Function at 0x1000d15d
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, 0x10071e42
call fcn.1004d1c0
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov ebx, 0xffff
push edi
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CGameSA.0
lea edi, [esi + 0x144]
mov ecx, edi
call fcn.1000f9a4
add edi, 0x1c
sub ebx, 1
jne 0x1000d183
lea ebx, [esi + 0x1c01e0]
mov dword [ebp - 0x18], ebx
and dword [ebx], 0
and dword [ebx + 4], 0
push ebx
call fcn.1000cf7b
pop ecx
mov dword [ebx], eax
lea eax, [ebp - 0x20]
mov dword [0x1011ded0], esi
push eax
push 0x40
push 0x4a3000
xor ebx, ebx
push 0x401000
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, esi
call fcn.1000de66
mov edi, eax
cmp edi, 5
je 0x1000d1fe
cmp edi, 0xb
je 0x1000d1f7
cmp edi, 0xf
je 0x1000d1f0
cmp edi, 0x14
jne 0x1000d203
call fcn.1000425d
jmp 0x1000d203
call fcn.10010f00
jmp 0x1000d203
call fcn.10010ecd
jmp 0x1000d203
call fcn.10010e9a
mov eax, ebx
lea ecx, [esi + 0x14c]
mov dword [ecx], eax
inc eax
lea ecx, [ecx + 0x1c]
cmp eax, 0xffff
jl 0x1000d20b
push 4
call fcn.1004cf74
pop ecx
test eax, eax
je 0x1000d22c
mov dword [eax], vtable.CAudioSA.0
jmp 0x1000d22e
mov eax, ebx
push 4
mov dword [esi + 0x1c01ac], eax
call fcn.1004cf74
pop ecx
test eax, eax
je 0x1000d248
mov dword [eax], vtable.CWorldSA.0
jmp 0x1000d24a
mov eax, ebx
push 0x13888
mov dword [esi + 0x1c0160], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1000d26f
mov ecx, eax
call fcn.10014ce0
jmp 0x1000d271
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0128], eax
call fcn.1004cf74
pop ecx
test eax, eax
je 0x1000d28e
mov dword [eax], vtable.CClockSA.0
jmp 0x1000d290
mov eax, ebx
push 4
mov dword [esi + 0x1c013c], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x1000d2b2
mov ecx, eax
call fcn.100173d2
jmp 0x1000d2b4
mov eax, ebx
push 0x14
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0134], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x1000d2de
push 0xb6f028
mov ecx, eax
call fcn.10009ea8
jmp 0x1000d2e0
mov eax, ebx
push 0x104
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0164], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x1000d308
mov ecx, eax
call fcn.1000b54b
jmp 0x1000d30a
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0140], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x1000d332
mov ecx, eax
call fcn.1000a7a1
jmp 0x1000d334
mov eax, ebx
push 0x9b4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0144], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x1000d35c
mov ecx, eax
call fcn.1001369f
jmp 0x1000d35e
mov eax, ebx
push 0xc4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c016c], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x1000d386
mov ecx, eax
call fcn.1000c56c
jmp 0x1000d388
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0174], eax
call fcn.1004cf74
pop ecx
test eax, eax
je 0x1000d3a5
mov dword [eax], vtable.CHudSA.0
jmp 0x1000d3a7
mov eax, ebx
push 0xf4
mov dword [esi + 0x1c0154], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 8
test eax, eax
je 0x1000d3cc
mov ecx, eax
call fcn.1000c840
jmp 0x1000d3ce
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c014c], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 9
test eax, eax
je 0x1000d3f6
mov ecx, eax
call fcn.10007a36
jmp 0x1000d3f8
mov eax, ebx
push 0x13c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0178], eax
call fcn.1004cf74
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d421
push 0xb73458
mov ecx, eax
call fcn.1000da4b
jmp 0x1000d423
mov eax, ebx
push 0x7d0
mov dword [esi + 0x1c01a0], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xa
test eax, eax
je 0x1000d448
mov ecx, eax
call fcn.1001d441
jmp 0x1000d44a
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01a4], eax
call fcn.1004cf74
pop ecx
test eax, eax
je 0x1000d467
mov dword [eax], vtable.CAERadioTrackManagerSA.0
jmp 0x1000d469
mov eax, ebx
push 4
mov dword [esi + 0x1c01a8], eax
call fcn.1004cf74
pop ecx
test eax, eax
je 0x1000d483
mov dword [eax], vtable.CWeatherSA.0
jmp 0x1000d485
mov eax, ebx
push 8
mov dword [esi + 0x1c015c], eax
call fcn.1004cf74
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d4a9
mov dword [eax], vtable.CMenuManagerSA.0
mov dword [eax + 4], 0xba6748
jmp 0x1000d4ab
mov eax, ebx
push 4
mov dword [esi + 0x1c01b0], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xb
test eax, eax
je 0x1000d4cd
mov ecx, eax
call fcn.1001d3e3
jmp 0x1000d4cf
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01b4], eax
call fcn.1004cf74
pop ecx
test eax, eax
je 0x1000d4ec
mov dword [eax], vtable.CStatsSA.0
jmp 0x1000d4ee
mov eax, ebx
push 4
mov dword [esi + 0x1c01b8], eax
call fcn.1004cf74
pop ecx
test eax, eax
je 0x1000d508
mov dword [eax], vtable.CFontSA.0
jmp 0x1000d50a
mov eax, ebx
push 4
mov dword [esi + 0x1c01bc], eax
call fcn.1004cf74
pop ecx
test eax, eax
je 0x1000d524
mov dword [eax], vtable.CPathFindSA.0
jmp 0x1000d526
mov eax, ebx
push 1
mov dword [esi + 0x1c01c0], eax
call fcn.1004cf74
push 8
mov dword [esi + 0x1c01c4], eax
call fcn.1004cf74
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x1000d556
mov ecx, eax
call fcn.10019573
jmp 0x1000d558
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01c8], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xd
test eax, eax
je 0x1000d57d
mov ecx, eax
call fcn.10018799
jmp 0x1000d57f
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d0], eax
call fcn.1004cf74
pop ecx
test eax, eax
je 0x1000d59c
mov dword [eax], vtable.CCarEnterExitSA.0
jmp 0x1000d59e
mov eax, ebx
push 4
mov dword [esi + 0x1c01d4], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x1000d5c0
mov ecx, eax
call fcn.1000b4a1
jmp 0x1000d5c2
mov eax, ebx
push 0x88
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d8], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xf
test eax, eax
je 0x1000d5ea
mov ecx, eax
call fcn.1000da9a
jmp 0x1000d5ec
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0130], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x1000d612
push edi
mov ecx, eax
call fcn.10017746
jmp 0x1000d614
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c017c], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x1000d639
mov ecx, eax
call fcn.1000ee33
jmp 0x1000d63b
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0180], eax
call fcn.1004cf74
pop ecx
test eax, eax
je 0x1000d658
mov dword [eax], vtable.CEventListSA.0
jmp 0x1000d65a
mov eax, ebx
push 0xd0
mov dword [esi + 0x1c0148], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x1000d684
push 0x96c048
mov ecx, eax
call fcn.1000e9e5
jmp 0x1000d686
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0150], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x13
test eax, eax
je 0x1000d6b1
push dword [esi + 0x1c01c8]
mov ecx, eax
call fcn.1001c6f4
jmp 0x1000d6b3
mov eax, ebx
push 0xe1c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01cc], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x14
test eax, eax
je 0x1000d6db
mov ecx, eax
call fcn.10007f3e
jmp 0x1000d6dd
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0184], eax
call fcn.1004cf74
pop ecx
test eax, eax
je 0x1000d6fa
mov dword [eax], vtable.CStreamingSA.0
jmp 0x1000d6fc
mov eax, ebx
push 4
mov dword [esi + 0x1c0188], eax
call fcn.1004cf74
pop ecx
test eax, eax
je 0x1000d716
mov dword [eax], vtable.CVisibilityPluginsSA.0
jmp 0x1000d718
mov eax, ebx
push 4
mov dword [esi + 0x1c018c], eax
call fcn.1004cf74
pop ecx
test eax, eax
je 0x1000d732
mov dword [eax], vtable.CKeyGenSA.0
jmp 0x1000d734
mov eax, ebx
push 4
mov dword [esi + 0x1c0190], eax
call fcn.1004cf74
pop ecx
test eax, eax
je 0x1000d74e
mov dword [eax], vtable.CRopesSA.0
jmp 0x1000d750
mov eax, ebx
push 8
mov dword [esi + 0x1c0194], eax
call fcn.1004cf74
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d774
mov dword [eax], vtable.CFxSA.0
mov dword [eax + 4], 0xa9ae00
jmp 0x1000d776
mov eax, ebx
push 0xe0cc
mov dword [esi + 0x1c0198], eax
call fcn.1004cf74
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x1000d79b
mov ecx, eax
call fcn.100207ab
jmp 0x1000d79d
mov eax, ebx
mov dword [esi + 0x1c019c], eax
mov edi, 0xc8bf48
lea eax, [esi + 4]
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], bl
mov ebx, 0xc8aab8
mov dword [ebp - 0x10], eax
push 0xc
call fcn.1004cf74
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d7dc
lea ecx, [esi + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], ebx
mov dword [eax + 4], ecx
jmp 0x1000d7de
xor eax, eax
mov ecx, dword [ebp - 0x10]
add ebx, 0x70
inc esi
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x10], ecx
cmp ebx, edi
jl 0x1000d7bc
mov eax, dword [ebp - 0x14]
add eax, 0xc0
mov esi, eax
xor ebx, ebx
push 0xc
call fcn.1004cf74
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d81d
lea ecx, [ebx + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
jmp 0x1000d81f
xor eax, eax
mov dword [esi], eax
inc ebx
add edi, 0x70
add esi, 4
cmp ebx, 0xb
jl 0x1000d7fd
cmp edi, 0xc8cdb8
jl 0x1000d7fb
push 0xc
call fcn.1004cf74
xor ebx, ebx
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d858
mov dword [eax], vtable.CPlayerInfoSA.0
mov dword [eax + 4], 0xb7cd98
mov dword [eax + 8], ebx
jmp 0x1000d85a
mov eax, ebx
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x38]
push 9
mov dword [ebp - 0x38], ebx
push str.hovercars
mov dword [esi + 0x1c012c], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004521
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x1c]
lea edi, [esi + 0x1c01e0]
push eax
mov ecx, edi
call fcn.1000d0d1
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969152
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000d8de
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ecx
cmp eax, 0x1000
jb 0x1000d8d5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10003c68
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
push eax
push ecx
call fcn.1004cfa4
pop ecx
pop ecx
push 7
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.aircars
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004521
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000d0d1
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969160
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000d953
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000d94a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10003c68
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1004cfa4
pop ecx
pop ecx
push 0xa
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrabunny
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004521
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000d0d1
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969161
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000d9c8
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000d9bf
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10003c68
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1004cfa4
pop ecx
pop ecx
push 9
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrajump
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004521
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000d0d1
mov eax, dword [eax]
mov dword [eax + 0x28], 0x96916c
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000da3a
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x1000da31
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10003c68
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.1004cfa4
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret