Function at 0x1000ed2d
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, 0x10085b5d
call fcn.1005f0c0
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov ebx, 0xffff
push edi
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CGameSA.0
lea edi, [esi + 0x144]
mov ecx, edi
call fcn.10011574
add edi, 0x1c
sub ebx, 1
jne 0x1000ed53
lea ebx, [esi + 0x1c01e0]
mov dword [ebp - 0x18], ebx
and dword [ebx], 0
and dword [ebx + 4], 0
push ebx
call fcn.1000eb4b
pop ecx
mov dword [ebx], eax
lea eax, [ebp - 0x20]
mov dword [0x1012aa08], esi
push eax
push 0x40
push 0x4a3000
xor ebx, ebx
push 0x401000
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, esi
call fcn.1000fa36
mov edi, eax
cmp edi, 5
je 0x1000edce
cmp edi, 0xb
je 0x1000edc7
cmp edi, 0xf
je 0x1000edc0
cmp edi, 0x14
jne 0x1000edd3
call fcn.100048e4
jmp 0x1000edd3
call fcn.10012ad0
jmp 0x1000edd3
call fcn.10012a9d
jmp 0x1000edd3
call fcn.10012a6a
mov eax, ebx
lea ecx, [esi + 0x14c]
mov dword [ecx], eax
inc eax
lea ecx, [ecx + 0x1c]
cmp eax, 0xffff
jl 0x1000eddb
push 4
call fcn.1005f07a
pop ecx
test eax, eax
je 0x1000edfc
mov dword [eax], vtable.CAudioSA.0
jmp 0x1000edfe
mov eax, ebx
push 4
mov dword [esi + 0x1c01ac], eax
call fcn.1005f07a
pop ecx
test eax, eax
je 0x1000ee18
mov dword [eax], vtable.CWorldSA.0
jmp 0x1000ee1a
mov eax, ebx
push 0x13888
mov dword [esi + 0x1c0160], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1000ee3f
mov ecx, eax
call fcn.1001695e
jmp 0x1000ee41
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0128], eax
call fcn.1005f07a
pop ecx
test eax, eax
je 0x1000ee5e
mov dword [eax], vtable.CClockSA.0
jmp 0x1000ee60
mov eax, ebx
push 4
mov dword [esi + 0x1c013c], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x1000ee82
mov ecx, eax
call fcn.10019050
jmp 0x1000ee84
mov eax, ebx
push 0x14
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0134], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x1000eeae
push 0xb6f028
mov ecx, eax
call fcn.1000ba45
jmp 0x1000eeb0
mov eax, ebx
push 0x104
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0164], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x1000eed8
mov ecx, eax
call fcn.1000d11b
jmp 0x1000eeda
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0140], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x1000ef02
mov ecx, eax
call fcn.1000c33e
jmp 0x1000ef04
mov eax, ebx
push 0x9b4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0144], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x1000ef2c
mov ecx, eax
call fcn.100152ea
jmp 0x1000ef2e
mov eax, ebx
push 0xc4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c016c], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x1000ef56
mov ecx, eax
call fcn.1000e13c
jmp 0x1000ef58
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0174], eax
call fcn.1005f07a
pop ecx
test eax, eax
je 0x1000ef75
mov dword [eax], vtable.CHudSA.0
jmp 0x1000ef77
mov eax, ebx
push 0xf4
mov dword [esi + 0x1c0154], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 8
test eax, eax
je 0x1000ef9c
mov ecx, eax
call fcn.1000e410
jmp 0x1000ef9e
mov eax, ebx
push 0x84
mov byte [ebp - 4], bl
mov dword [esi + 0x1c014c], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 9
test eax, eax
je 0x1000efc6
mov ecx, eax
call fcn.100095d3
jmp 0x1000efc8
mov eax, ebx
push 0x13c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0178], eax
call fcn.1005f07a
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000eff1
push 0xb73458
mov ecx, eax
call fcn.1000f61b
jmp 0x1000eff3
mov eax, ebx
push 0x7d0
mov dword [esi + 0x1c01a0], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xa
test eax, eax
je 0x1000f018
mov ecx, eax
call fcn.1001f0bf
jmp 0x1000f01a
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01a4], eax
call fcn.1005f07a
pop ecx
test eax, eax
je 0x1000f037
mov dword [eax], vtable.CAERadioTrackManagerSA.0
jmp 0x1000f039
mov eax, ebx
push 4
mov dword [esi + 0x1c01a8], eax
call fcn.1005f07a
pop ecx
test eax, eax
je 0x1000f053
mov dword [eax], vtable.CWeatherSA.0
jmp 0x1000f055
mov eax, ebx
push 8
mov dword [esi + 0x1c015c], eax
call fcn.1005f07a
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f079
mov dword [eax], vtable.CMenuManagerSA.0
mov dword [eax + 4], 0xba6748
jmp 0x1000f07b
mov eax, ebx
push 4
mov dword [esi + 0x1c01b0], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xb
test eax, eax
je 0x1000f09d
mov ecx, eax
call fcn.1001f061
jmp 0x1000f09f
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01b4], eax
call fcn.1005f07a
pop ecx
test eax, eax
je 0x1000f0bc
mov dword [eax], vtable.CStatsSA.0
jmp 0x1000f0be
mov eax, ebx
push 4
mov dword [esi + 0x1c01b8], eax
call fcn.1005f07a
pop ecx
test eax, eax
je 0x1000f0d8
mov dword [eax], vtable.CFontSA.0
jmp 0x1000f0da
mov eax, ebx
push 4
mov dword [esi + 0x1c01bc], eax
call fcn.1005f07a
pop ecx
test eax, eax
je 0x1000f0f4
mov dword [eax], vtable.CPathFindSA.0
jmp 0x1000f0f6
mov eax, ebx
push 1
mov dword [esi + 0x1c01c0], eax
call fcn.1005f07a
push 8
mov dword [esi + 0x1c01c4], eax
call fcn.1005f07a
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x1000f126
mov ecx, eax
call fcn.1001b1f1
jmp 0x1000f128
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01c8], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xd
test eax, eax
je 0x1000f14d
mov ecx, eax
call fcn.1001a417
jmp 0x1000f14f
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d0], eax
call fcn.1005f07a
pop ecx
test eax, eax
je 0x1000f16c
mov dword [eax], vtable.CCarEnterExitSA.0
jmp 0x1000f16e
mov eax, ebx
push 4
mov dword [esi + 0x1c01d4], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x1000f190
mov ecx, eax
call fcn.1000d071
jmp 0x1000f192
mov eax, ebx
push 0x88
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01d8], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xf
test eax, eax
je 0x1000f1ba
mov ecx, eax
call fcn.1000f66a
jmp 0x1000f1bc
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0130], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x1000f1e2
push edi
mov ecx, eax
call fcn.100193c4
jmp 0x1000f1e4
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c017c], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x1000f209
mov ecx, eax
call fcn.10010a03
jmp 0x1000f20b
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0180], eax
call fcn.1005f07a
pop ecx
test eax, eax
je 0x1000f228
mov dword [eax], vtable.CEventListSA.0
jmp 0x1000f22a
mov eax, ebx
push 0xd0
mov dword [esi + 0x1c0148], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x1000f254
push 0x96c048
mov ecx, eax
call fcn.100105b5
jmp 0x1000f256
mov eax, ebx
push 8
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0150], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x13
test eax, eax
je 0x1000f281
push dword [esi + 0x1c01c8]
mov ecx, eax
call fcn.1001e372
jmp 0x1000f283
mov eax, ebx
push 0xe1c
mov byte [ebp - 4], bl
mov dword [esi + 0x1c01cc], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x14
test eax, eax
je 0x1000f2ab
mov ecx, eax
call fcn.10009adb
jmp 0x1000f2ad
mov eax, ebx
push 4
mov byte [ebp - 4], bl
mov dword [esi + 0x1c0184], eax
call fcn.1005f07a
pop ecx
test eax, eax
je 0x1000f2ca
mov dword [eax], vtable.CStreamingSA.0
jmp 0x1000f2cc
mov eax, ebx
push 4
mov dword [esi + 0x1c0188], eax
call fcn.1005f07a
pop ecx
test eax, eax
je 0x1000f2e6
mov dword [eax], vtable.CVisibilityPluginsSA.0
jmp 0x1000f2e8
mov eax, ebx
push 4
mov dword [esi + 0x1c018c], eax
call fcn.1005f07a
pop ecx
test eax, eax
je 0x1000f302
mov dword [eax], vtable.CKeyGenSA.0
jmp 0x1000f304
mov eax, ebx
push 4
mov dword [esi + 0x1c0190], eax
call fcn.1005f07a
pop ecx
test eax, eax
je 0x1000f31e
mov dword [eax], vtable.CRopesSA.0
jmp 0x1000f320
mov eax, ebx
push 8
mov dword [esi + 0x1c0194], eax
call fcn.1005f07a
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f344
mov dword [eax], vtable.CFxSA.0
mov dword [eax + 4], 0xa9ae00
jmp 0x1000f346
mov eax, ebx
push 0xe0cc
mov dword [esi + 0x1c0198], eax
call fcn.1005f07a
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x1000f36b
mov ecx, eax
call fcn.10022426
jmp 0x1000f36d
mov eax, ebx
mov dword [esi + 0x1c019c], eax
mov edi, 0xc8bf48
lea eax, [esi + 4]
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], bl
mov ebx, 0xc8aab8
mov dword [ebp - 0x10], eax
push 0xc
call fcn.1005f07a
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f3ac
lea ecx, [esi + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], ebx
mov dword [eax + 4], ecx
jmp 0x1000f3ae
xor eax, eax
mov ecx, dword [ebp - 0x10]
add ebx, 0x70
inc esi
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x10], ecx
cmp ebx, edi
jl 0x1000f38c
mov eax, dword [ebp - 0x14]
add eax, 0xc0
mov esi, eax
xor ebx, ebx
push 0xc
call fcn.1005f07a
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f3ed
lea ecx, [ebx + 0x16]
mov dword [eax], vtable.CWeaponInfoSA.0
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
jmp 0x1000f3ef
xor eax, eax
mov dword [esi], eax
inc ebx
add edi, 0x70
add esi, 4
cmp ebx, 0xb
jl 0x1000f3cd
cmp edi, 0xc8cdb8
jl 0x1000f3cb
push 0xc
call fcn.1005f07a
xor ebx, ebx
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x1000f428
mov dword [eax], vtable.CPlayerInfoSA.0
mov dword [eax + 4], 0xb7cd98
mov dword [eax + 8], ebx
jmp 0x1000f42a
mov eax, ebx
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x38]
push 9
mov dword [ebp - 0x38], ebx
push str.hovercars
mov dword [esi + 0x1c012c], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004ba8
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x1c]
lea edi, [esi + 0x1c01e0]
push eax
mov ecx, edi
call fcn.1000eca1
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969152
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f4ae
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ecx
cmp eax, 0x1000
jb 0x1000f4a5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100042ef
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
push eax
push ecx
call fcn.1005f0aa
pop ecx
pop ecx
push 7
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.aircars
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004ba8
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000eca1
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969160
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f523
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000f51a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100042ef
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1005f0aa
pop ecx
pop ecx
push 0xa
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrabunny
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004ba8
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000eca1
mov byte [ebp - 4], bl
mov eax, dword [eax]
mov dword [eax + 0x28], 0x969161
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f598
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x1000f58f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100042ef
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.1005f0aa
pop ecx
pop ecx
push 9
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
push str.extrajump
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.10004ba8
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000eca1
mov eax, dword [eax]
mov dword [eax + 0x28], 0x96916c
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1000f60a
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x1000f601
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.100042ef
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.1005f0aa
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret