Function at 0x1000e998
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, 0x10081fa9
call fcn.1005f178
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov ebx, 0xffff
push edi
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CGameSA.0
lea edi, [esi + 0x144]
mov ecx, edi
call fcn.100111df
add edi, 0x1c
sub ebx, 1
jne 0x1000e9be
lea ebx, [esi + 0x1c01e0]
mov dword [ebp - 0x18], ebx
and dword [ebx], 0
and dword [ebx + 4], 0
push ebx
call fcn.1000e7b6
pop ecx
mov dword [ebx], eax
lea eax, [ebp - 0x20]
mov dword [0x10125a3c], esi
push eax
push 0x40
push 0x4a3000
xor ebx, ebx
push 0x401000
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, esi
call fcn.1000f6a1
mov edi, eax
cmp edi, 5
je 0x1000ea39
cmp edi, 0xb
je 0x1000ea32
cmp edi, 0xf
je 0x1000ea2b
cmp edi, 0x14
jne 0x1000ea3e
call fcn.10004f53
jmp 0x1000ea3e
call fcn.1001273b
jmp 0x1000ea3e
call fcn.10012708
jmp 0x1000ea3e
call fcn.100126d5
mov eax, ebx
lea ecx, [esi + 0x14c]
mov dword [ecx], eax
inc eax
lea ecx, [ecx + 0x1c]
cmp eax, 0xffff
jl 0x1000ea46
push 4
call fcn.1005ef2b
pop ecx
test eax, eax
je 0x1000ea67
mov dword [eax], vtable.CAudioSA.0
jmp 0x1000ea69
mov eax, ebx
push 4
mov dword [esi + 0x1c01ac], eax
call fcn.1005ef2b
pop ecx
test eax, eax
je 0x1000ea83
mov dword [eax], vtable.CWorldSA.0
jmp 0x1000ea85
mov eax, ebx
push 0x13888
mov dword [esi + 0x1c0160], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1000eaaa
mov ecx, eax
call fcn.1001651b
jmp 0x1000eaac
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0128], eax
call fcn.1005ef2b
pop ecx
test eax, eax
je 0x1000eac9
mov dword [eax], vtable.CClockSA.0
jmp 0x1000eacb
mov eax, ebx
push 4
mov dword [esi + 0x1c013c], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x1000eaed
mov ecx, eax
call fcn.10018c0d
jmp 0x1000eaef
mov eax, ebx
push 0x14
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0134], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x1000eb19
push 0xb6f028
mov ecx, eax
call fcn.1000b6e3
jmp 0x1000eb1b
mov eax, ebx
push 0x104
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0164], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x1000eb43
mov ecx, eax
call fcn.1000cd86
jmp 0x1000eb45
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0140], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x1000eb6d
mov ecx, eax
call fcn.1000bfdc
jmp 0x1000eb6f
mov eax, ebx
push 0x9b4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0144], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x1000eb97
mov ecx, eax
call fcn.10014eda
jmp 0x1000eb99
mov eax, ebx
push 0xc4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c016c], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x1000ebc1
mov ecx, eax
call fcn.1000dda7
jmp 0x1000ebc3
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0174], eax
call fcn.1005ef2b
pop ecx
test eax, eax
je 0x1000ebe0
mov dword [eax], vtable.CHudSA.0
jmp 0x1000ebe2
mov eax, ebx
push 0xf4
mov dword [esi + 0x1c0154], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 8
test eax, eax
je 0x1000ec07
mov ecx, eax
call fcn.1000e07b
jmp 0x1000ec09
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c014c], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 9
test eax, eax
je 0x1000ec31
mov ecx, eax
call fcn.1000928b
jmp 0x1000ec33
mov eax, ebx
push 0x13c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0178], eax
call fcn.1005ef2b
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000ec5c
push 0xb73458
mov ecx, eax
call fcn.1000f286
jmp 0x1000ec5e
mov eax, ebx
push 0x7d0
mov dword [esi + 0x1c01a0], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xa
test eax, eax
je 0x1000ec83
mov ecx, eax
call fcn.1001ec7c
jmp 0x1000ec85
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01a4], eax
call fcn.1005ef2b
pop ecx
test eax, eax
je 0x1000eca2
mov dword [eax], vtable.CAERadioTrackManagerSA.0
jmp 0x1000eca4
mov eax, ebx
push 4
mov dword [esi + 0x1c01a8], eax
call fcn.1005ef2b
pop ecx
test eax, eax
je 0x1000ecbe
mov dword [eax], vtable.CWeatherSA.0
jmp 0x1000ecc0
mov eax, ebx
push 8
mov dword [esi + 0x1c015c], eax
call fcn.1005ef2b
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000ece4
mov dword [eax], vtable.CMenuManagerSA.0
mov dword [eax + 4], 0xba6748
jmp 0x1000ece6
mov eax, ebx
push 4
mov dword [esi + 0x1c01b0], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xb
test eax, eax
je 0x1000ed08
mov ecx, eax
call fcn.1001ec1e
jmp 0x1000ed0a
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01b4], eax
call fcn.1005ef2b
pop ecx
test eax, eax
je 0x1000ed27
mov dword [eax], vtable.CStatsSA.0
jmp 0x1000ed29
mov eax, ebx
push 4
mov dword [esi + 0x1c01b8], eax
call fcn.1005ef2b
pop ecx
test eax, eax
je 0x1000ed43
mov dword [eax], vtable.CFontSA.0
jmp 0x1000ed45
mov eax, ebx
push 4
mov dword [esi + 0x1c01bc], eax
call fcn.1005ef2b
pop ecx
test eax, eax
je 0x1000ed5f
mov dword [eax], vtable.CPathFindSA.0
jmp 0x1000ed61
mov eax, ebx
push 1
mov dword [esi + 0x1c01c0], eax
call fcn.1005ef2b
push 8
mov dword [esi + 0x1c01c4], eax
call fcn.1005ef2b
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x1000ed91
mov ecx, eax
call fcn.1001adae
jmp 0x1000ed93
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01c8], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xd
test eax, eax
je 0x1000edb8
mov ecx, eax
call fcn.10019fd4
jmp 0x1000edba
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d0], eax
call fcn.1005ef2b
pop ecx
test eax, eax
je 0x1000edd7
mov dword [eax], vtable.CCarEnterExitSA.0
jmp 0x1000edd9
mov eax, ebx
push 4
mov dword [esi + 0x1c01d4], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x1000edfb
mov ecx, eax
call fcn.1000ccdc
jmp 0x1000edfd
mov eax, ebx
push 0x88
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d8], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xf
test eax, eax
je 0x1000ee25
mov ecx, eax
call fcn.1000f2d5
jmp 0x1000ee27
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0130], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x1000ee4d
push edi
mov ecx, eax
call fcn.10018f81
jmp 0x1000ee4f
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c017c], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x1000ee74
mov ecx, eax
call fcn.1001066e
jmp 0x1000ee76
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0180], eax
call fcn.1005ef2b
pop ecx
test eax, eax
je 0x1000ee93
mov dword [eax], vtable.CEventListSA.0
jmp 0x1000ee95
mov eax, ebx
push 0xd0
mov dword [esi + 0x1c0148], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x1000eebf
push 0x96c048
mov ecx, eax
call fcn.10010220
jmp 0x1000eec1
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0150], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x13
test eax, eax
je 0x1000eeec
push dword [esi + 0x1c01c8]
mov ecx, eax
call fcn.1001df2f
jmp 0x1000eeee
mov eax, ebx
push 0xe1c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01cc], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x14
test eax, eax
je 0x1000ef16
mov ecx, eax
call fcn.10009793
jmp 0x1000ef18
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0184], eax
call fcn.1005ef2b
pop ecx
test eax, eax
je 0x1000ef35
mov dword [eax], vtable.CStreamingSA.0
jmp 0x1000ef37
mov eax, ebx
push 4
mov dword [esi + 0x1c0188], eax
call fcn.1005ef2b
pop ecx
test eax, eax
je 0x1000ef51
mov dword [eax], vtable.CVisibilityPluginsSA.0
jmp 0x1000ef53
mov eax, ebx
push 4
mov dword [esi + 0x1c018c], eax
call fcn.1005ef2b
pop ecx
test eax, eax
je 0x1000ef6d
mov dword [eax], vtable.CKeyGenSA.0
jmp 0x1000ef6f
mov eax, ebx
push 4
mov dword [esi + 0x1c0190], eax
call fcn.1005ef2b
pop ecx
test eax, eax
je 0x1000ef89
mov dword [eax], vtable.CRopesSA.0
jmp 0x1000ef8b
mov eax, ebx
push 8
mov dword [esi + 0x1c0194], eax
call fcn.1005ef2b
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000efaf
mov dword [eax], vtable.CFxSA.0
mov dword [eax + 4], 0xa9ae00
jmp 0x1000efb1
mov eax, ebx
push 0xe0cc
mov dword [esi + 0x1c0198], eax
call fcn.1005ef2b
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x1000efd6
mov ecx, eax
call fcn.10021fe3
jmp 0x1000efd8
mov eax, ebx
mov dword [esi + 0x1c019c], eax
mov edi, 0xc8bf48
lea eax, [esi + 4]
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], bl
mov ebx, 0xc8aab8
mov dword [ebp - 0x10], eax
push 0xc
call fcn.1005ef2b
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f017
lea ecx, [esi + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], ebx
mov dword [eax + 4], ecx
jmp 0x1000f019
xor eax, eax
mov ecx, dword [ebp - 0x10]
add ebx, 0x70
inc esi
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x10], ecx
cmp ebx, edi
jl 0x1000eff7
mov eax, dword [ebp - 0x14]
add eax, 0xc0
mov esi, eax
xor ebx, ebx
push 0xc
call fcn.1005ef2b
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f058
lea ecx, [ebx + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
jmp 0x1000f05a
xor eax, eax
mov dword [esi], eax
inc ebx
add edi, 0x70
add esi, 4
cmp ebx, 0xb
jl 0x1000f038
cmp edi, 0xc8cdb8
jl 0x1000f036
push 0xc
call fcn.1005ef2b
xor ebx, ebx
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f093
mov dword [eax], vtable.CPlayerInfoSA.0
mov dword [eax + 4], 0xb7cd98
mov dword [eax + 8], ebx
jmp 0x1000f095
mov eax, ebx
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x38]
push 9
mov dword [ebp - 0x38], ebx
push str.hovercars
mov dword [esi + 0x1c012c], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10005217
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x1c]
lea edi, [esi + 0x1c01e0]
push eax
mov ecx, edi
call fcn.1000e90c
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969152
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f119
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ecx
cmp eax, 0x1000
jb 0x1000f110
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000495e
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
push eax
push ecx
call fcn.1005ef5b
pop ecx
pop ecx
push 7
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.aircars
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10005217
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000e90c
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969160
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f18e
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000f185
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1000495e
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1005ef5b
pop ecx
pop ecx
push 0xa
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrabunny
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10005217
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000e90c
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969161
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f203
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000f1fa
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1000495e
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1005ef5b
pop ecx
pop ecx
push 9
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrajump
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10005217
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000e90c
mov eax, dword [eax]
mov dword [eax + 0x28], 0x96916c
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f275
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x1000f26c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000495e
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.1005ef5b
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret