Function at 0x1000c2e0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006f985
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x100b0040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x100b09dc], 0
je 0x1000d8fe
mov esi, dword [0x100b1df8]
test esi, esi
je 0x1000c3d9
push 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], esi
push eax
push dword [0x100b1c00]
call dword [sym.imp.KERNEL32.dll_K32QueryWorkingSetEx]
test eax, eax
je 0x1000c3d9
test byte [ebp - 0x24], 1
je 0x1000c3d9
mov esi, dword [esi]
sub esi, 0xffffff80
cmp esi, dword [0x100b3614]
je 0x1000c3d9
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
mov edx, esi
call fcn.10002eb0
add esp, 4
test eax, eax
je 0x1000c3d3
mov edi, dword [ebp - 0x30]
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], 0
lea edx, [edi + 4]
call fcn.10002eb0
add esp, 4
test eax, eax
je 0x1000c3d3
push 0
push 0
push 0xff
push str.Freedom_v0.94.1_DEV__f7a6a52__is_Loading_
push dword [ebp - 0x30]
lea eax, [edi + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x100
jae 0x1000d92a
mov byte [eax + str.Freedom_v0.94.1_DEV__f7a6a52__is_Loading_], 0
mov dword [0x100b3614], esi
mov ecx, dword [0x100b31c8]
mov edi, ecx
mov esi, dword [0x100b31d4]
mov dword [ebp - 0x30], ecx
test ecx, ecx
jne 0x1000c402
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1000c3fd
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + 0x44]
mov ecx, dword [eax]
mov edi, ecx
mov dword [ebp - 0x30], ecx
call fcn.1001fcd0
lea eax, [ebp - 0x30]
lea ecx, [esi + 0x49d8]
push eax
call fcn.1002a840
mov eax, dword [esi + 0x3f8c]
mov ecx, dword [eax + 0x270]
mov eax, dword [edi + 0x30]
push dword [eax + 4]
call fcn.10033c30
mov eax, dword [0x100b31d4]
xor edx, edx
push 0x41
mov ecx, str.Freedom
or dword [eax + 0x4954], 1
mov dword [eax + 0x4964], 0
mov dword [eax + 0x4968], 0
mov dword [eax + 0x496c], 0
mov dword [eax + 0x4970], 0
mov dword [eax + 0x4958], 2
call fcn.1001cfc0
add esp, 4
push str.Freedom_v0.94.1_DEV__f7a6a52__is_Loading_
push 0x100a3454
call fcn.1003c950
movss xmm0, dword [0x100a5e4c]
add esp, 8
movss xmm1, dword [0x100b1e7c]
comiss xmm0, xmm1
jbe 0x1000c528
mulss xmm1, dword [0x100a5f34]
sub esp, 8
addss xmm1, dword [0x100a5dd4]
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
push str.Memory_Scan:__.0f__
push 0x20
push 0x100b3618
call fcn.10013c40
mov eax, dword [0x100b31d4]
add esp, 0x14
mov edx, dword [eax + 0x3f8c]
mov ecx, edx
cmp dword [ecx + 0x198], 0
jne 0x1000c4fa
cmp dword [eax + 0x4ce0], 0
mov eax, 0x234
je 0x1000c4ff
mov eax, 0x204
movss xmm0, dword [ecx + eax]
lea ecx, [ebp - 0x28]
subss xmm0, dword [edx + 0xf8]
mov dword [ebp - 0x24], 0
movss dword [ebp - 0x28], xmm0
movss xmm0, dword [0x100b1e7c]
call fcn.1003edb0
mov ecx, dword [0x100b31d4]
mov eax, dword [ecx + 0x3f8c]
movss xmm1, dword [eax + 0x24]
addss xmm1, dword [eax + 0x1c]
movss xmm0, dword [eax + 0x18]
or dword [ecx + 0x4954], 1
movss dword [ecx + 0x4964], xmm0
mov dword [ecx + 0x496c], 0
movss dword [ecx + 0x4968], xmm1
mov dword [ecx + 0x4970], 0
mov dword [ecx + 0x4958], 8
mov ecx, eax
cmp byte [ecx + 0xb3], 0
jne 0x1000d8f4
push ecx
push str.settings
call fcn.10016da0
mov ecx, dword [0x100b31d4]
mov esi, eax
cmp byte [ecx + 0x383f], 0
je 0x1000c5c6
cmp byte [ecx + 0x470c], 0
jne 0x1000c5c6
mov ecx, 0x20
call fcn.10017120
test al, al
je 0x1000c5c6
mov edx, 1
mov ecx, esi
call fcn.10023f70
mov ecx, esi
call fcn.10024280
test al, al
je 0x1000d8f4
cmp byte [0x100b0950], 0
jne 0x1000c5f4
cmp byte [0x100b09a0], 0
jne 0x1000c5f4
cmp byte [0x100b0978], 0
jne 0x1000c5f4
xor al, al
jmp 0x1000c5f9
mov eax, 1
push eax
push 0
push str.Difficulty
call fcn.1000d980
cmp dword [0x100b1e9c], 0
je 0x1000c625
movzx eax, byte [0x100b1e2e]
push eax
push 1
push str.Relax
call fcn.1000d980
jmp 0x1000c62f
push str.Relax
call fcn.1000da10
cmp dword [0x100b1e9c], 0
je 0x1000c64e
movzx eax, byte [0x100b1e2d]
push eax
push 2
push str.Aimbot
call fcn.1000d980
jmp 0x1000c658
push str.Aimbot
call fcn.1000da10
cmp dword [0x100b1f98], 0
je 0x1000c677
movzx eax, byte [0x100b1fc3]
push eax
push 3
push str.Timewarp
call fcn.1000d980
jmp 0x1000c681
push str.Timewarp
call fcn.1000da10
cmp dword [0x100b1f84], 0
je 0x1000c6a0
movzx eax, byte [0x100b1e2f]
push eax
push 4
push str.Replay
call fcn.1000d980
jmp 0x1000c6aa
push str.Replay
call fcn.1000da10
cmp byte [0x100b1fc1], 0
jne 0x1000c6c9
cmp byte [0x100b1fc2], 0
jne 0x1000c6c9
cmp byte [0x100b1c07], 0
jne 0x1000c6c9
xor al, al
jmp 0x1000c6ce
mov eax, 1
push eax
push 5
push 0x100a263c
call fcn.1000d980
movzx eax, byte [0x100b1fc4]
push eax
push 6
push str.Misc
call fcn.1000d980
cmp dword [0x100b3638], 7
lea eax, [ebp - 0x28]
push eax
sete dl
mov dword [ebp - 0x28], 0
push 1
mov ecx, str.About
mov dword [ebp - 0x24], 0
call fcn.10046800
add esp, 8
test al, al
je 0x1000c734
mov eax, dword [0x100b31d4]
mov dword [0x100b3638], 7
or dword [eax + 0x4954], 0x20
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
push 1
xor dl, dl
mov dword [ebp - 0x24], 0
mov ecx, str.Debug
call fcn.10046800
add esp, 8
test al, al
je 0x1000c7b8
mov edx, dword [0x100b31d4]
mov byte [0x100b1e2c], 1
mov esi, dword [edx + 0x20]
mov dword [edx + 0x5dc0], 0
test esi, esi
je 0x1000c7be
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
call fcn.10029130
mov edx, 0x100a4c58
mov ecx, esi
mov edi, eax
call fcn.10013e40
mov esi, eax
test esi, esi
je 0x1000c7b8
push esi
push dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
push 1
push edi
call fcn.1005d449
push esi
call fcn.1005ac9c
add esp, 0x14
mov edx, dword [0x100b31d4]
mov eax, dword [edx + 0x3f8c]
mov ecx, 5
movss xmm0, dword [edx + 0x3cf4]
lea edx, [ebp - 0x28]
mulss xmm0, dword [0x100a5f14]
movss xmm1, dword [eax + 0x24]
movss dword [ebp - 0x24], xmm1
movss dword [ebp - 0x28], xmm0
call fcn.10014d90
mov esi, dword [0x100b31d4]
push 5
mov ecx, dword [esi + 0x3f8c]
mov eax, ecx
mov edx, dword [esi + 0x4954]
or edx, 2
mov dword [esi + 0x4974], 0
mov dword [esi + 0x4954], edx
or edx, 1
mov dword [esi + 0x4978], 0
mov dword [esi + 0x495c], 1
movss xmm0, dword [ecx + 0x18]
addss xmm0, dword [eax + 0x20]
movss xmm1, dword [ecx + 0x1c]
mov ecx, str.tab_content
mov dword [esi + 0x4954], edx
xor edx, edx
movss dword [esi + 0x4968], xmm1
mov dword [esi + 0x496c], 0
movss dword [esi + 0x4964], xmm0
mov dword [esi + 0x4970], 0
mov dword [esi + 0x4958], 1
call fcn.1001cfc0
add esp, 4
mov ecx, 1
call fcn.10014e10
cmp dword [0x100b3638], 0
jne 0x1000c8e9
mov eax, dword [0x100b31d4]
lea edx, [ebp - 0x28]
mov ecx, 0xe
movss xmm0, dword [eax + 0x3cf4]
mulss xmm0, dword [0x100a5df8]
movss dword [ebp - 0x28], xmm0
movss dword [ebp - 0x24], xmm0
call fcn.10014d90
mov edx, 0x100b0950
call fcn.1000dae0
mov edx, 0x100b09a0
call fcn.1000dae0
mov edx, 0x100b0978
call fcn.1000dae0
mov ecx, 1
call fcn.10014e10
cmp dword [0x100b3638], 1
jne 0x1000cb38
mov edx, 0x100b1e2e
mov ecx, str.Enable
call fcn.1003e480
test al, al
je 0x1000c92c
cmp byte [0x100b1e2e], 0
je 0x1000c919
call fcn.10008060
jmp 0x1000c91e
call fcn.100080b0
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x40a00000
call fcn.1003f080
mov eax, dword [0x100b31d4]
movss xmm3, dword [0x100a5f9c]
push 0
push 0
movss xmm2, dword [eax + 0x3cf4]
push 0x100a3520
push ecx
lea ecx, [ebp - 0x20]
mov dword [esp], 0xbf800000
push ecx
mov ecx, dword [eax + 0x3cf0]
call fcn.10039950
movss xmm0, dword [ebp - 0x20]
addss xmm0, dword [0x100a5e50]
cvttss2si eax, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x100a5e90]
call fcn.10023130
push 0
push 0
push 0x14
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
push 2
push 0x100b0948
xor edx, edx
mov dword [ebp - 0x24], 0
mov ecx, str.Left_Click
call fcn.10042f60
push 0
push 0
push 0x14
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
push 2
push 0x100b0944
xor edx, edx
mov dword [ebp - 0x24], 0
mov ecx, str.Right_Click
call fcn.10042f60
add esp, 0x30
call fcn.10023190
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x40a00000
call fcn.1003f080
cmp dword [0x100b09f0], 0x73
mov ecx, str.SingleTap
sete dl
call fcn.1003e8e0
test al, al
je 0x1000ca57
push str.SingleTap_Mode
push 0x10077d44
push 0x100b0c80
mov dword [0x100b09f0], 0x73
call fcn.1000ae20
mov ecx, dword [0x100b31d4]
add esp, 0xc
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
movss xmm1, dword [0x100a5fac]
xorps xmm0, xmm0
call fcn.10023080
cmp dword [0x100b09f0], 0x61
mov ecx, str.Alternate
sete dl
call fcn.1003e8e0
test al, al
je 0x1000caae
push str.Alternate_Mode
push 0x10077d44
push 0x100b0c80
mov dword [0x100b09f0], 0x61
call fcn.1000ae20
mov ecx, dword [0x100b31d4]
add esp, 0xc
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x40a00000
call fcn.1003f080
mov edx, 0x100b09dd
mov ecx, str.Variable_Unstable_Rate
call fcn.1003e480
test al, al
je 0x1000cae5
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x40a00000
call fcn.1003f080
mov al, byte [0x100b09dd]
mov byte [ebp - 0x29], al
test al, al
jne 0x1000cb0c
call fcn.1001fe10
mov edx, 0x100b1fc5
mov ecx, str.Jumping_Unstable_Rate_Window
call fcn.1003e480
test al, al
je 0x1000cb2d
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
cmp byte [ebp - 0x29], 0
jne 0x1000cb38
call fcn.1001fe70
cmp dword [0x100b3638], 2
jne 0x1000cc85
mov edx, 0x100b1e2d
mov ecx, str.Enable
call fcn.1003e480
test al, al
je 0x1000cb7b
cmp byte [0x100b1e2d], 0
je 0x1000cb68
call fcn.10008060
jmp 0x1000cb6d
call fcn.100080b0
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x40a00000
call fcn.1003f080
movss xmm3, dword [0x100a5ee8]
mov edx, 0x100b09e4
movss xmm2, dword [0x100a5dd4]
push ecx
push str.Cursor_Delay:__.2f
mov ecx, str.fraction_modifier
call fcn.1000c1f0
add esp, 8
call fcn.1001a160
test al, al
je 0x1000cbd0
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x3f000000
call fcn.1003f080
mov eax, dword [0x100b31d4]
movss xmm0, dword [eax + 0x3cf4]
mulss xmm0, dword [0x100a5f10]
call fcn.10023130
sub esp, 0x10
call fcn.10040980
add esp, 0x10
call fcn.10023190
call fcn.1001a160
test al, al
je 0x1000cc27
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
mov ecx, dword [0x100b31d4]
movss xmm0, dword [ecx + 0x38e8]
mov eax, dword [ecx + 0x3f8c]
addss xmm0, xmm0
movss xmm1, dword [eax + 0x24]
addss xmm0, dword [ecx + 0x3cf4]
addss xmm0, dword [ecx + 0x38f8]
mov byte [eax + 0xb0], 1
mov eax, dword [ecx + 0x3f8c]
subss xmm1, xmm0
movss xmm0, dword [eax + 0x1c]
subss xmm0, dword [eax + 0x80]
mov byte [eax + 0x139], 1
addss xmm0, xmm1
movss dword [eax + 0xfc], xmm0
cmp dword [0x100b3638], 3
jne 0x1000cd77
mov edx, 0x100b1fc3
mov ecx, str.Enable
call fcn.1003e480
test al, al
je 0x1000ccc8
cmp byte [0x100b1fc3], 0
je 0x1000ccb5
call fcn.1000a2e0
jmp 0x1000ccba
call fcn.1000a3b0
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x40a00000
call fcn.1003f080
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100b1524]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100b3f10]
cmp eax, dword [ecx + 4]
jg 0x1000d92f
mov eax, dword [0x100b31d4]
movss xmm0, dword [eax + 0x3cf4]
mulss xmm0, dword [0x100a5f10]
call fcn.10023130
push ecx
push str.Timewarp_Scale:__.2lf
push 0x100b0d78
push 0x100b0d70
push 0x100b3f08
mov edx, 9
mov ecx, str.timewarp_scale
call fcn.100404a0
add esp, 0x14
test al, al
je 0x1000cd5b
movsd xmm0, qword [0x100b3f08]
mulsd xmm0, qword [0x100a5ec8]
movsd qword [0x100b09e8], xmm0
call fcn.10023190
call fcn.1001a160
test al, al
je 0x1000cd77
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
cmp dword [0x100b3638], 4
jne 0x1000d0b1
push str.Open_Replay_Preview_in_game_to_Select_a_Replay
push 0x100a3454
call fcn.1003c950
add esp, 8
mov ecx, 0x400
call fcn.10017120
test al, al
je 0x1000cdb1
push str.Selected_Replay
call fcn.10023e10
add esp, 4
movss xmm0, dword [0x100b0c74]
push str.Mods
push dword [0x100b0c78]
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push str.Replay_Author
push str._s____.2f______ux____s
call fcn.1003c950
add esp, 0x18
mov ecx, 0x400
call fcn.10017120
test al, al
je 0x1000cdfc
push str.Player__Accuracy__Mods
call fcn.10023e10
add esp, 4
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x40000000
call fcn.1003f080
mov edx, 0x100b1e2f
mov ecx, str.Enable
call fcn.1003e480
test al, al
je 0x1000cee3
cmp byte [0x100b1e2f], 0
je 0x1000ced0
cmp byte [0x100b32f0], 0
jne 0x1000ce7d
mov eax, dword [0x100b32dc]
test eax, eax
je 0x1000ce7d
push eax
push dword [0x100b32d0]
push 0x100b32e0
call fcn.10052c90
mov edx, dword [0x100b32d4]
add esp, 0xc
mov ecx, dword [0x100b32d0]
push dword [0x100b32dc]
call fcn.10002f80
add esp, 4
mov byte [0x100b32f0], 1
mov ecx, 0x100b3318
call fcn.100010c0
cmp byte [0x100b34ec], 0
jne 0x1000ced5
mov eax, dword [0x100b34d8]
test eax, eax
je 0x1000ced5
push eax
push dword [0x100b34cc]
push 0x100b34dc
call fcn.10052c90
mov edx, dword [0x100b34d0]
add esp, 0xc
mov ecx, dword [0x100b34cc]
push dword [0x100b34d8]
call fcn.10002f80
add esp, 4
mov byte [0x100b34ec], 1
jmp 0x1000ced5
call fcn.1000a1a0
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
mov ecx, 0x400
call fcn.10017120
test al, al
je 0x1000cefe
push str.Usage:_Open_Replay_Preview_in_game_to_Select_a_Replay
call fcn.10023e10
add esp, 4
mov eax, dword [0x100b31d4]
movss xmm1, dword [0x100a5fac]
movss xmm0, dword [eax + 0x3cf4]
mulss xmm0, dword [0x100a5ef8]
call fcn.10023080
cmp byte [0x100b1e2f], 0
jne 0x1000cf2e
call fcn.1001fe10
mov edx, 0x100b1fc0
mov ecx, str.Hardrock
call fcn.1003e480
test al, al
je 0x1000cfd8
cmp byte [0x100b0b10], 0
je 0x1000cfd8
mov ecx, dword [0x100b0afc]
mov eax, dword [0x100b0af8]
cmp eax, ecx
je 0x1000cfd8
movss xmm5, dword [0x100b1ef8]
movss xmm6, dword [0x100a60e0]
movss xmm7, dword [0x100a5f50]
nop dword [eax]
movss xmm1, dword [eax + 0xc]
movaps xmm0, xmm7
subss xmm1, dword [0x100b1eec]
movss xmm4, dword [eax + 8]
subss xmm4, dword [0x100b1ee8]
divss xmm1, xmm5
divss xmm4, xmm5
subss xmm0, xmm1
movaps xmm1, xmm5
mulss xmm4, xmm5
addss xmm4, dword [0x100b1ee8]
andps xmm0, xmm6
mulss xmm1, xmm0
addss xmm1, dword [0x100b1eec]
movss dword [eax + 8], xmm4
movss dword [eax + 0xc], xmm1
add eax, 0x18
cmp eax, ecx
jne 0x1000cf80
mov ecx, 0x400
call fcn.10017120
test al, al
je 0x1000cff3
push str.Convert_Replay_to_from_Hardrock
call fcn.10023e10
add esp, 4
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x40000000
call fcn.1003f080
mov edx, 0x100b094b
mov ecx, str.Replay_Aim
call fcn.1003e480
test al, al
je 0x1000d02a
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
mov ecx, 0x400
call fcn.10017120
test al, al
je 0x1000d045
push str.Aim_According_to_Replay_Data
call fcn.10023e10
add esp, 4
mov eax, dword [0x100b31d4]
movss xmm1, dword [0x100a5fac]
movss xmm0, dword [eax + 0x3cf4]
mulss xmm0, dword [0x100a5ef8]
call fcn.10023080
mov edx, 0x100b094a
mov ecx, str.Replay_Keys
call fcn.1003e480
test al, al
je 0x1000d088
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
mov ecx, 0x400
call fcn.10017120
test al, al
je 0x1000d0a3
push str.Press_Keys_According_to_Replay_Data
call fcn.10023e10
add esp, 4
cmp byte [0x100b1e2f], 0
jne 0x1000d0b1
call fcn.1001fe70
cmp dword [0x100b3638], 5
jne 0x1000d347
mov esi, dword [0x100b1fbc]
test esi, esi
jne 0x1000d0cd
call fcn.1001fe10
mov edx, 0x100b1fc1
mov ecx, str.Unmod_Flashlight
call fcn.1003e480
test al, al
je 0x1000d103
cmp byte [0x100b1fc1], 0
je 0x1000d0f0
call fcn.1000a4e0
jmp 0x1000d0f5
call fcn.1000a580
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
test esi, esi
jne 0x1000d10c
call fcn.1001fe70
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x40a00000
call fcn.1003f080
mov esi, dword [0x100b1f5c]
test esi, esi
jne 0x1000d131
call fcn.1001fe10
mov edx, 0x100b1fc2
mov ecx, str.Unmod_Hidden
call fcn.1003e480
test al, al
je 0x1000d1bd
cmp byte [0x100b1fc2], 0
je 0x1000d1aa
cmp byte [0x100b32f0], 0
jne 0x1000d194
mov eax, dword [0x100b32dc]
test eax, eax
je 0x1000d194
push eax
push dword [0x100b32d0]
push 0x100b32e0
call fcn.10052c90
mov edx, dword [0x100b32d4]
add esp, 0xc
mov ecx, dword [0x100b32d0]
push dword [0x100b32dc]
call fcn.10002f80
add esp, 4
mov byte [0x100b32f0], 1
mov ecx, 0x100b3318
call fcn.100010c0
mov ecx, 0x100b34a4
call fcn.100010c0
jmp 0x1000d1af
call fcn.10009d10
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
test esi, esi
jne 0x1000d1c6
call fcn.1001fe70
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x40a00000
call fcn.1003f080
mov edi, dword [0x100b1f90]
test edi, edi
jne 0x1000d1eb
call fcn.1001fe10
push str.Score_Multiplier
call fcn.1003c950
add esp, 4
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x24], 0x40a00000
call fcn.1003f080
mov eax, dword [0x100b31d4]
push 0x46
mov esi, dword [eax + 0x3f8c]
mov ecx, esi
call fcn.10016df0
mov dword [ebp - 0x34], eax
lea ecx, [esi + 0xec]
lea eax, [ebp - 0x34]
push eax
call fcn.1002a840
mov edx, 0x100b1c07
mov ecx, str.Enable
call fcn.1003e480
test al, al
je 0x1000d26a
cmp byte [0x100b1c07], 0
je 0x1000d257
call fcn.1000a220
jmp 0x1000d25c
call fcn.1000a270
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
mov eax, dword [0x100b31d4]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x40a00000
mov eax, dword [eax + 0x3f8c]
dec dword [eax + 0xec]
call fcn.1003f080
cmp byte [0x100b1c07], 0
jne 0x1000d2b4
call fcn.1001fde0
movaps xmm0, xmmword [0x100a60b0]
lea edx, [ebp - 0x50]
xor ecx, ecx
movups xmmword [ebp - 0x50], xmm0
call fcn.10014c70
movss xmm3, dword [0x100a5f34]
xorps xmm2, xmm2
push ecx
push str.Score_Multiplier:__.0f
mov edx, 0x100b09d4
mov ecx, str.score_multiplier
call fcn.1000c1f0
add esp, 8
mov ecx, 0x400
call fcn.10017120
test al, al
je 0x1000d2f2
push str.Hold_Ctrl_To_Set_a_Custom_Value
call fcn.10023e10
add esp, 4
call fcn.1001a160
test al, al
je 0x1000d309
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
cmp byte [0x100b1c07], 0
jne 0x1000d33e
mov ecx, 1
call fcn.10014cd0
mov edx, dword [0x100b31d4]
dec dword [edx + 0x49f0]
mov eax, dword [edx + 0x49f8]
mov ecx, dword [edx + 0x49f0]
mov eax, dword [eax + ecx*4 - 4]
mov dword [edx + 0x48dc], eax
test edi, edi
jne 0x1000d347
call fcn.1001fe70
cmp dword [0x100b3638], 6
jne 0x1000d8a4
push str.Discord_RPC_Settings
call fcn.1003c950
add esp, 4
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x24], 0x40a00000
call fcn.1003f080
mov edx, 0x100b1fc4
mov ecx, str.Enable
call fcn.1003e480
test al, al
je 0x1000d3ad
cmp byte [0x100b1fc4], 0
je 0x1000d39a
call fcn.10009c30
jmp 0x1000d39f
call fcn.10009c80
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x40a00000
call fcn.1003f080
cmp byte [0x100b1fc4], 0
jne 0x1000d3e6
call fcn.1001fde0
movaps xmm0, xmmword [0x100a60b0]
lea edx, [ebp - 0x50]
xor ecx, ecx
movups xmmword [ebp - 0x50], xmm0
call fcn.10014c70
mov eax, dword [0x100b31d4]
movss xmm0, dword [eax + 0x3cf4]
mulss xmm0, dword [0x100a5f10]
call fcn.10023130
push 0
push 0
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
push 0x200
push 0x100b2bc8
mov edx, str.State
mov dword [ebp - 0x24], 0
mov ecx, str.rpc_state
call fcn.10042f60
add esp, 0x18
test al, al
je 0x1000d45d
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
push 0x100b1f48
mov edx, 0x100b2bc8
mov ecx, 0x100b27c8
call fcn.10009bb0
add esp, 4
push 0
push 0
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
push 0x200
push 0x100b21c8
mov edx, str.Large_Text
mov dword [ebp - 0x24], 0
mov ecx, str.rpc_large_text
call fcn.10042f60
add esp, 0x18
test al, al
je 0x1000d4ba
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
push 0x100b1f54
mov edx, 0x100b21c8
mov ecx, 0x100b2dc8
call fcn.10009bb0
add esp, 4
push 0
push 0
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
push 0x200
push 0x100b1fc8
mov edx, str.Small_Text
mov dword [ebp - 0x24], 0
mov ecx, str.rpc_small_text
call fcn.10042f60
add esp, 0x18
test al, al
je 0x1000d517
mov ecx, dword [0x100b31d4]
mov ecx, dword [ecx + 0x20]
call fcn.100290d0
push 0x100b1f4c
mov edx, 0x100b1fc8
mov ecx, 0x100b23c8
call fcn.10009bb0
add esp, 4
cmp byte [0x100b1fc4], 0
jne 0x1000d54c
mov ecx, 1
call fcn.10014cd0
mov edx, dword [0x100b31d4]
dec dword [edx + 0x49f0]
mov eax, dword [edx + 0x49f8]
mov ecx, dword [edx + 0x49f0]
mov eax, dword [eax + ecx*4 - 4]
mov dword [edx + 0x48dc], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x41200000
call fcn.1003f080
mov eax, dword [0x100b31d4]
cvttss2si eax, dword [eax + 0x3cf4]
push eax
push str.Font_Size:__dpx
push 0x10
push 0x100b3604
call fcn.10013180
push 0x10
mov edx, 0x100b3604
mov ecx, str.font_size
call fcn.1003f320
add esp, 0x14
test al, al
je 0x1000d6c9
mov eax, dword [0x100b31d4]
mov eax, dword [eax + 0x2c]
mov esi, dword [eax + 0x44]
mov eax, dword [eax + 0x3c]
lea edi, [esi + eax*4]
mov dword [ebp - 0x30], edi
cmp esi, edi
je 0x1000d6b8
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
nop word [eax + eax]
mov eax, dword [esi]
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov eax, dword [eax + 0x34]
cvttss2si eax, dword [eax + 0x10]
push eax
push 0x100a3838
lea eax, [ebp - 0x20]
push 4
push eax
call fcn.10013180
mov eax, dword [esi]
lea ecx, [ebp - 0x40]
cmp eax, dword [0x100b31c8]
push ecx
sete al
lea ecx, [ebp - 0x20]
push 0
mov dl, al
mov byte [ebp - 0x29], al
call fcn.10046800
add esp, 0x18
test al, al
je 0x1000d6a2
mov eax, dword [esi]
mov dword [0x100b31c8], eax
mov eax, dword [eax + 0x34]
cvttss2si eax, dword [eax + 0x10]
mov dword [0x100b09d8], eax
movd xmm0, eax
mov eax, dword [0x100b31d4]
cvtdq2ps xmm0, xmm0
mov edi, dword [eax + 0x20]
mov dword [eax + 0x5dc0], 0
mulss xmm0, dword [0x100a5e24]
movss dword [eax + 0x391c], xmm0
test edi, edi
je 0x1000d69f
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], 0
call fcn.10029130
mov edx, 0x100a4c58
mov dword [ebp - 0x24], eax
mov ecx, edi
call fcn.10013e40
mov edi, eax
test edi, edi
je 0x1000d69f
push edi
push dword [ebp - 0x34]
mov dword [ebp - 0x44], 0
push 1
push dword [ebp - 0x24]
call fcn.1005d449
push edi
call fcn.1005ac9c
add esp, 0x14
mov edi, dword [ebp - 0x30]
cmp byte [ebp - 0x29], 0
je 0x1000d6ad
call fcn.100202f0
add esi, 4
cmp esi, edi
jne 0x1000d5d0
mov esi, dword [0x100b31d4]
call fcn.10024320
dec dword [esi + 0x5c90]
mov ecx, dword [0x100b31d4]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x41200000
mov eax, dword [ecx + 0x3f8c]
mov byte [eax + 0xb0], 1
mov edx, dword [ecx + 0x3f8c]
mov ecx, dword [edx + 0x1b4]
mov eax, dword [edx + 0x1bc]
mov eax, dword [eax + ecx*4 - 4]
mov dword [edx + 0x1ac], eax
lea eax, [ecx - 1]
lea ecx, [ebp - 0x20]
mov dword [edx + 0x1b4], eax
call fcn.1003f080
call fcn.10006990
mov byte [ebp - 0x29], al
test al, al
je 0x1000d728
call fcn.1001fe10
push ecx
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], 0
mov ecx, str.Rescan_Memory
mov dword [ebp - 0x1c], 0
call fcn.1003d2b0
add esp, 4
test al, al
je 0x1000d76c
call fcn.10008260
push 0
push 0
push 0
push 0x10007fb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x29], 0
je 0x1000d792
call fcn.1001fe70
mov ecx, 0x400
call fcn.10017120
test al, al
je 0x1000d792
push str.No_Rescan_Needed:_All_Found
call fcn.10023e10
add esp, 4
movss xmm1, dword [0x100a5f18]
xorps xmm0, xmm0
call fcn.10023080
push ecx
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], 0
mov ecx, str.Unload_DLL
mov dword [ebp - 0x1c], 0
call fcn.1003d2b0
add esp, 4
test al, al
je 0x1000d88e
push dword [0x100b31cc]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp byte [0x100b3314], 0
je 0x1000d821
mov edi, dword [0x100b3300]
lea ecx, [ebp - 0x34]
mov eax, dword [0x100b32f4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ecx
push 0x40
push edi
push eax
mov dword [ebp - 0x30], eax
call esi
push edi
push 0x100b3304
push dword [ebp - 0x30]
call fcn.10052c90
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
push edi
push dword [ebp - 0x30]
call esi
mov byte [0x100b3314], 0
call fcn.10008260
push 4
call fcn.10050e74
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [eax], 0x100011e0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100016d0
push 0
push 0
call fcn.10054922
add esp, 0x18
mov dword [ebp - 0x38], eax
test eax, eax
je 0x1000d91c
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x1000d973
push ecx
push eax
call fcn.10050c74
add esp, 8
test eax, eax
jne 0x1000d973
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x40a00000
call fcn.1003f080
cmp dword [0x100b3638], 7
jne 0x1000d8ea
push str.Ciremuns_Freedom_v0.94.1_DEV__f7a6a52_
call fcn.1003c950
add esp, 4
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x40a00000
call fcn.1003f080
push str.Special_Thanks_to_Maple_Syrup
call fcn.1003c950
add esp, 4
push str._mrflashstudio
call fcn.1003c950
add esp, 4
call fcn.1001f630
call fcn.10024320
call fcn.1001f630
call fcn.1001fd70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10050e66
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 6
mov dword [ebp - 0x34], 0
call fcn.10050a9b
call fcn.100513d0
push 0x100b3f10
call fcn.1005124a
add esp, 4
cmp dword [0x100b3f10], 0xffffffff
jne 0x1000ccfe
movsd xmm0, qword [0x100b09e8]
divsd xmm0, qword [0x100a5ec8]
push 0x100b3f10
movsd qword [0x100b3f08], xmm0
call fcn.100511f9
add esp, 4
jmp 0x1000ccfe
push 1
call fcn.10050a9b
int3