Function at 0x1000e9f1
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, 0x1008541c
call fcn.1005e900
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov ebx, 0xffff
push edi
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CGameSA.0
lea edi, [esi + 0x144]
mov ecx, edi
call fcn.10011238
add edi, 0x1c
sub ebx, 1
jne 0x1000ea17
lea ebx, [esi + 0x1c01e0]
mov dword [ebp - 0x18], ebx
and dword [ebx], 0
and dword [ebx + 4], 0
push ebx
call fcn.1000e80f
pop ecx
mov dword [ebx], eax
lea eax, [ebp - 0x20]
mov dword [0x10129a3c], esi
push eax
push 0x40
push 0x4a3000
xor ebx, ebx
push 0x401000
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, esi
call fcn.1000f6fa
mov edi, eax
cmp edi, 5
je 0x1000ea92
cmp edi, 0xb
je 0x1000ea8b
cmp edi, 0xf
je 0x1000ea84
cmp edi, 0x14
jne 0x1000ea97
call fcn.1000459b
jmp 0x1000ea97
call fcn.10012794
jmp 0x1000ea97
call fcn.10012761
jmp 0x1000ea97
call fcn.1001272e
mov eax, ebx
lea ecx, [esi + 0x14c]
mov dword [ecx], eax
inc eax
lea ecx, [ecx + 0x1c]
cmp eax, 0xffff
jl 0x1000ea9f
push 4
call fcn.1005e8ba
pop ecx
test eax, eax
je 0x1000eac0
mov dword [eax], vtable.CAudioSA.0
jmp 0x1000eac2
mov eax, ebx
push 4
mov dword [esi + 0x1c01ac], eax
call fcn.1005e8ba
pop ecx
test eax, eax
je 0x1000eadc
mov dword [eax], vtable.CWorldSA.0
jmp 0x1000eade
mov eax, ebx
push 0x13888
mov dword [esi + 0x1c0160], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1000eb03
mov ecx, eax
call fcn.10016622
jmp 0x1000eb05
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0128], eax
call fcn.1005e8ba
pop ecx
test eax, eax
je 0x1000eb22
mov dword [eax], vtable.CClockSA.0
jmp 0x1000eb24
mov eax, ebx
push 4
mov dword [esi + 0x1c013c], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x1000eb46
mov ecx, eax
call fcn.10018d14
jmp 0x1000eb48
mov eax, ebx
push 0x14
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0134], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x1000eb72
push 0xb6f028
mov ecx, eax
call fcn.1000b709
jmp 0x1000eb74
mov eax, ebx
push 0x104
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0164], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x1000eb9c
mov ecx, eax
call fcn.1000cddf
jmp 0x1000eb9e
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0140], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x1000ebc6
mov ecx, eax
call fcn.1000c002
jmp 0x1000ebc8
mov eax, ebx
push 0x9b4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0144], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x1000ebf0
mov ecx, eax
call fcn.10014fae
jmp 0x1000ebf2
mov eax, ebx
push 0xc4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c016c], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x1000ec1a
mov ecx, eax
call fcn.1000de00
jmp 0x1000ec1c
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0174], eax
call fcn.1005e8ba
pop ecx
test eax, eax
je 0x1000ec39
mov dword [eax], vtable.CHudSA.0
jmp 0x1000ec3b
mov eax, ebx
push 0xf4
mov dword [esi + 0x1c0154], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 8
test eax, eax
je 0x1000ec60
mov ecx, eax
call fcn.1000e0d4
jmp 0x1000ec62
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c014c], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 9
test eax, eax
je 0x1000ec8a
mov ecx, eax
call fcn.10009297
jmp 0x1000ec8c
mov eax, ebx
push 0x13c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0178], eax
call fcn.1005e8ba
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000ecb5
push 0xb73458
mov ecx, eax
call fcn.1000f2df
jmp 0x1000ecb7
mov eax, ebx
push 0x7d0
mov dword [esi + 0x1c01a0], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xa
test eax, eax
je 0x1000ecdc
mov ecx, eax
call fcn.1001ed83
jmp 0x1000ecde
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01a4], eax
call fcn.1005e8ba
pop ecx
test eax, eax
je 0x1000ecfb
mov dword [eax], vtable.CAERadioTrackManagerSA.0
jmp 0x1000ecfd
mov eax, ebx
push 4
mov dword [esi + 0x1c01a8], eax
call fcn.1005e8ba
pop ecx
test eax, eax
je 0x1000ed17
mov dword [eax], vtable.CWeatherSA.0
jmp 0x1000ed19
mov eax, ebx
push 8
mov dword [esi + 0x1c015c], eax
call fcn.1005e8ba
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000ed3d
mov dword [eax], vtable.CMenuManagerSA.0
mov dword [eax + 4], 0xba6748
jmp 0x1000ed3f
mov eax, ebx
push 4
mov dword [esi + 0x1c01b0], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xb
test eax, eax
je 0x1000ed61
mov ecx, eax
call fcn.1001ed25
jmp 0x1000ed63
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01b4], eax
call fcn.1005e8ba
pop ecx
test eax, eax
je 0x1000ed80
mov dword [eax], vtable.CStatsSA.0
jmp 0x1000ed82
mov eax, ebx
push 4
mov dword [esi + 0x1c01b8], eax
call fcn.1005e8ba
pop ecx
test eax, eax
je 0x1000ed9c
mov dword [eax], vtable.CFontSA.0
jmp 0x1000ed9e
mov eax, ebx
push 4
mov dword [esi + 0x1c01bc], eax
call fcn.1005e8ba
pop ecx
test eax, eax
je 0x1000edb8
mov dword [eax], vtable.CPathFindSA.0
jmp 0x1000edba
mov eax, ebx
push 1
mov dword [esi + 0x1c01c0], eax
call fcn.1005e8ba
push 8
mov dword [esi + 0x1c01c4], eax
call fcn.1005e8ba
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x1000edea
mov ecx, eax
call fcn.1001aeb5
jmp 0x1000edec
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01c8], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xd
test eax, eax
je 0x1000ee11
mov ecx, eax
call fcn.1001a0db
jmp 0x1000ee13
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d0], eax
call fcn.1005e8ba
pop ecx
test eax, eax
je 0x1000ee30
mov dword [eax], vtable.CCarEnterExitSA.0
jmp 0x1000ee32
mov eax, ebx
push 4
mov dword [esi + 0x1c01d4], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x1000ee54
mov ecx, eax
call fcn.1000cd35
jmp 0x1000ee56
mov eax, ebx
push 0x88
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d8], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xf
test eax, eax
je 0x1000ee7e
mov ecx, eax
call fcn.1000f32e
jmp 0x1000ee80
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0130], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x1000eea6
push edi
mov ecx, eax
call fcn.10019088
jmp 0x1000eea8
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c017c], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x1000eecd
mov ecx, eax
call fcn.100106c7
jmp 0x1000eecf
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0180], eax
call fcn.1005e8ba
pop ecx
test eax, eax
je 0x1000eeec
mov dword [eax], vtable.CEventListSA.0
jmp 0x1000eeee
mov eax, ebx
push 0xd0
mov dword [esi + 0x1c0148], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x1000ef18
push 0x96c048
mov ecx, eax
call fcn.10010279
jmp 0x1000ef1a
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0150], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x13
test eax, eax
je 0x1000ef45
push dword [esi + 0x1c01c8]
mov ecx, eax
call fcn.1001e036
jmp 0x1000ef47
mov eax, ebx
push 0xe1c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01cc], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x14
test eax, eax
je 0x1000ef6f
mov ecx, eax
call fcn.1000979f
jmp 0x1000ef71
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0184], eax
call fcn.1005e8ba
pop ecx
test eax, eax
je 0x1000ef8e
mov dword [eax], vtable.CStreamingSA.0
jmp 0x1000ef90
mov eax, ebx
push 4
mov dword [esi + 0x1c0188], eax
call fcn.1005e8ba
pop ecx
test eax, eax
je 0x1000efaa
mov dword [eax], vtable.CVisibilityPluginsSA.0
jmp 0x1000efac
mov eax, ebx
push 4
mov dword [esi + 0x1c018c], eax
call fcn.1005e8ba
pop ecx
test eax, eax
je 0x1000efc6
mov dword [eax], vtable.CKeyGenSA.0
jmp 0x1000efc8
mov eax, ebx
push 4
mov dword [esi + 0x1c0190], eax
call fcn.1005e8ba
pop ecx
test eax, eax
je 0x1000efe2
mov dword [eax], vtable.CRopesSA.0
jmp 0x1000efe4
mov eax, ebx
push 8
mov dword [esi + 0x1c0194], eax
call fcn.1005e8ba
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f008
mov dword [eax], vtable.CFxSA.0
mov dword [eax + 4], 0xa9ae00
jmp 0x1000f00a
mov eax, ebx
push 0xe0cc
mov dword [esi + 0x1c0198], eax
call fcn.1005e8ba
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x1000f02f
mov ecx, eax
call fcn.100220ea
jmp 0x1000f031
mov eax, ebx
mov dword [esi + 0x1c019c], eax
mov edi, 0xc8bf48
lea eax, [esi + 4]
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], bl
mov ebx, 0xc8aab8
mov dword [ebp - 0x10], eax
push 0xc
call fcn.1005e8ba
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f070
lea ecx, [esi + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], ebx
mov dword [eax + 4], ecx
jmp 0x1000f072
xor eax, eax
mov ecx, dword [ebp - 0x10]
add ebx, 0x70
inc esi
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x10], ecx
cmp ebx, edi
jl 0x1000f050
mov eax, dword [ebp - 0x14]
add eax, 0xc0
mov esi, eax
xor ebx, ebx
push 0xc
call fcn.1005e8ba
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f0b1
lea ecx, [ebx + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
jmp 0x1000f0b3
xor eax, eax
mov dword [esi], eax
inc ebx
add edi, 0x70
add esi, 4
cmp ebx, 0xb
jl 0x1000f091
cmp edi, 0xc8cdb8
jl 0x1000f08f
push 0xc
call fcn.1005e8ba
xor ebx, ebx
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f0ec
mov dword [eax], vtable.CPlayerInfoSA.0
mov dword [eax + 4], 0xb7cd98
mov dword [eax + 8], ebx
jmp 0x1000f0ee
mov eax, ebx
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x38]
push 9
mov dword [ebp - 0x38], ebx
push str.hovercars
mov dword [esi + 0x1c012c], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.1000485f
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x1c]
lea edi, [esi + 0x1c01e0]
push eax
mov ecx, edi
call fcn.1000e965
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969152
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f172
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ecx
cmp eax, 0x1000
jb 0x1000f169
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10003fa6
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
push eax
push ecx
call fcn.1005e8ea
pop ecx
pop ecx
push 7
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.aircars
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.1000485f
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000e965
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969160
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f1e7
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000f1de
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10003fa6
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1005e8ea
pop ecx
pop ecx
push 0xa
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrabunny
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.1000485f
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000e965
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969161
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f25c
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000f253
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10003fa6
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1005e8ea
pop ecx
pop ecx
push 9
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrajump
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.1000485f
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000e965
mov eax, dword [eax]
mov dword [eax + 0x28], 0x96916c
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f2ce
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x1000f2c5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10003fa6
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.1005e8ea
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret