Function at 0x1000d1fd
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, 0x1008349e
call fcn.1005ccdc
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov ebx, 0xffff
push edi
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CGameSA.0
lea edi, [esi + 0x144]
mov ecx, edi
call fcn.1000f9ba
add edi, 0x1c
sub ebx, 1
jne 0x1000d223
lea ebx, [esi + 0x1c01e0]
mov dword [ebp - 0x18], ebx
and dword [ebx], 0
and dword [ebx + 4], 0
push ebx
call fcn.1000d01b
pop ecx
mov dword [ebx], eax
lea eax, [ebp - 0x20]
mov dword [0x101273c8], esi
push eax
push 0x40
push 0x4a3000
xor ebx, ebx
push 0x401000
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, esi
call fcn.1000df06
mov edi, eax
cmp edi, 5
je 0x1000d29e
cmp edi, 0xb
je 0x1000d297
cmp edi, 0xf
je 0x1000d290
cmp edi, 0x14
jne 0x1000d2a3
call fcn.10004415
jmp 0x1000d2a3
call fcn.10010ec5
jmp 0x1000d2a3
call fcn.10010e92
jmp 0x1000d2a3
call fcn.10010e5f
mov eax, ebx
lea ecx, [esi + 0x14c]
mov dword [ecx], eax
inc eax
lea ecx, [ecx + 0x1c]
cmp eax, 0xffff
jl 0x1000d2ab
push 4
call fcn.1005cc97
pop ecx
test eax, eax
je 0x1000d2cc
mov dword [eax], vtable.CAudioSA.0
jmp 0x1000d2ce
mov eax, ebx
push 4
mov dword [esi + 0x1c01ac], eax
call fcn.1005cc97
pop ecx
test eax, eax
je 0x1000d2e8
mov dword [eax], vtable.CWorldSA.0
jmp 0x1000d2ea
mov eax, ebx
push 0x13888
mov dword [esi + 0x1c0160], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1000d30f
mov ecx, eax
call fcn.10014ca5
jmp 0x1000d311
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0128], eax
call fcn.1005cc97
pop ecx
test eax, eax
je 0x1000d32e
mov dword [eax], vtable.CClockSA.0
jmp 0x1000d330
mov eax, ebx
push 4
mov dword [esi + 0x1c013c], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x1000d352
mov ecx, eax
call fcn.100173b1
jmp 0x1000d354
mov eax, ebx
push 0x14
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0134], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x1000d37e
push 0xb6f028
mov ecx, eax
call fcn.10009f48
jmp 0x1000d380
mov eax, ebx
push 0x104
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0164], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x1000d3a8
mov ecx, eax
call fcn.1000b5eb
jmp 0x1000d3aa
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0140], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x1000d3d2
mov ecx, eax
call fcn.1000a841
jmp 0x1000d3d4
mov eax, ebx
push 0x9b4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0144], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x1000d3fc
mov ecx, eax
call fcn.10013664
jmp 0x1000d3fe
mov eax, ebx
push 0xc4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c016c], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x1000d426
mov ecx, eax
call fcn.1000c60c
jmp 0x1000d428
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0174], eax
call fcn.1005cc97
pop ecx
test eax, eax
je 0x1000d445
mov dword [eax], vtable.CHudSA.0
jmp 0x1000d447
mov eax, ebx
push 0xf4
mov dword [esi + 0x1c0154], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 8
test eax, eax
je 0x1000d46c
mov ecx, eax
call fcn.1000c8e0
jmp 0x1000d46e
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c014c], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 9
test eax, eax
je 0x1000d496
mov ecx, eax
call fcn.10007af0
jmp 0x1000d498
mov eax, ebx
push 0x13c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0178], eax
call fcn.1005cc97
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d4c1
push 0xb73458
mov ecx, eax
call fcn.1000daeb
jmp 0x1000d4c3
mov eax, ebx
push 0x7d0
mov dword [esi + 0x1c01a0], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xa
test eax, eax
je 0x1000d4e8
mov ecx, eax
call fcn.1001d420
jmp 0x1000d4ea
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01a4], eax
call fcn.1005cc97
pop ecx
test eax, eax
je 0x1000d507
mov dword [eax], vtable.CAERadioTrackManagerSA.0
jmp 0x1000d509
mov eax, ebx
push 4
mov dword [esi + 0x1c01a8], eax
call fcn.1005cc97
pop ecx
test eax, eax
je 0x1000d523
mov dword [eax], vtable.CWeatherSA.0
jmp 0x1000d525
mov eax, ebx
push 8
mov dword [esi + 0x1c015c], eax
call fcn.1005cc97
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d549
mov dword [eax], vtable.CMenuManagerSA.0
mov dword [eax + 4], 0xba6748
jmp 0x1000d54b
mov eax, ebx
push 4
mov dword [esi + 0x1c01b0], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xb
test eax, eax
je 0x1000d56d
mov ecx, eax
call fcn.1001d3c2
jmp 0x1000d56f
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01b4], eax
call fcn.1005cc97
pop ecx
test eax, eax
je 0x1000d58c
mov dword [eax], vtable.CStatsSA.0
jmp 0x1000d58e
mov eax, ebx
push 4
mov dword [esi + 0x1c01b8], eax
call fcn.1005cc97
pop ecx
test eax, eax
je 0x1000d5a8
mov dword [eax], vtable.CFontSA.0
jmp 0x1000d5aa
mov eax, ebx
push 4
mov dword [esi + 0x1c01bc], eax
call fcn.1005cc97
pop ecx
test eax, eax
je 0x1000d5c4
mov dword [eax], vtable.CPathFindSA.0
jmp 0x1000d5c6
mov eax, ebx
push 1
mov dword [esi + 0x1c01c0], eax
call fcn.1005cc97
push 8
mov dword [esi + 0x1c01c4], eax
call fcn.1005cc97
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x1000d5f6
mov ecx, eax
call fcn.10019552
jmp 0x1000d5f8
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01c8], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xd
test eax, eax
je 0x1000d61d
mov ecx, eax
call fcn.10018778
jmp 0x1000d61f
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d0], eax
call fcn.1005cc97
pop ecx
test eax, eax
je 0x1000d63c
mov dword [eax], vtable.CCarEnterExitSA.0
jmp 0x1000d63e
mov eax, ebx
push 4
mov dword [esi + 0x1c01d4], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x1000d660
mov ecx, eax
call fcn.1000b541
jmp 0x1000d662
mov eax, ebx
push 0x88
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d8], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xf
test eax, eax
je 0x1000d68a
mov ecx, eax
call fcn.1000db3a
jmp 0x1000d68c
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0130], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x1000d6b2
push edi
mov ecx, eax
call fcn.10017725
jmp 0x1000d6b4
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c017c], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x1000d6d9
mov ecx, eax
call fcn.1000eed3
jmp 0x1000d6db
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0180], eax
call fcn.1005cc97
pop ecx
test eax, eax
je 0x1000d6f8
mov dword [eax], vtable.CEventListSA.0
jmp 0x1000d6fa
mov eax, ebx
push 0xd0
mov dword [esi + 0x1c0148], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x1000d724
push 0x96c048
mov ecx, eax
call fcn.1000ea85
jmp 0x1000d726
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0150], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x13
test eax, eax
je 0x1000d751
push dword [esi + 0x1c01c8]
mov ecx, eax
call fcn.1001c6d3
jmp 0x1000d753
mov eax, ebx
push 0xe1c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01cc], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x14
test eax, eax
je 0x1000d77b
mov ecx, eax
call fcn.10007ff8
jmp 0x1000d77d
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0184], eax
call fcn.1005cc97
pop ecx
test eax, eax
je 0x1000d79a
mov dword [eax], vtable.CStreamingSA.0
jmp 0x1000d79c
mov eax, ebx
push 4
mov dword [esi + 0x1c0188], eax
call fcn.1005cc97
pop ecx
test eax, eax
je 0x1000d7b6
mov dword [eax], vtable.CVisibilityPluginsSA.0
jmp 0x1000d7b8
mov eax, ebx
push 4
mov dword [esi + 0x1c018c], eax
call fcn.1005cc97
pop ecx
test eax, eax
je 0x1000d7d2
mov dword [eax], vtable.CKeyGenSA.0
jmp 0x1000d7d4
mov eax, ebx
push 4
mov dword [esi + 0x1c0190], eax
call fcn.1005cc97
pop ecx
test eax, eax
je 0x1000d7ee
mov dword [eax], vtable.CRopesSA.0
jmp 0x1000d7f0
mov eax, ebx
push 8
mov dword [esi + 0x1c0194], eax
call fcn.1005cc97
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d814
mov dword [eax], vtable.CFxSA.0
mov dword [eax + 4], 0xa9ae00
jmp 0x1000d816
mov eax, ebx
push 0xe0cc
mov dword [esi + 0x1c0198], eax
call fcn.1005cc97
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x1000d83b
mov ecx, eax
call fcn.1002078a
jmp 0x1000d83d
mov eax, ebx
mov dword [esi + 0x1c019c], eax
mov edi, 0xc8bf48
lea eax, [esi + 4]
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], bl
mov ebx, 0xc8aab8
mov dword [ebp - 0x10], eax
push 0xc
call fcn.1005cc97
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d87c
lea ecx, [esi + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], ebx
mov dword [eax + 4], ecx
jmp 0x1000d87e
xor eax, eax
mov ecx, dword [ebp - 0x10]
add ebx, 0x70
inc esi
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x10], ecx
cmp ebx, edi
jl 0x1000d85c
mov eax, dword [ebp - 0x14]
add eax, 0xc0
mov esi, eax
xor ebx, ebx
push 0xc
call fcn.1005cc97
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d8bd
lea ecx, [ebx + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
jmp 0x1000d8bf
xor eax, eax
mov dword [esi], eax
inc ebx
add edi, 0x70
add esi, 4
cmp ebx, 0xb
jl 0x1000d89d
cmp edi, 0xc8cdb8
jl 0x1000d89b
push 0xc
call fcn.1005cc97
xor ebx, ebx
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d8f8
mov dword [eax], vtable.CPlayerInfoSA.0
mov dword [eax + 4], 0xb7cd98
mov dword [eax + 8], ebx
jmp 0x1000d8fa
mov eax, ebx
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x38]
push 9
mov dword [ebp - 0x38], ebx
push str.hovercars
mov dword [esi + 0x1c012c], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.100047ed
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x1c]
lea edi, [esi + 0x1c01e0]
push eax
mov ecx, edi
call fcn.1000d171
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969152
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000d97e
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ecx
cmp eax, 0x1000
jb 0x1000d975
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10003e9d
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
push eax
push ecx
call fcn.1005ccc7
pop ecx
pop ecx
push 7
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.aircars
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.100047ed
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000d171
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969160
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000d9f3
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000d9ea
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10003e9d
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1005ccc7
pop ecx
pop ecx
push 0xa
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrabunny
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.100047ed
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000d171
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969161
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000da68
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000da5f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10003e9d
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1005ccc7
pop ecx
pop ecx
push 9
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrajump
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.100047ed
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000d171
mov eax, dword [eax]
mov dword [eax + 0x28], 0x96916c
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000dada
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x1000dad1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10003e9d
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.1005ccc7
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret