Function at 0x1000ceb7
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, 0x10074c73
call fcn.100500cc
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov ebx, 0xffff
push edi
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CGameSA.0
lea edi, [esi + 0x144]
mov ecx, edi
call fcn.1000f8b7
add edi, 0x1c
sub ebx, 1
jne 0x1000cedd
lea ebx, [esi + 0x1c01e0]
mov dword [ebp - 0x18], ebx
mov ecx, ebx
and dword [ebx], 0
and dword [ebx + 4], 0
call fcn.10006a22
mov dword [ebx], eax
lea eax, [ebp - 0x20]
mov dword [0x101173d4], esi
push eax
push 0x40
push 0x4a3000
xor ebx, ebx
push 0x401000
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, esi
call fcn.1000db62
mov edi, eax
cmp edi, 5
je 0x1000cf58
cmp edi, 0xb
je 0x1000cf51
cmp edi, 0xf
je 0x1000cf4a
cmp edi, 0x14
jne 0x1000cf5d
call fcn.10004014
jmp 0x1000cf5d
call fcn.10010f41
jmp 0x1000cf5d
call fcn.10010f0e
jmp 0x1000cf5d
call fcn.10010edb
mov eax, ebx
lea ecx, [esi + 0x14c]
mov dword [ecx], eax
inc eax
lea ecx, [ecx + 0x1c]
cmp eax, 0xffff
jl 0x1000cf65
push 4
call fcn.1005008d
pop ecx
test eax, eax
je 0x1000cf86
mov dword [eax], vtable.CAudioSA.0
jmp 0x1000cf88
mov eax, ebx
push 4
mov dword [esi + 0x1c01ac], eax
call fcn.1005008d
pop ecx
test eax, eax
je 0x1000cfa2
mov dword [eax], vtable.CWorldSA.0
jmp 0x1000cfa4
mov eax, ebx
push 0x13888
mov dword [esi + 0x1c0160], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1000cfc9
mov ecx, eax
call fcn.10014d3b
jmp 0x1000cfcb
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0128], eax
call fcn.1005008d
pop ecx
test eax, eax
je 0x1000cfe8
mov dword [eax], vtable.CClockSA.0
jmp 0x1000cfea
mov eax, ebx
push 4
mov dword [esi + 0x1c013c], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x1000d00c
mov ecx, eax
call fcn.10017451
jmp 0x1000d00e
mov eax, ebx
push 0x14
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0134], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x1000d038
push 0xb6f028
mov ecx, eax
call fcn.10009a08
jmp 0x1000d03a
mov eax, ebx
push 0x104
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0164], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x1000d062
mov ecx, eax
call fcn.1000b0ac
jmp 0x1000d064
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0140], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x1000d08c
mov ecx, eax
call fcn.1000a307
jmp 0x1000d08e
mov eax, ebx
push 0x9b4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0144], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x1000d0b6
mov ecx, eax
call fcn.100136da
jmp 0x1000d0b8
mov eax, ebx
push 0xc4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c016c], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x1000d0e0
mov ecx, eax
call fcn.1000c0c5
jmp 0x1000d0e2
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0174], eax
call fcn.1005008d
pop ecx
test eax, eax
je 0x1000d0ff
mov dword [eax], vtable.CHudSA.0
jmp 0x1000d101
mov eax, ebx
push 0xf4
mov dword [esi + 0x1c0154], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 8
test eax, eax
je 0x1000d126
mov ecx, eax
call fcn.1000c399
jmp 0x1000d128
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c014c], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 9
test eax, eax
je 0x1000d150
mov ecx, eax
call fcn.100075ca
jmp 0x1000d152
mov eax, ebx
push 0x13c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0178], eax
call fcn.1005008d
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d17b
push 0xb73458
mov ecx, eax
call fcn.1000d6e0
jmp 0x1000d17d
mov eax, ebx
push 0x7d0
mov dword [esi + 0x1c01a0], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xa
test eax, eax
je 0x1000d1a2
mov ecx, eax
call fcn.1001d502
jmp 0x1000d1a4
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01a4], eax
call fcn.1005008d
pop ecx
test eax, eax
je 0x1000d1c1
mov dword [eax], vtable.CAERadioTrackManagerSA.0
jmp 0x1000d1c3
mov eax, ebx
push 4
mov dword [esi + 0x1c01a8], eax
call fcn.1005008d
pop ecx
test eax, eax
je 0x1000d1dd
mov dword [eax], vtable.CWeatherSA.0
jmp 0x1000d1df
mov eax, ebx
push 8
mov dword [esi + 0x1c015c], eax
call fcn.1005008d
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d203
mov dword [eax], vtable.CMenuManagerSA.0
mov dword [eax + 4], 0xba6748
jmp 0x1000d205
mov eax, ebx
push 4
mov dword [esi + 0x1c01b0], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xb
test eax, eax
je 0x1000d227
mov ecx, eax
call fcn.1001d4a4
jmp 0x1000d229
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01b4], eax
call fcn.1005008d
pop ecx
test eax, eax
je 0x1000d246
mov dword [eax], vtable.CStatsSA.0
jmp 0x1000d248
mov eax, ebx
push 4
mov dword [esi + 0x1c01b8], eax
call fcn.1005008d
pop ecx
test eax, eax
je 0x1000d262
mov dword [eax], vtable.CFontSA.0
jmp 0x1000d264
mov eax, ebx
push 4
mov dword [esi + 0x1c01bc], eax
call fcn.1005008d
pop ecx
test eax, eax
je 0x1000d27e
mov dword [eax], vtable.CPathFindSA.0
jmp 0x1000d280
mov eax, ebx
push 1
mov dword [esi + 0x1c01c0], eax
call fcn.1005008d
push 8
mov dword [esi + 0x1c01c4], eax
call fcn.1005008d
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x1000d2b0
mov ecx, eax
call fcn.100195ee
jmp 0x1000d2b2
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01c8], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xd
test eax, eax
je 0x1000d2d7
mov ecx, eax
call fcn.10018814
jmp 0x1000d2d9
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d0], eax
call fcn.1005008d
pop ecx
test eax, eax
je 0x1000d2f6
mov dword [eax], vtable.CCarEnterExitSA.0
jmp 0x1000d2f8
mov eax, ebx
push 4
mov dword [esi + 0x1c01d4], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x1000d31a
mov ecx, eax
call fcn.1000b002
jmp 0x1000d31c
mov eax, ebx
push 0x88
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d8], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xf
test eax, eax
je 0x1000d344
mov ecx, eax
call fcn.1000d72f
jmp 0x1000d346
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0130], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x1000d36c
push edi
mov ecx, eax
call fcn.100177ca
jmp 0x1000d36e
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c017c], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x1000d393
mov ecx, eax
call fcn.1000ed0a
jmp 0x1000d395
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0180], eax
call fcn.1005008d
pop ecx
test eax, eax
je 0x1000d3b2
mov dword [eax], vtable.CEventListSA.0
jmp 0x1000d3b4
mov eax, ebx
push 0xd0
mov dword [esi + 0x1c0148], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x1000d3de
push 0x96c048
mov ecx, eax
call fcn.1000e8bc
jmp 0x1000d3e0
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0150], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x13
test eax, eax
je 0x1000d40b
push dword [esi + 0x1c01c8]
mov ecx, eax
call fcn.1001c7b5
jmp 0x1000d40d
mov eax, ebx
push 0xe1c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01cc], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x14
test eax, eax
je 0x1000d435
mov ecx, eax
call fcn.10007a35
jmp 0x1000d437
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0184], eax
call fcn.1005008d
pop ecx
test eax, eax
je 0x1000d454
mov dword [eax], vtable.CStreamingSA.0
jmp 0x1000d456
mov eax, ebx
push 4
mov dword [esi + 0x1c0188], eax
call fcn.1005008d
pop ecx
test eax, eax
je 0x1000d470
mov dword [eax], vtable.CVisibilityPluginsSA.0
jmp 0x1000d472
mov eax, ebx
push 4
mov dword [esi + 0x1c018c], eax
call fcn.1005008d
pop ecx
test eax, eax
je 0x1000d48c
mov dword [eax], vtable.CKeyGenSA.0
jmp 0x1000d48e
mov eax, ebx
push 4
mov dword [esi + 0x1c0190], eax
call fcn.1005008d
pop ecx
test eax, eax
je 0x1000d4a8
mov dword [eax], vtable.CRopesSA.0
jmp 0x1000d4aa
mov eax, ebx
push 8
mov dword [esi + 0x1c0194], eax
call fcn.1005008d
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d4ce
mov dword [eax], vtable.CFxSA.0
mov dword [eax + 4], 0xa9ae00
jmp 0x1000d4d0
mov eax, ebx
push 0xe0cc
mov dword [esi + 0x1c0198], eax
call fcn.1005008d
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x1000d4f5
mov ecx, eax
call fcn.100209e3
jmp 0x1000d4f7
mov eax, ebx
mov dword [esi + 0x1c019c], eax
mov edi, 0xc8bf48
lea eax, [esi + 4]
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], bl
mov ebx, 0xc8aab8
mov dword [ebp - 0x10], eax
push 0xc
call fcn.1005008d
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d536
lea ecx, [esi + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], ebx
mov dword [eax + 4], ecx
jmp 0x1000d538
xor eax, eax
mov ecx, dword [ebp - 0x10]
add ebx, 0x70
inc esi
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x10], ecx
cmp ebx, edi
jl 0x1000d516
mov ebx, dword [ebp - 0x14]
add ebx, 0xc0
xor esi, esi
push 0xc
call fcn.1005008d
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d576
lea ecx, [esi + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
jmp 0x1000d578
xor eax, eax
mov dword [ebx], eax
inc esi
add edi, 0x70
add ebx, 4
cmp esi, 0xb
jl 0x1000d556
cmp edi, 0xc8cdb8
jl 0x1000d554
push 0xc
call fcn.1005008d
xor ebx, ebx
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000d5b1
mov dword [eax], vtable.CPlayerInfoSA.0
mov dword [eax + 4], 0xb7cd98
mov dword [eax + 8], ebx
jmp 0x1000d5b3
mov eax, ebx
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x38]
push 9
push str.hovercars
mov dword [ebp - 0x28], ebx
mov dword [esi + 0x1c012c], eax
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004689
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x1c]
lea edi, [esi + 0x1c01e0]
push eax
mov ecx, edi
call fcn.1000ce4a
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], bl
mov dword [eax + 0x28], 0x969152
call fcn.100041ad
push 7
push str.aircars
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004689
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000ce4a
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], bl
mov dword [eax + 0x28], 0x969160
call fcn.100041ad
push 0xa
push str.extrabunny
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004689
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000ce4a
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], bl
mov dword [eax + 0x28], 0x969161
call fcn.100041ad
push 9
push str.extrajump
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004689
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000ce4a
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x38]
mov dword [eax + 0x28], 0x96916c
call fcn.100041ad
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret