Function at 0x1000ea19
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, 0x10084af9
call fcn.1005f99c
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov ebx, 0xffff
push edi
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CGameSA.0
lea edi, [esi + 0x144]
mov ecx, edi
call fcn.10011260
add edi, 0x1c
sub ebx, 1
jne 0x1000ea3f
lea ebx, [esi + 0x1c01e0]
mov dword [ebp - 0x18], ebx
and dword [ebx], 0
and dword [ebx + 4], 0
push ebx
call fcn.1000e837
pop ecx
mov dword [ebx], eax
lea eax, [ebp - 0x20]
mov dword [0x10129a08], esi
push eax
push 0x40
push 0x4a3000
xor ebx, ebx
push 0x401000
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, esi
call fcn.1000f722
mov edi, eax
cmp edi, 5
je 0x1000eaba
cmp edi, 0xb
je 0x1000eab3
cmp edi, 0xf
je 0x1000eaac
cmp edi, 0x14
jne 0x1000eabf
call fcn.100045ca
jmp 0x1000eabf
call fcn.100127bc
jmp 0x1000eabf
call fcn.10012789
jmp 0x1000eabf
call fcn.10012756
mov eax, ebx
lea ecx, [esi + 0x14c]
mov dword [ecx], eax
inc eax
lea ecx, [ecx + 0x1c]
cmp eax, 0xffff
jl 0x1000eac7
push 4
call fcn.1005f959
pop ecx
test eax, eax
je 0x1000eae8
mov dword [eax], vtable.CAudioSA.0
jmp 0x1000eaea
mov eax, ebx
push 4
mov dword [esi + 0x1c01ac], eax
call fcn.1005f959
pop ecx
test eax, eax
je 0x1000eb04
mov dword [eax], vtable.CWorldSA.0
jmp 0x1000eb06
mov eax, ebx
push 0x13888
mov dword [esi + 0x1c0160], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1000eb2b
mov ecx, eax
call fcn.1001664a
jmp 0x1000eb2d
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0128], eax
call fcn.1005f959
pop ecx
test eax, eax
je 0x1000eb4a
mov dword [eax], vtable.CClockSA.0
jmp 0x1000eb4c
mov eax, ebx
push 4
mov dword [esi + 0x1c013c], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x1000eb6e
mov ecx, eax
call fcn.10018d3c
jmp 0x1000eb70
mov eax, ebx
push 0x14
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0134], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x1000eb9a
push 0xb6f028
mov ecx, eax
call fcn.1000b731
jmp 0x1000eb9c
mov eax, ebx
push 0x104
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0164], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x1000ebc4
mov ecx, eax
call fcn.1000ce07
jmp 0x1000ebc6
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0140], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x1000ebee
mov ecx, eax
call fcn.1000c02a
jmp 0x1000ebf0
mov eax, ebx
push 0x9b4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0144], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x1000ec18
mov ecx, eax
call fcn.10014fd6
jmp 0x1000ec1a
mov eax, ebx
push 0xc4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c016c], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x1000ec42
mov ecx, eax
call fcn.1000de28
jmp 0x1000ec44
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0174], eax
call fcn.1005f959
pop ecx
test eax, eax
je 0x1000ec61
mov dword [eax], vtable.CHudSA.0
jmp 0x1000ec63
mov eax, ebx
push 0xf4
mov dword [esi + 0x1c0154], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 8
test eax, eax
je 0x1000ec88
mov ecx, eax
call fcn.1000e0fc
jmp 0x1000ec8a
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c014c], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 9
test eax, eax
je 0x1000ecb2
mov ecx, eax
call fcn.100092bf
jmp 0x1000ecb4
mov eax, ebx
push 0x13c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0178], eax
call fcn.1005f959
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000ecdd
push 0xb73458
mov ecx, eax
call fcn.1000f307
jmp 0x1000ecdf
mov eax, ebx
push 0x7d0
mov dword [esi + 0x1c01a0], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xa
test eax, eax
je 0x1000ed04
mov ecx, eax
call fcn.1001edab
jmp 0x1000ed06
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01a4], eax
call fcn.1005f959
pop ecx
test eax, eax
je 0x1000ed23
mov dword [eax], vtable.CAERadioTrackManagerSA.0
jmp 0x1000ed25
mov eax, ebx
push 4
mov dword [esi + 0x1c01a8], eax
call fcn.1005f959
pop ecx
test eax, eax
je 0x1000ed3f
mov dword [eax], vtable.CWeatherSA.0
jmp 0x1000ed41
mov eax, ebx
push 8
mov dword [esi + 0x1c015c], eax
call fcn.1005f959
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000ed65
mov dword [eax], vtable.CMenuManagerSA.0
mov dword [eax + 4], 0xba6748
jmp 0x1000ed67
mov eax, ebx
push 4
mov dword [esi + 0x1c01b0], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xb
test eax, eax
je 0x1000ed89
mov ecx, eax
call fcn.1001ed4d
jmp 0x1000ed8b
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01b4], eax
call fcn.1005f959
pop ecx
test eax, eax
je 0x1000eda8
mov dword [eax], vtable.CStatsSA.0
jmp 0x1000edaa
mov eax, ebx
push 4
mov dword [esi + 0x1c01b8], eax
call fcn.1005f959
pop ecx
test eax, eax
je 0x1000edc4
mov dword [eax], vtable.CFontSA.0
jmp 0x1000edc6
mov eax, ebx
push 4
mov dword [esi + 0x1c01bc], eax
call fcn.1005f959
pop ecx
test eax, eax
je 0x1000ede0
mov dword [eax], vtable.CPathFindSA.0
jmp 0x1000ede2
mov eax, ebx
push 1
mov dword [esi + 0x1c01c0], eax
call fcn.1005f959
push 8
mov dword [esi + 0x1c01c4], eax
call fcn.1005f959
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x1000ee12
mov ecx, eax
call fcn.1001aedd
jmp 0x1000ee14
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01c8], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xd
test eax, eax
je 0x1000ee39
mov ecx, eax
call fcn.1001a103
jmp 0x1000ee3b
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d0], eax
call fcn.1005f959
pop ecx
test eax, eax
je 0x1000ee58
mov dword [eax], vtable.CCarEnterExitSA.0
jmp 0x1000ee5a
mov eax, ebx
push 4
mov dword [esi + 0x1c01d4], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x1000ee7c
mov ecx, eax
call fcn.1000cd5d
jmp 0x1000ee7e
mov eax, ebx
push 0x88
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d8], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xf
test eax, eax
je 0x1000eea6
mov ecx, eax
call fcn.1000f356
jmp 0x1000eea8
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0130], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x1000eece
push edi
mov ecx, eax
call fcn.100190b0
jmp 0x1000eed0
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c017c], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x1000eef5
mov ecx, eax
call fcn.100106ef
jmp 0x1000eef7
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0180], eax
call fcn.1005f959
pop ecx
test eax, eax
je 0x1000ef14
mov dword [eax], vtable.CEventListSA.0
jmp 0x1000ef16
mov eax, ebx
push 0xd0
mov dword [esi + 0x1c0148], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x1000ef40
push 0x96c048
mov ecx, eax
call fcn.100102a1
jmp 0x1000ef42
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0150], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x13
test eax, eax
je 0x1000ef6d
push dword [esi + 0x1c01c8]
mov ecx, eax
call fcn.1001e05e
jmp 0x1000ef6f
mov eax, ebx
push 0xe1c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01cc], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x14
test eax, eax
je 0x1000ef97
mov ecx, eax
call fcn.100097c7
jmp 0x1000ef99
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0184], eax
call fcn.1005f959
pop ecx
test eax, eax
je 0x1000efb6
mov dword [eax], vtable.CStreamingSA.0
jmp 0x1000efb8
mov eax, ebx
push 4
mov dword [esi + 0x1c0188], eax
call fcn.1005f959
pop ecx
test eax, eax
je 0x1000efd2
mov dword [eax], vtable.CVisibilityPluginsSA.0
jmp 0x1000efd4
mov eax, ebx
push 4
mov dword [esi + 0x1c018c], eax
call fcn.1005f959
pop ecx
test eax, eax
je 0x1000efee
mov dword [eax], vtable.CKeyGenSA.0
jmp 0x1000eff0
mov eax, ebx
push 4
mov dword [esi + 0x1c0190], eax
call fcn.1005f959
pop ecx
test eax, eax
je 0x1000f00a
mov dword [eax], vtable.CRopesSA.0
jmp 0x1000f00c
mov eax, ebx
push 8
mov dword [esi + 0x1c0194], eax
call fcn.1005f959
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f030
mov dword [eax], vtable.CFxSA.0
mov dword [eax + 4], 0xa9ae00
jmp 0x1000f032
mov eax, ebx
push 0xe0cc
mov dword [esi + 0x1c0198], eax
call fcn.1005f959
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x1000f057
mov ecx, eax
call fcn.10022112
jmp 0x1000f059
mov eax, ebx
mov dword [esi + 0x1c019c], eax
mov edi, 0xc8bf48
lea eax, [esi + 4]
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], bl
mov ebx, 0xc8aab8
mov dword [ebp - 0x10], eax
push 0xc
call fcn.1005f959
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f098
lea ecx, [esi + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], ebx
mov dword [eax + 4], ecx
jmp 0x1000f09a
xor eax, eax
mov ecx, dword [ebp - 0x10]
add ebx, 0x70
inc esi
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x10], ecx
cmp ebx, edi
jl 0x1000f078
mov eax, dword [ebp - 0x14]
add eax, 0xc0
mov esi, eax
xor ebx, ebx
push 0xc
call fcn.1005f959
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f0d9
lea ecx, [ebx + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
jmp 0x1000f0db
xor eax, eax
mov dword [esi], eax
inc ebx
add edi, 0x70
add esi, 4
cmp ebx, 0xb
jl 0x1000f0b9
cmp edi, 0xc8cdb8
jl 0x1000f0b7
push 0xc
call fcn.1005f959
xor ebx, ebx
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f114
mov dword [eax], vtable.CPlayerInfoSA.0
mov dword [eax + 4], 0xb7cd98
mov dword [eax + 8], ebx
jmp 0x1000f116
mov eax, ebx
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x38]
push 9
mov dword [ebp - 0x38], ebx
push str.hovercars
mov dword [esi + 0x1c012c], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.1000488e
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x1c]
lea edi, [esi + 0x1c01e0]
push eax
mov ecx, edi
call fcn.1000e98d
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969152
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f19a
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ecx
cmp eax, 0x1000
jb 0x1000f191
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10003fd5
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
push eax
push ecx
call fcn.1005f989
pop ecx
pop ecx
push 7
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.aircars
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.1000488e
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000e98d
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969160
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f20f
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000f206
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10003fd5
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1005f989
pop ecx
pop ecx
push 0xa
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrabunny
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.1000488e
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000e98d
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969161
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f284
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000f27b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10003fd5
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1005f989
pop ecx
pop ecx
push 9
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrajump
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.1000488e
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000e98d
mov eax, dword [eax]
mov dword [eax + 0x28], 0x96916c
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f2f6
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x1000f2ed
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10003fd5
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.1005f989
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret