Function at 0x1000c72b
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, 0x10074991
call fcn.1004e6c4
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov ebx, 0xffff
push edi
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CGameSA.0
lea edi, [esi + 0x144]
mov ecx, edi
call fcn.1000ef72
add edi, 0x1c
sub ebx, 1
jne 0x1000c751
lea ebx, [esi + 0x1c01e0]
mov dword [ebp - 0x18], ebx
and dword [ebx], 0
and dword [ebx + 4], 0
push ebx
call fcn.1000c549
pop ecx
mov dword [ebx], eax
lea eax, [ebp - 0x20]
mov dword [0x10116448], esi
push eax
push 0x40
push 0x4a3000
xor ebx, ebx
push 0x401000
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, esi
call fcn.1000d434
mov edi, eax
cmp edi, 5
je 0x1000c7cc
cmp edi, 0xb
je 0x1000c7c5
cmp edi, 0xf
je 0x1000c7be
cmp edi, 0x14
jne 0x1000c7d1
call fcn.1000453f
jmp 0x1000c7d1
call fcn.100104ce
jmp 0x1000c7d1
call fcn.1001049b
jmp 0x1000c7d1
call fcn.10010468
mov eax, ebx
lea ecx, [esi + 0x14c]
mov dword [ecx], eax
inc eax
lea ecx, [ecx + 0x1c]
cmp eax, 0xffff
jl 0x1000c7d9
push 4
call fcn.1004e6e3
pop ecx
test eax, eax
je 0x1000c7fa
mov dword [eax], vtable.CAudioSA.0
jmp 0x1000c7fc
mov eax, ebx
push 4
mov dword [esi + 0x1c01ac], eax
call fcn.1004e6e3
pop ecx
test eax, eax
je 0x1000c816
mov dword [eax], vtable.CWorldSA.0
jmp 0x1000c818
mov eax, ebx
push 0x13888
mov dword [esi + 0x1c0160], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1000c83d
mov ecx, eax
call fcn.100142ae
jmp 0x1000c83f
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0128], eax
call fcn.1004e6e3
pop ecx
test eax, eax
je 0x1000c85c
mov dword [eax], vtable.CClockSA.0
jmp 0x1000c85e
mov eax, ebx
push 4
mov dword [esi + 0x1c013c], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x1000c880
mov ecx, eax
call fcn.100169a0
jmp 0x1000c882
mov eax, ebx
push 0x14
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0134], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x1000c8ac
push 0xb6f028
mov ecx, eax
call fcn.10009476
jmp 0x1000c8ae
mov eax, ebx
push 0x104
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0164], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x1000c8d6
mov ecx, eax
call fcn.1000ab19
jmp 0x1000c8d8
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0140], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x1000c900
mov ecx, eax
call fcn.10009d6f
jmp 0x1000c902
mov eax, ebx
push 0x9b4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0144], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x1000c92a
mov ecx, eax
call fcn.10012c6d
jmp 0x1000c92c
mov eax, ebx
push 0xc4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c016c], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x1000c954
mov ecx, eax
call fcn.1000bb3a
jmp 0x1000c956
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0174], eax
call fcn.1004e6e3
pop ecx
test eax, eax
je 0x1000c973
mov dword [eax], vtable.CHudSA.0
jmp 0x1000c975
mov eax, ebx
push 0xf4
mov dword [esi + 0x1c0154], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 8
test eax, eax
je 0x1000c99a
mov ecx, eax
call fcn.1000be0e
jmp 0x1000c99c
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c014c], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 9
test eax, eax
je 0x1000c9c4
mov ecx, eax
call fcn.10007004
jmp 0x1000c9c6
mov eax, ebx
push 0x13c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0178], eax
call fcn.1004e6e3
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000c9ef
push 0xb73458
mov ecx, eax
call fcn.1000d019
jmp 0x1000c9f1
mov eax, ebx
push 0x7d0
mov dword [esi + 0x1c01a0], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xa
test eax, eax
je 0x1000ca16
mov ecx, eax
call fcn.1001ca0f
jmp 0x1000ca18
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01a4], eax
call fcn.1004e6e3
pop ecx
test eax, eax
je 0x1000ca35
mov dword [eax], vtable.CAERadioTrackManagerSA.0
jmp 0x1000ca37
mov eax, ebx
push 4
mov dword [esi + 0x1c01a8], eax
call fcn.1004e6e3
pop ecx
test eax, eax
je 0x1000ca51
mov dword [eax], vtable.CWeatherSA.0
jmp 0x1000ca53
mov eax, ebx
push 8
mov dword [esi + 0x1c015c], eax
call fcn.1004e6e3
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000ca77
mov dword [eax], vtable.CMenuManagerSA.0
mov dword [eax + 4], 0xba6748
jmp 0x1000ca79
mov eax, ebx
push 4
mov dword [esi + 0x1c01b0], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xb
test eax, eax
je 0x1000ca9b
mov ecx, eax
call fcn.1001c9b1
jmp 0x1000ca9d
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01b4], eax
call fcn.1004e6e3
pop ecx
test eax, eax
je 0x1000caba
mov dword [eax], vtable.CStatsSA.0
jmp 0x1000cabc
mov eax, ebx
push 4
mov dword [esi + 0x1c01b8], eax
call fcn.1004e6e3
pop ecx
test eax, eax
je 0x1000cad6
mov dword [eax], vtable.CFontSA.0
jmp 0x1000cad8
mov eax, ebx
push 4
mov dword [esi + 0x1c01bc], eax
call fcn.1004e6e3
pop ecx
test eax, eax
je 0x1000caf2
mov dword [eax], vtable.CPathFindSA.0
jmp 0x1000caf4
mov eax, ebx
push 1
mov dword [esi + 0x1c01c0], eax
call fcn.1004e6e3
push 8
mov dword [esi + 0x1c01c4], eax
call fcn.1004e6e3
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x1000cb24
mov ecx, eax
call fcn.10018b41
jmp 0x1000cb26
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01c8], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xd
test eax, eax
je 0x1000cb4b
mov ecx, eax
call fcn.10017d67
jmp 0x1000cb4d
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d0], eax
call fcn.1004e6e3
pop ecx
test eax, eax
je 0x1000cb6a
mov dword [eax], vtable.CCarEnterExitSA.0
jmp 0x1000cb6c
mov eax, ebx
push 4
mov dword [esi + 0x1c01d4], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x1000cb8e
mov ecx, eax
call fcn.1000aa6f
jmp 0x1000cb90
mov eax, ebx
push 0x88
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d8], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xf
test eax, eax
je 0x1000cbb8
mov ecx, eax
call fcn.1000d068
jmp 0x1000cbba
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0130], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x1000cbe0
push edi
mov ecx, eax
call fcn.10016d14
jmp 0x1000cbe2
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c017c], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x1000cc07
mov ecx, eax
call fcn.1000e401
jmp 0x1000cc09
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0180], eax
call fcn.1004e6e3
pop ecx
test eax, eax
je 0x1000cc26
mov dword [eax], vtable.CEventListSA.0
jmp 0x1000cc28
mov eax, ebx
push 0xd0
mov dword [esi + 0x1c0148], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x1000cc52
push 0x96c048
mov ecx, eax
call fcn.1000dfb3
jmp 0x1000cc54
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0150], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x13
test eax, eax
je 0x1000cc7f
push dword [esi + 0x1c01c8]
mov ecx, eax
call fcn.1001bcc2
jmp 0x1000cc81
mov eax, ebx
push 0xe1c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01cc], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x14
test eax, eax
je 0x1000cca9
mov ecx, eax
call fcn.1000750c
jmp 0x1000ccab
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0184], eax
call fcn.1004e6e3
pop ecx
test eax, eax
je 0x1000ccc8
mov dword [eax], vtable.CStreamingSA.0
jmp 0x1000ccca
mov eax, ebx
push 4
mov dword [esi + 0x1c0188], eax
call fcn.1004e6e3
pop ecx
test eax, eax
je 0x1000cce4
mov dword [eax], vtable.CVisibilityPluginsSA.0
jmp 0x1000cce6
mov eax, ebx
push 4
mov dword [esi + 0x1c018c], eax
call fcn.1004e6e3
pop ecx
test eax, eax
je 0x1000cd00
mov dword [eax], vtable.CKeyGenSA.0
jmp 0x1000cd02
mov eax, ebx
push 4
mov dword [esi + 0x1c0190], eax
call fcn.1004e6e3
pop ecx
test eax, eax
je 0x1000cd1c
mov dword [eax], vtable.CRopesSA.0
jmp 0x1000cd1e
mov eax, ebx
push 8
mov dword [esi + 0x1c0194], eax
call fcn.1004e6e3
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000cd42
mov dword [eax], vtable.CFxSA.0
mov dword [eax + 4], 0xa9ae00
jmp 0x1000cd44
mov eax, ebx
push 0xe0cc
mov dword [esi + 0x1c0198], eax
call fcn.1004e6e3
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x1000cd69
mov ecx, eax
call fcn.1001fd79
jmp 0x1000cd6b
mov eax, ebx
mov dword [esi + 0x1c019c], eax
mov edi, 0xc8bf48
lea eax, [esi + 4]
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], bl
mov ebx, 0xc8aab8
mov dword [ebp - 0x10], eax
push 0xc
call fcn.1004e6e3
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000cdaa
lea ecx, [esi + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], ebx
mov dword [eax + 4], ecx
jmp 0x1000cdac
xor eax, eax
mov ecx, dword [ebp - 0x10]
add ebx, 0x70
inc esi
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x10], ecx
cmp ebx, edi
jl 0x1000cd8a
mov eax, dword [ebp - 0x14]
add eax, 0xc0
mov esi, eax
xor ebx, ebx
push 0xc
call fcn.1004e6e3
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000cdeb
lea ecx, [ebx + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
jmp 0x1000cded
xor eax, eax
mov dword [esi], eax
inc ebx
add edi, 0x70
add esi, 4
cmp ebx, 0xb
jl 0x1000cdcb
cmp edi, 0xc8cdb8
jl 0x1000cdc9
push 0xc
call fcn.1004e6e3
xor ebx, ebx
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000ce26
mov dword [eax], vtable.CPlayerInfoSA.0
mov dword [eax + 4], 0xb7cd98
mov dword [eax + 8], ebx
jmp 0x1000ce28
mov eax, ebx
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x38]
push 9
mov dword [ebp - 0x38], ebx
push str.hovercars
mov dword [esi + 0x1c012c], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004803
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x1c]
lea edi, [esi + 0x1c01e0]
push eax
mov ecx, edi
call fcn.1000c69f
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969152
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000ceac
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ecx
cmp eax, 0x1000
jb 0x1000cea3
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10003f4a
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
push eax
push ecx
call fcn.1004e713
pop ecx
pop ecx
push 7
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.aircars
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004803
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000c69f
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969160
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000cf21
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000cf18
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10003f4a
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1004e713
pop ecx
pop ecx
push 0xa
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrabunny
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004803
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000c69f
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969161
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000cf96
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000cf8d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10003f4a
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1004e713
pop ecx
pop ecx
push 9
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrajump
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004803
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000c69f
mov eax, dword [eax]
mov dword [eax + 0x28], 0x96916c
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000d008
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x1000cfff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10003f4a
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.1004e713
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret