Function at 0x1000be0f
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, 0x10072dcc
call fcn.1004e0b0
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov ebx, 0xffff
push edi
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CGameSA.0
lea edi, [esi + 0x144]
mov ecx, edi
call fcn.1000e656
add edi, 0x1c
sub ebx, 1
jne 0x1000be35
lea ebx, [esi + 0x1c01e0]
mov dword [ebp - 0x18], ebx
and dword [ebx], 0
and dword [ebx + 4], 0
push ebx
call fcn.1000bc2d
pop ecx
mov dword [ebx], eax
lea eax, [ebp - 0x20]
mov dword [0x1011379c], esi
push eax
push 0x40
push 0x4a3000
xor ebx, ebx
push 0x401000
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, esi
call fcn.1000cb18
mov edi, eax
cmp edi, 5
je 0x1000beb0
cmp edi, 0xb
je 0x1000bea9
cmp edi, 0xf
je 0x1000bea2
cmp edi, 0x14
jne 0x1000beb5
call fcn.100040ee
jmp 0x1000beb5
call fcn.1000fbb2
jmp 0x1000beb5
call fcn.1000fb7f
jmp 0x1000beb5
call fcn.1000fb4c
mov eax, ebx
lea ecx, [esi + 0x14c]
mov dword [ecx], eax
inc eax
lea ecx, [ecx + 0x1c]
cmp eax, 0xffff
jl 0x1000bebd
push 4
call fcn.1004de64
pop ecx
test eax, eax
je 0x1000bede
mov dword [eax], vtable.CAudioSA.0
jmp 0x1000bee0
mov eax, ebx
push 4
mov dword [esi + 0x1c01ac], eax
call fcn.1004de64
pop ecx
test eax, eax
je 0x1000befa
mov dword [eax], vtable.CWorldSA.0
jmp 0x1000befc
mov eax, ebx
push 0x13888
mov dword [esi + 0x1c0160], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1000bf21
mov ecx, eax
call fcn.10013992
jmp 0x1000bf23
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0128], eax
call fcn.1004de64
pop ecx
test eax, eax
je 0x1000bf40
mov dword [eax], vtable.CClockSA.0
jmp 0x1000bf42
mov eax, ebx
push 4
mov dword [esi + 0x1c013c], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x1000bf64
mov ecx, eax
call fcn.10016084
jmp 0x1000bf66
mov eax, ebx
push 0x14
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0134], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x1000bf90
push 0xb6f028
mov ecx, eax
call fcn.10008b5a
jmp 0x1000bf92
mov eax, ebx
push 0x104
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0164], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x1000bfba
mov ecx, eax
call fcn.1000a1fd
jmp 0x1000bfbc
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0140], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x1000bfe4
mov ecx, eax
call fcn.10009453
jmp 0x1000bfe6
mov eax, ebx
push 0x9b4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0144], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x1000c00e
mov ecx, eax
call fcn.10012351
jmp 0x1000c010
mov eax, ebx
push 0xc4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c016c], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x1000c038
mov ecx, eax
call fcn.1000b21e
jmp 0x1000c03a
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0174], eax
call fcn.1004de64
pop ecx
test eax, eax
je 0x1000c057
mov dword [eax], vtable.CHudSA.0
jmp 0x1000c059
mov eax, ebx
push 0xf4
mov dword [esi + 0x1c0154], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 8
test eax, eax
je 0x1000c07e
mov ecx, eax
call fcn.1000b4f2
jmp 0x1000c080
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c014c], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 9
test eax, eax
je 0x1000c0a8
mov ecx, eax
call fcn.100066e8
jmp 0x1000c0aa
mov eax, ebx
push 0x13c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0178], eax
call fcn.1004de64
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000c0d3
push 0xb73458
mov ecx, eax
call fcn.1000c6fd
jmp 0x1000c0d5
mov eax, ebx
push 0x7d0
mov dword [esi + 0x1c01a0], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xa
test eax, eax
je 0x1000c0fa
mov ecx, eax
call fcn.1001c0f3
jmp 0x1000c0fc
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01a4], eax
call fcn.1004de64
pop ecx
test eax, eax
je 0x1000c119
mov dword [eax], vtable.CAERadioTrackManagerSA.0
jmp 0x1000c11b
mov eax, ebx
push 4
mov dword [esi + 0x1c01a8], eax
call fcn.1004de64
pop ecx
test eax, eax
je 0x1000c135
mov dword [eax], vtable.CWeatherSA.0
jmp 0x1000c137
mov eax, ebx
push 8
mov dword [esi + 0x1c015c], eax
call fcn.1004de64
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000c15b
mov dword [eax], vtable.CMenuManagerSA.0
mov dword [eax + 4], 0xba6748
jmp 0x1000c15d
mov eax, ebx
push 4
mov dword [esi + 0x1c01b0], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xb
test eax, eax
je 0x1000c17f
mov ecx, eax
call fcn.1001c095
jmp 0x1000c181
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01b4], eax
call fcn.1004de64
pop ecx
test eax, eax
je 0x1000c19e
mov dword [eax], vtable.CStatsSA.0
jmp 0x1000c1a0
mov eax, ebx
push 4
mov dword [esi + 0x1c01b8], eax
call fcn.1004de64
pop ecx
test eax, eax
je 0x1000c1ba
mov dword [eax], vtable.CFontSA.0
jmp 0x1000c1bc
mov eax, ebx
push 4
mov dword [esi + 0x1c01bc], eax
call fcn.1004de64
pop ecx
test eax, eax
je 0x1000c1d6
mov dword [eax], vtable.CPathFindSA.0
jmp 0x1000c1d8
mov eax, ebx
push 1
mov dword [esi + 0x1c01c0], eax
call fcn.1004de64
push 8
mov dword [esi + 0x1c01c4], eax
call fcn.1004de64
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x1000c208
mov ecx, eax
call fcn.10018225
jmp 0x1000c20a
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01c8], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xd
test eax, eax
je 0x1000c22f
mov ecx, eax
call fcn.1001744b
jmp 0x1000c231
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d0], eax
call fcn.1004de64
pop ecx
test eax, eax
je 0x1000c24e
mov dword [eax], vtable.CCarEnterExitSA.0
jmp 0x1000c250
mov eax, ebx
push 4
mov dword [esi + 0x1c01d4], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x1000c272
mov ecx, eax
call fcn.1000a153
jmp 0x1000c274
mov eax, ebx
push 0x88
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d8], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xf
test eax, eax
je 0x1000c29c
mov ecx, eax
call fcn.1000c74c
jmp 0x1000c29e
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0130], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x1000c2c4
push edi
mov ecx, eax
call fcn.100163f8
jmp 0x1000c2c6
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c017c], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x1000c2eb
mov ecx, eax
call fcn.1000dae5
jmp 0x1000c2ed
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0180], eax
call fcn.1004de64
pop ecx
test eax, eax
je 0x1000c30a
mov dword [eax], vtable.CEventListSA.0
jmp 0x1000c30c
mov eax, ebx
push 0xd0
mov dword [esi + 0x1c0148], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x1000c336
push 0x96c048
mov ecx, eax
call fcn.1000d697
jmp 0x1000c338
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0150], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x13
test eax, eax
je 0x1000c363
push dword [esi + 0x1c01c8]
mov ecx, eax
call fcn.1001b3a6
jmp 0x1000c365
mov eax, ebx
push 0xe1c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01cc], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x14
test eax, eax
je 0x1000c38d
mov ecx, eax
call fcn.10006bf0
jmp 0x1000c38f
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0184], eax
call fcn.1004de64
pop ecx
test eax, eax
je 0x1000c3ac
mov dword [eax], vtable.CStreamingSA.0
jmp 0x1000c3ae
mov eax, ebx
push 4
mov dword [esi + 0x1c0188], eax
call fcn.1004de64
pop ecx
test eax, eax
je 0x1000c3c8
mov dword [eax], vtable.CVisibilityPluginsSA.0
jmp 0x1000c3ca
mov eax, ebx
push 4
mov dword [esi + 0x1c018c], eax
call fcn.1004de64
pop ecx
test eax, eax
je 0x1000c3e4
mov dword [eax], vtable.CKeyGenSA.0
jmp 0x1000c3e6
mov eax, ebx
push 4
mov dword [esi + 0x1c0190], eax
call fcn.1004de64
pop ecx
test eax, eax
je 0x1000c400
mov dword [eax], vtable.CRopesSA.0
jmp 0x1000c402
mov eax, ebx
push 8
mov dword [esi + 0x1c0194], eax
call fcn.1004de64
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000c426
mov dword [eax], vtable.CFxSA.0
mov dword [eax + 4], 0xa9ae00
jmp 0x1000c428
mov eax, ebx
push 0xe0cc
mov dword [esi + 0x1c0198], eax
call fcn.1004de64
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x1000c44d
mov ecx, eax
call fcn.1001f45a
jmp 0x1000c44f
mov eax, ebx
mov dword [esi + 0x1c019c], eax
mov edi, 0xc8bf48
lea eax, [esi + 4]
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], bl
mov ebx, 0xc8aab8
mov dword [ebp - 0x10], eax
push 0xc
call fcn.1004de64
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000c48e
lea ecx, [esi + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], ebx
mov dword [eax + 4], ecx
jmp 0x1000c490
xor eax, eax
mov ecx, dword [ebp - 0x10]
add ebx, 0x70
inc esi
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x10], ecx
cmp ebx, edi
jl 0x1000c46e
mov eax, dword [ebp - 0x14]
add eax, 0xc0
mov esi, eax
xor ebx, ebx
push 0xc
call fcn.1004de64
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000c4cf
lea ecx, [ebx + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
jmp 0x1000c4d1
xor eax, eax
mov dword [esi], eax
inc ebx
add edi, 0x70
add esi, 4
cmp ebx, 0xb
jl 0x1000c4af
cmp edi, 0xc8cdb8
jl 0x1000c4ad
push 0xc
call fcn.1004de64
xor ebx, ebx
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000c50a
mov dword [eax], vtable.CPlayerInfoSA.0
mov dword [eax + 4], 0xb7cd98
mov dword [eax + 8], ebx
jmp 0x1000c50c
mov eax, ebx
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x38]
push 9
mov dword [ebp - 0x38], ebx
push str.hovercars
mov dword [esi + 0x1c012c], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004351
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x1c]
lea edi, [esi + 0x1c01e0]
push eax
mov ecx, edi
call fcn.1000bd83
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969152
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000c590
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ecx
cmp eax, 0x1000
jb 0x1000c587
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10003ba0
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
push eax
push ecx
call fcn.1004de94
pop ecx
pop ecx
push 7
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.aircars
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004351
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000bd83
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969160
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000c605
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000c5fc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10003ba0
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1004de94
pop ecx
pop ecx
push 0xa
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrabunny
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004351
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000bd83
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969161
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000c67a
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000c671
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10003ba0
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1004de94
pop ecx
pop ecx
push 9
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrajump
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004351
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000bd83
mov eax, dword [eax]
mov dword [eax + 0x28], 0x96916c
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000c6ec
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x1000c6e3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10003ba0
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.1004de94
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret