joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b8670
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x100b86df
cmp dword [ecx], edi
jne 0x100b86d7
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x100b86e7
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x100b86e7
cmp dword [ecx], edi
jne 0x100b86eb
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x100b870f
push 8
push eax
call fcn.100e9b90
add esp, 8
push edi
call fcn.100e9b9e
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
ret 8

Function at 0x100b8810
Capabilities:
Hash data using fnv

Disassembly:
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [0x10154e64]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
push edi
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
mov edx, dword [0x10154e6c]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x10154e78]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [esp + 0x14]
nop dword [eax]
cmp edi, esi
jne 0x100b8878
mov ecx, esi
jmp 0x100b887d
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100b88c7
mov ecx, dword [eax + 8]
cmp ecx, dword [edx]
je 0x100b888c
mov eax, dword [eax]
jmp 0x100b8870
mov edx, dword [edx]
mov ecx, eax
mov dword [esp + 0x14], edx
cmp edi, esi
jne 0x100b889c
mov edx, esi
jmp 0x100b88a1
mov edx, dword [ebx + 4]
mov edx, dword [edx]
cmp eax, edx
je 0x100b88b2
mov edx, dword [esp + 0x14]
cmp edx, dword [eax + 8]
jne 0x100b88b2
mov eax, dword [eax]
jmp 0x100b8894
cmp ecx, eax
je 0x100b88c7
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword [edx + 4], eax
mov eax, edx
mov dword [edx], ecx
ret 8
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], esi
mov dword [eax + 4], esi
pop esi
pop ebx
ret 8
Function at 0x100b88e0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [0x10154e6c]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x10154e78]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x10154e64]
cmp edi, edx
jne 0x100b8940
mov ecx, edx
jmp 0x100b8945
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100b896a
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x100b8954
mov eax, dword [eax]
jmp 0x100b8938
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
mov ecx, dword [esp + 0x10]
pop edi
cmovne eax, edx
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], edx
ret 8
Function at 0x100b8a20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [esp + 0xc], edi
jb 0x100b8a3b
mov esi, dword [ebx]
jmp 0x100b8a3d
mov esi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x100b8a59
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100b8a48
mov ecx, dword [0x10154e58]
and ecx, edx
mov edx, dword [0x10154e4c]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov esi, dword [edx + ecx*4]
inc ecx
mov dword [esp + 0x10], esi
lea ecx, [edx + ecx*4]
mov dword [esp + 0x14], ecx
nop dword [eax + eax]
mov edx, dword [0x10154e44]
cmp esi, edx
jne 0x100b8a8e
mov ecx, edx
jmp 0x100b8a92
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100b8bd7
cmp dword [ebx + 0x14], 0x10
lea edx, [eax + 8]
jb 0x100b8aa7
mov edi, dword [ebx]
jmp 0x100b8aa9
mov edi, ebx
cmp dword [edx + 0x14], 0x10
lea ecx, [edx + 0x10]
jb 0x100b8ab4
mov edx, dword [edx]
mov ecx, dword [ecx]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xc]
mov esi, ecx
cmp dword [esp + 0x20], ecx
cmovb esi, dword [esp + 0x20]
test esi, esi
je 0x100b8b26
sub esi, 4
jb 0x100b8ae3
mov ecx, dword [edx]
cmp ecx, dword [edi]
jne 0x100b8ae8
add edx, 4
add edi, 4
sub esi, 4
jae 0x100b8ad2
cmp esi, 0xfffffffc
je 0x100b8b1c
mov cl, byte [edx]
cmp cl, byte [edi]
jne 0x100b8b15
cmp esi, 0xfffffffd
je 0x100b8b1c
mov cl, byte [edx + 1]
cmp cl, byte [edi + 1]
jne 0x100b8b15
cmp esi, 0xfffffffe
je 0x100b8b1c
mov cl, byte [edx + 2]
cmp cl, byte [edi + 2]
jne 0x100b8b15
cmp esi, 0xffffffff
je 0x100b8b1c
mov cl, byte [edx + 3]
cmp cl, byte [edi + 3]
je 0x100b8b1c
sbb ecx, ecx
or ecx, 1
jmp 0x100b8b1e
xor ecx, ecx
test ecx, ecx
jne 0x100b8b30
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x20]
cmp edx, ecx
jb 0x100b8b30
jbe 0x100b8b3f
mov eax, dword [eax]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jmp 0x100b8a80
cmp dword [eax + 0x1c], 0x10
lea edx, [eax + 8]
lea edi, [edx + 0x10]
jb 0x100b8b4d
mov edx, dword [edx]
cmp dword [ebx + 0x14], 0x10
jb 0x100b8b55
mov ebx, dword [ebx]
mov edi, dword [edi]
cmp ecx, edi
mov esi, edi
cmovb esi, ecx
test esi, esi
je 0x100b8bbb
sub esi, 4
jb 0x100b8b78
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x100b8b7d
add ebx, 4
add edx, 4
sub esi, 4
jae 0x100b8b67
cmp esi, 0xfffffffc
je 0x100b8bb1
mov cl, byte [ebx]
cmp cl, byte [edx]
jne 0x100b8baa
cmp esi, 0xfffffffd
je 0x100b8bb1
mov cl, byte [ebx + 1]
cmp cl, byte [edx + 1]
jne 0x100b8baa
cmp esi, 0xfffffffe
je 0x100b8bb1
mov cl, byte [ebx + 2]
cmp cl, byte [edx + 2]
jne 0x100b8baa
cmp esi, 0xffffffff
je 0x100b8bb1
mov cl, byte [ebx + 3]
cmp cl, byte [edx + 3]
je 0x100b8bb1
sbb ecx, ecx
or ecx, 1
jmp 0x100b8bb3
xor ecx, ecx
test ecx, ecx
jne 0x100b8bc1
mov ecx, dword [esp + 0xc]
cmp ecx, edi
jb 0x100b8bc1
jbe 0x100b8bc6
mov eax, dword [0x10154e44]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
add esp, 0xc
ret 8
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword [eax], edx
add esp, 0xc
ret 8
Function at 0x100b8dc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010f8a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], esp
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x18], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edx, [ecx*8]
mov dword [ebp + 0xc], edx
cmp eax, dword [ebx + 4]
jne 0x100b8e41
mov esi, dword [ebx + 4]
jmp 0x100b8e47
mov esi, dword [esi + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x100b8e5c
mov ecx, dword [edi]
nop dword [eax]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x100b8ea3
cmp esi, eax
jne 0x100b8e50
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x100b8e8c
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x100b8eef
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x100b8f11
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x100b8eca
push 8
push eax
call fcn.100e9b90
add esp, 8
push edi
call fcn.100e9b9e
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x100b8ef7
mov dword [ecx], edi
jmp 0x100b8f11
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x100b8f11
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.100b8f60
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100b9a30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x663974], 0
jne 0x100b9a46
cmp dword [0x638e74], 0
jne 0x100b9a84
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4f5f40
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
mov byte [0x4f5f40], 0xc3
push eax
push dword [ebp - 4]
push 1
push 0x4f5f40
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0
call dword [0x101215cc]
mov dword [0x10176040], eax
mov esp, ebp
pop ebp
ret
Function at 0x100b9aab
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [0x1013d350]
sub esp, 0x20c
push esi
mov esi, ecx
cmp eax, 0xffffffff
jne 0x100b9b3f
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0x10113558
push 3
push 0
push 0x1012e0b4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x100b9af2
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [0x1013d350], 0
jmp 0x100b9b43
mov edx, str.Error:_Video_Mixing_Renderer__VMR9__capabilities_are_required.
mov ecx, 0x10153db8
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
cmp dword [0x101553d8], 0
je 0x100b9b2b
mov edx, str.Error:_Video_Mixing_Renderer__VMR9__capabilities_are_required.
mov ecx, 0x10141e60
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
mov dword [0x1013d350], 1
xor eax, eax
pop esi
add esp, 0x20c
ret
test eax, eax
jne 0x100b9b35
mov edx, dword [0x5193cc]
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [edx + ecx]
test al, al
je 0x100b9bb7
cbw
mov word [esp + ecx*2 + 8], ax
mov al, byte [edx + ecx + 1]
test al, al
je 0x100b9bb6
cbw
mov word [esp + ecx*2 + 0xa], ax
mov al, byte [edx + ecx + 2]
test al, al
je 0x100b9bb1
cbw
mov word [esp + ecx*2 + 0xc], ax
mov al, byte [edx + ecx + 3]
test al, al
je 0x100b9bac
cbw
mov word [esp + ecx*2 + 0xe], ax
mov al, byte [edx + ecx + 4]
test al, al
je 0x100b9ba7
cbw
mov word [esp + ecx*2 + 0x10], ax
add ecx, 5
cmp ecx, 0x104
jl 0x100b9b50
jmp 0x100b9bb7
add ecx, 4
jmp 0x100b9bb7
add ecx, 3
jmp 0x100b9bb7
add ecx, 2
jmp 0x100b9bb7
inc ecx
lea edx, [ecx + 0xa]
cmp edx, 0x104
jge 0x100b9b35
movups xmm0, xmmword [str._artcuts_]
mov eax, dword [0x1012df80]
movups xmmword [esp + ecx*2 + 8], xmm0
mov dword [esp + ecx*2 + 0x18], eax
mov ax, word [0x1012df84]
mov word [esp + ecx*2 + 0x1c], ax
mov ecx, dword [esi*4 + 0x1016eba0]
sub ecx, edx
cmp edx, 0x104
jge 0x100b9b35
nop dword [eax + eax]
mov al, byte [ecx + edx]
test al, al
je 0x100b9c21
cbw
mov word [esp + edx*2 + 8], ax
inc edx
cmp edx, 0x104
jl 0x100b9c00
xor eax, eax
pop esi
add esp, 0x20c
ret
cmp edx, 0x104
jge 0x100b9b35
mov eax, dword [0x1012df88]
mov dword [esp + edx*2 + 2], eax
mov eax, dword [0x1012df8c]
mov dword [esp + edx*2 + 6], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x100b9b35
mov edx, 0x10154a7c
lea ecx, [esp + 8]
call fcn.100b96e0
test eax, eax
jne 0x100b9c76
mov ecx, 0x10154a7c
call fcn.100b9630
pop esi
add esp, 0x20c
ret
mov edx, 0x100b9a90
mov ecx, 0x44e932
call fcn.100121f0
mov edx, 0x100b9a20
mov ecx, 0x44e949
call fcn.100121f0
mov edx, 0x100b9a10
mov ecx, 0x44e937
call fcn.100121f0
mov eax, dword [0x10154a94]
push 0x1016ec28
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov dword [0x1016ec20], 1
mov eax, 1
pop esi
add esp, 0x20c
ret
Function at 0x100b9cd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x44e933
call esi
lea eax, [ebp - 4]
mov dword [0x44e933], 0x39191
push eax
push dword [ebp - 4]
push 4
push 0x44e933
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x44e938
call esi
lea eax, [ebp - 4]
mov dword [0x44e938], 0x3934c
push eax
push dword [ebp - 4]
push 4
push 0x44e938
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x44e94a
call esi
lea eax, [ebp - 4]
mov dword [0x44e94a], 0x7a22a
push eax
push dword [ebp - 4]
push 4
push 0x44e94a
call esi
cmp dword [0x663974], 0
jne 0x100b9d68
cmp dword [0x638e74], 0
jne 0x100b9da8
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4f5f40
call esi
lea eax, [ebp - 4]
mov byte [0x4f5f40], 0x53
push eax
push dword [ebp - 4]
push 1
push 0x4f5f40
call esi
mov eax, dword [0x10176040]
test eax, eax
je 0x100b9da8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call dword [0x101215cc]
mov dword [0x10176040], eax
mov ecx, 0x10154a7c
mov dword [0x1016ec20], 0
call fcn.100b9630
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100b9e70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ea78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push str.SkipOpeningMovies
mov edx, str.Misc
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x100b9eea
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x100b9ee6
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
xor esi, esi
jmp 0x100b9f1d
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov esi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x100b9f18
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x100b9f55
cmp eax, 1
je 0x100b9f55
push str..ddraw.ini
push 0
mov edx, str.SkipOpeningMovies
mov ecx, str.Misc
call fcn.10005480
mov esi, eax
mov dword [0x1016ec30], esi
test esi, esi
je 0x100b9ff2
cmp byte [0x10174f84], 0
je 0x100b9fb4
test byte [0x10174f88], 1
je 0x100b9fb4
mov edx, str.Skipping_opening_movies.
mov ecx, 0x10153db8
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
cmp dword [0x101553d8], 0
je 0x100b9fae
mov edx, str.Skipping_opening_movies.
mov ecx, 0x10141e60
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
mov esi, dword [0x1016ec30]
cmp esi, 1
je 0x100b9ff2
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x4426a1
call esi
lea eax, [ebp - 0x10]
mov dword [0x4426a1], 0x441f0f
push eax
push dword [ebp - 0x10]
push 4
push 0x4426a1
call esi
mov dword [0x1016ec30], 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100ba090
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ea78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push str.AllowDShowMovies
mov edx, str.Graphics
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x100ba10a
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x100ba106
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
xor esi, esi
jmp 0x100ba13d
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov esi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x100ba138
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x100ba175
cmp eax, 1
je 0x100ba175
push str..ddraw.ini
push 0
mov edx, str.AllowDShowMovies
mov ecx, str.Graphics
call fcn.10005480
mov esi, eax
test esi, esi
jle 0x100ba201
lea eax, [ebp - 0x10]
cmp esi, 2
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 5
push 0x44e690
setge byte [0x10175332]
call esi
mov eax, 0x100b9dd0
mov byte [0x44e690], 0xe9
sub eax, 0x44e695
mov dword [0x44e691], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 5
push 0x44e690
call esi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x44e994
call esi
mov eax, 0x100b9e10
sub eax, 0x44e998
mov dword [0x44e994], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 4
push 0x44e994
call esi
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
xor al, al
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100ba700
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x104
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov edx, edi
push str.._sfall.ini
mov dword [esp + 0x10], ecx
mov ecx, str.Misc
push esi
call fcn.10005480
cmp byte [0x10153f67], 0
mov ebx, eax
je 0x100ba753
cmp dword [0x10154e3c], 1
je 0x100ba753
push str..ddraw.ini
push esi
mov edx, edi
mov ecx, str.Misc
call fcn.10005480
mov ebx, eax
cmp ebx, esi
je 0x100ba7ee
cmp ebx, dword [ebp + 0x18]
lea eax, [esp + 0x10]
cmova ebx, dword [ebp + 0x18]
push ebx
push edi
push str.Applying_patch:__s___d.
push 0xffffffffffffffff
push 0xff
push eax
call fcn.10013410
add esp, 0x18
cmp byte [0x10174f84], 0
je 0x100ba7c6
test byte [0x10174f88], 1
je 0x100ba7c6
lea edx, [esp + 0x10]
mov ecx, 0x10153db8
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
cmp dword [0x101553d8], 0
je 0x100ba7c6
lea edx, [esp + 0x10]
mov ecx, 0x10141e60
call fcn.10012ce0
push eax
call fcn.10012f80
add esp, 4
mov edi, dword [esp + 0xc]
lea eax, [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
mov edi, dword [edi]
push 4
push edi
call esi
lea eax, [esp + 0xc]
mov dword [edi], ebx
push eax
push dword [esp + 0x10]
push 4
push edi
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100bc160
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010e6f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, 0x51
mov byte [0x1016eb0e], 1
push esi
mov word [0x518d32], ax
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x34], 0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
push str.SmartBehavior
mov edx, str.CombatAI
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x100bc1ef
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x100bc1e8
mov ecx, dword [ebp - 0x34]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
mov esi, 1
jmp 0x100bc225
cmp dword [ebp - 0x20], 0x10
lea ecx, [ebp - 0x34]
mov edx, 1
cmovae ecx, dword [ebp - 0x34]
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov esi, eax
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x100bc220
mov ecx, dword [ebp - 0x34]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
je 0x100bc25d
cmp eax, 1
je 0x100bc25d
push str..ddraw.ini
push 1
mov edx, str.SmartBehavior
mov ecx, str.CombatAI
call fcn.10005480
mov esi, eax
test esi, esi
jg 0x100bc295
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x42b236
call esi
mov eax, 0x100bc140
sub eax, 0x42b23a
mov dword [0x42b236], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 4
push 0x42b236
call esi
sub esp, 0x28
mov ecx, 0x10154e24
mov eax, esp
mov dword [eax], 0x1012e13c
mov dword [eax + 0x24], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1001d210
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x100bc2e6
push dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
push ecx
call fcn.1000fa00
mov edx, dword [ebp - 0x14]
mov eax, 0x66666667
mov ecx, dword [ebp - 0x1c]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100be030
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x40
push 4
push 0x43d128
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x100bd5a0
sub eax, 0x43d12c
mov dword [0x43d128], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 4
push 0x43d128
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
mov dword [esp], 0x43d25e
lea ecx, [esp]
mov dword [esp + 4], 0x43d275
push eax
push ecx
mov ecx, 0x100bd5c0
call fcn.100122b0
lea eax, [esp + 4]
mov dword [esp], 0x43d17d
lea ecx, [esp]
push eax
push ecx
mov ecx, 0x100bd5e0
call fcn.100122b0
add esp, 0xc
ret
Function at 0x100bf0e0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [0x10154f90]
mov eax, 0x77975b9
sub edx, dword [0x10154f8c]
imul edx
push ebx
push esi
push edi
sar edx, 5
mov edi, ecx
mov eax, edx
shr eax, 0x1f
push edi
add eax, edx
push 1
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 4
push eax
call fcn.100f5fe9
xor ebx, ebx
add esp, 0x10
cmp dword [esp + 0xc], ebx
jbe 0x100bf148
xor esi, esi
mov eax, dword [0x10154f8c]
push edi
push 1
add eax, esi
push 0x448
push eax
call fcn.100f5fe9
inc ebx
add esp, 0x10
add esi, 0x448
cmp ebx, dword [esp + 0xc]
jb 0x100bf123
mov ecx, dword [0x10154f9c]
mov eax, 0x77975b9
sub ecx, dword [0x10154f98]
imul ecx
push edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push 1
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 4
push eax
call fcn.100f5fe9
xor ebx, ebx
add esp, 0x10
cmp dword [esp + 0xc], ebx
jbe 0x100bf1aa
xor esi, esi
mov eax, dword [0x10154f98]
push edi
push 1
add eax, esi
push 0x448
push eax
call fcn.100f5fe9
inc ebx
add esp, 0x10
add esi, 0x448
cmp ebx, dword [esp + 0xc]
jb 0x100bf185
mov ecx, dword [0x10154fa8]
mov eax, 0x77975b9
sub ecx, dword [0x10154fa4]
imul ecx
push edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push 1
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 4
push eax
call fcn.100f5fe9
xor ebx, ebx
add esp, 0x10
cmp dword [esp + 0xc], ebx
jbe 0x100bf20c
xor esi, esi
mov eax, dword [0x10154fa4]
push edi
push 1
add eax, esi
push 0x448
push eax
call fcn.100f5fe9
inc ebx
add esp, 0x10
add esi, 0x448
cmp ebx, dword [esp + 0xc]
jb 0x100bf1e7
pop edi
pop esi
pop ebx
pop ecx
ret