One more update: Let's assume actual speed value is at [esi+34](float), [esi+10] will be the speed multiplier(float). [esi+28](int) - [esi+20](int) = base speed(or whatever you want to name it) of the song, it's 1147 or 1248 or some other numbers. Therefore, [esi+34](actual speed value) = ([esi+28]-[esi+20])*[esi+10].
And the actual speed of the song depends on the ratio between [esi+28](int) and [esi+34](float), which means setting [esi+34](float) higher or [esi+28](int) lower can speed up the song.
(Or, set [esi+10](float) before osu! does the calculation:[esi+34](actual speed value) = ([esi+28]-[esi+20])*[esi+10]). It does this calculation everytime the speed changes, such as when entering/exiting a song with mod)
However, osu! only use these number when [esi+10](float) != 1.0 so it's necessary to set it to some numbers other than 1.0 in order to make speed value do the jobs (or you can patch that check so that osu! always use these number).