCL_DriftInterpolationAmount:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
push dword [0x10110148]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pCL_RecordHUDCommand:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
add esp, 0x40
push dword [0x10110144]
mov ecx, dword [eax]
push str.COffsets::FindGameOffsets
push str.___s:_g_pHost_FilterTime:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
push dword [0x10110140]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pSCR_UpdateScreen:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
push dword [0x1010e7e4]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pStudioModelRenderer:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
push dword [0x1011013c]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pR_DrawEntitiesOnList:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
add esp, 0x40
push dword [0x1010fcfc]
mov ecx, dword [eax]
push str.COffsets::FindGameOffsets
push str.___s:_g_pInitiateGameConnection:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
push dword [0x1010fbcc]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pCL_RunUsercmd:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x1010e7b0]
push dword [0x1010e9dc]
push str.COffsets::FindGameOffsets
mov ecx, dword [eax]
push str.___s:_g_pNET_SendPacket:_0x_X_n
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x101149e4]
mov ecx, dword [0x1010e7b0]
push dword [eax + 0x90]
mov edx, dword [ecx]
push str.COffsets::FindGameOffsets
push str.___s:_g_pGlobals__m_iGameBuild:__i_n
push ecx
call dword [edx + 0x1c]
mov eax, dword [0x101149e4]
add esp, 0x40
mov ecx, dword [0x1010e7b0]
push dword [eax + 0x9c]
mov edx, dword [ecx]
push str.COffsets::FindGameOffsets
push str.___s:_g_pGlobals__m_dwInitPoint:_0x_X_n
push ecx
call dword [edx + 0x1c]
mov esi, dword [0x1010e928]
mov ecx, 0x2b
mov edi, 0x1010e930
add esp, 0x10
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x86
mov esi, dword [0x1010e86c]
mov edi, 0x1010e598
mov eax, dword [0x1010e858]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [0x1010e868]
mov ecx, 0x2e
mov edi, 0x1010e870
rep movsd dword es:[edi], dword [esi]
movq xmm0, qword [eax]
mov ecx, 0x1c
movq qword [0x1010e85c], xmm0
mov edi, 0x1010e7e8
mov eax, dword [eax + 8]
mov dword [0x1010e864], eax
mov eax, dword [0x1010e7e4]
mov esi, eax
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x1c]
push ecx
push 0x40
push 0x70
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1005fbb7
push str.COffsets::FindGameOffsets
push str._s:_g_pStudioModelRenderer_memory_protected._n
call fcn.100a0980
jmp 0x1005fd82
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100aa00f
add esp, 0x24
ret
push str.COffsets::InitPoint
push str._s:_not_found._n
call fcn.100a0980
mov eax, dword [0x101149e4]
mov dword [eax + 0x9c], 0
jmp 0x1005fd82
push str.COffsets::PlayerExtraInfo
push str._s:_not_found._n
call fcn.100a0980
mov dword [0x10110170], 0
jmp 0x1005fd82
push str.COffsets::InitiateGameConnection
push str._s:_not_found._n
call fcn.100a0980
mov dword [0x1010fcfc], 0
jmp 0x1005fd82
push str.COffsets::CL_RecordHUDCommand
push str._s:_not_found._n
call fcn.100a0980
mov dword [0x10110148], 0
jmp 0x1005fd82
push str.COffsets::CL_DriftInterpolationAmount
push str._s:_not_found._n
call fcn.100a0980
mov dword [0x1011014c], 0
jmp 0x1005fd82
push str.COffsets::ClientStatic
push str._s:_not_found._n
call fcn.100a0980
mov dword [0x1010e7dc], 0
jmp 0x1005fd82
push str.COffsets::ClientState
push str._s:_not_found._n
call fcn.100a0980
mov dword [0x1010e514], 0
jmp 0x1005fd82
push str.COffsets::ClientUserMsgs
push str._s:_not_found._n
call fcn.100a0980
mov dword [0x10110154], 0
jmp 0x1005fd82
push str.COffsets::PreS_DynamicSound
push str._s:_not_found._n
call fcn.100a0980
mov dword [0x10110150], 0
jmp 0x1005fd82
push str.COffsets::PlayerMove
push str._s:_not_found._n
call fcn.100a0980
mov dword [0x1010e7e0], 0
jmp 0x1005fd82
push str.COffsets::StudioModelRenderer
push str._s:_not_found._n
call fcn.100a0980
mov dword [0x1010e7e4], 0
jmp 0x1005fd82
push str.COffsets::StudioAPI
push str._s:_not_found._n
call fcn.100a0980
mov dword [0x1010e858], 0
jmp 0x1005fd82
push str.COffsets::Studio
push str._s:_not_found._n
call fcn.100a0980
mov dword [0x1010e868], 0
jmp 0x1005fd82
push str.COffsets::Engine
push str._s:_not_found._n
call fcn.100a0980
mov dword [0x1010e86c], 0
jmp 0x1005fd82
push str.COffsets::Client
push str._s:_not_found._n
call fcn.100a0980
mov dword [0x1010e928], 0
add esp, 8
mov ecx, dword [esp + 0x30]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100aa00f
add esp, 0x24
ret