joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006ffa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push 0
mov edx, str.DeathScreenFontPatch
mov ecx, str.Misc
call fcn.1000dcb0
test eax, eax
mov edx, str.SpecialDeathGVAR
push 0x1eb
mov ecx, str.Misc
setne byte [0x10175031]
call fcn.1000dcb0
mov dword [0x1013ced8], eax
lea eax, [esp]
push eax
push 0x40
push 5
push 0x440bd0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x1006ff90
mov byte [0x440bd0], 0xe9
sub eax, 0x440bd5
mov dword [0x440bd1], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x440bd0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x10070d80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4bc6f0
call esi
mov eax, 0x10070d60
mov byte [0x4bc6f0], 0xe9
sub eax, 0x4bc6f5
mov dword [0x4bc6f1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4bc6f0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x447fa0
call esi
mov eax, 0x10070d70
mov byte [0x447fa0], 0xe9
sub eax, 0x447fa5
mov dword [0x447fa1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x447fa0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x43186c
call esi
mov eax, 0x10070ce0
mov byte [0x43186c], 0xe9
sub eax, 0x431871
mov dword [0x43186d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x43186c
call esi
pop esi
pop ecx
ret

Function at 0x10071430
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push 0
mov edx, str.DisableSpecialMapIDs
mov ecx, str.Misc
call fcn.1000dcb0
test eax, eax
je 0x100714a5
cmp byte [0x10174f84], 0
je 0x10071491
test byte [0x10174f88], 1
je 0x10071491
mov edx, str.Applying_disable_handling_special_maps_patch.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x10071491
mov edx, str.Applying_disable_handling_special_maps_patch.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
mov dword [0x1013cee0], 0xffffffff
mov dword [0x1013cedc], 0xffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48411c
call esi
mov eax, 0x10071410
mov byte [0x48411c], 0xe9
sub eax, 0x484121
mov dword [0x48411d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48411c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x482158
call esi
mov eax, 0x10071420
mov byte [0x482158], 0xe9
sub eax, 0x48215d
mov dword [0x482159], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x482158
call esi
pop esi
pop ecx
ret
Function at 0x10071f90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x415efc
call esi
mov eax, 0x10071f60
mov byte [0x415efc], 0xe9
sub eax, 0x415f01
mov dword [0x415efd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x415efc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4163c8
call esi
mov eax, 0x10071f80
mov byte [0x4163c8], 0xe9
sub eax, 0x4163cd
mov dword [0x4163c9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4163c8
call esi
mov eax, dword [0x10153db4]
sub eax, dword [0x10153dac]
sar eax, 4
pop esi
cmp eax, 0x9c40
jae 0x10072028
push 0x9c40
call fcn.10072130
push dword [0x1013cee4]
call fcn.10072040
pop ecx
ret

Function at 0x10072c90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49d4d4
call esi
mov eax, 0x10072c50
mov byte [0x49d4d4], 0xe9
sub eax, 0x49d4d9
mov dword [0x49d4d5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49d4d4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x44cec4
call esi
mov eax, 0x10072c60
mov byte [0x44cec4], 0xe9
sub eax, 0x44cec9
mov dword [0x44cec5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x44cec4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48a568
call esi
mov eax, 0x10072c70
mov byte [0x48a568], 0xe9
sub eax, 0x48a56d
mov dword [0x48a569], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48a568
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48d8e8
call esi
mov eax, 0x10072c80
mov byte [0x48d8e8], 0xe9
sub eax, 0x48d8ed
mov dword [0x48d8e9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48d8e8
call esi
pop esi
pop ecx
ret

Function at 0x100730b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b1754
call esi
mov eax, 0x10073080
mov byte [0x4b1754], 0xe9
sub eax, 0x4b1759
mov dword [0x4b1755], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b1754
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b185c
call esi
mov eax, 0x10073090
mov byte [0x4b185c], 0xe9
sub eax, 0x4b1861
mov dword [0x4b185d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b185c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b1a6c
call esi
mov eax, 0x100730a0
mov byte [0x4b1a6c], 0xe9
sub eax, 0x4b1a71
mov dword [0x4b1a6d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b1a6c
call esi
pop esi
pop ecx
ret
Function at 0x10073e30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.10071430
call fcn.10072c90
call fcn.100730b0
call fcn.10071f90
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48b848
call esi
mov eax, 0x10073e00
mov byte [0x48b848], 0xe9
sub eax, 0x48b84d
mov dword [0x48b849], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48b848
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48b930
call esi
mov eax, 0x10073e10
mov byte [0x48b930], 0xe9
sub eax, 0x48b935
mov dword [0x48b931], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48b930
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b1b84
call esi
mov eax, 0x10073e20
mov byte [0x4b1b84], 0xe9
sub eax, 0x4b1b89
mov dword [0x4b1b85], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b1b84
call esi
pop esi
pop ecx
ret

Function at 0x100741c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.10074110
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a3338
call esi
mov eax, 0x10074180
mov byte [0x4a3338], 0xe9
sub eax, 0x4a333d
mov dword [0x4a3339], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a3338
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a34cc
call esi
mov eax, 0x10074190
mov byte [0x4a34cc], 0xe9
sub eax, 0x4a34d1
mov dword [0x4a34cd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a34cc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a3518
call esi
mov eax, 0x100741a0
mov byte [0x4a3518], 0xe9
sub eax, 0x4a351d
mov dword [0x4a3519], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a3518
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a347c
call esi
mov eax, 0x100741b0
mov byte [0x4a347c], 0xe9
sub eax, 0x4a3481
mov dword [0x4a347d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a347c
call esi
pop esi
pop ecx
ret

Function at 0x10074590
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.100741c0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a3d84
call esi
mov eax, 0x10074560
mov byte [0x4a3d84], 0xe9
sub eax, 0x4a3d89
mov dword [0x4a3d85], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a3d84
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a2834
call esi
mov eax, 0x10074570
mov byte [0x4a2834], 0xe9
sub eax, 0x4a2839
mov dword [0x4a2835], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a2834
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a3620
call esi
mov eax, 0x10074580
mov byte [0x4a3620], 0xe9
sub eax, 0x4a3625
mov dword [0x4a3621], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a3620
call esi
pop esi
pop ecx
ret
Function at 0x100751d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
movaps xmm0, xmmword [0x101329d0]
lea eax, [esp]
push eax
push 0x40
push 5
push 0x4d9808
movups xmmword [0x10142cb8], xmm0
mov dword [0x10142cc8], 0x7feb
mov dword [0x10142ccc], 0x7c00
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x100751c0
mov byte [0x4d9808], 0xe9
sub eax, 0x4d980d
mov dword [0x4d9809], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x4d9808
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x10075d00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.100751d0
call fcn.10076360
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d6dac
call esi
mov eax, 0x10075ca0
mov byte [0x4d6dac], 0xe9
sub eax, 0x4d6db1
mov dword [0x4d6dad], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d6dac
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d6e64
call esi
mov eax, 0x10075cb0
mov byte [0x4d6e64], 0xe9
sub eax, 0x4d6e69
mov dword [0x4d6e65], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d6e64
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d6ea0
call esi
mov eax, 0x10075cc0
mov byte [0x4d6ea0], 0xe9
sub eax, 0x4d6ea5
mov dword [0x4d6ea1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d6ea0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d765c
call esi
mov eax, 0x10075cd0
mov byte [0x4d765c], 0xe9
sub eax, 0x4d7661
mov dword [0x4d765d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d765c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d6238
call esi
mov eax, 0x10075ce0
mov byte [0x4d6238], 0xe9
sub eax, 0x4d623d
mov dword [0x4d6239], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d6238
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d6468
call esi
mov eax, 0x10075cf0
mov byte [0x4d6468], 0xe9
sub eax, 0x4d646d
mov dword [0x4d6469], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d6468
call esi
pop esi
pop ecx
ret
Function at 0x10076360
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b6a54
call esi
mov eax, 0x10077310
mov byte [0x4b6a54], 0xe9
sub eax, 0x4b6a59
mov dword [0x4b6a55], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b6a54
call esi
sub esp, 0x28
mov ecx, 0x100762c0
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x100763c7
mov dword [eax], 0x101218c8
mov dword [eax + 4], 0x100762c0
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
mov ecx, 0x10154dd0
push eax
call fcn.1001d220
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x10076410
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b7f3c
call esi
mov eax, 0x10076310
mov byte [0x4b7f3c], 0xe9
sub eax, 0x4b7f41
mov dword [0x4b7f3d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b7f3c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b78a4
call esi
mov eax, 0x10076320
mov byte [0x4b78a4], 0xe9
sub eax, 0x4b78a9
mov dword [0x4b78a5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b78a4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b81c4
call esi
mov eax, 0x10076330
mov byte [0x4b81c4], 0xe9
sub eax, 0x4b81c9
mov dword [0x4b81c5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b81c4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b8330
call esi
mov eax, 0x10076340
mov byte [0x4b8330], 0xe9
sub eax, 0x4b8335
mov dword [0x4b8331], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b8330
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b83d4
call esi
mov eax, 0x10076350
mov byte [0x4b83d4], 0xe9
sub eax, 0x4b83d9
mov dword [0x4b83d5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b83d4
call esi
pop esi
add esp, 0x10
ret

Function at 0x10076810
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d78cc
call esi
mov eax, 0x10076770
mov byte [0x4d78cc], 0xe9
sub eax, 0x4d78d1
mov dword [0x4d78cd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d78cc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d797c
call esi
mov eax, 0x100767f0
mov byte [0x4d797c], 0xe9
sub eax, 0x4d7981
mov dword [0x4d797d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d797c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4d650c
call esi
mov eax, 0x10076800
mov byte [0x4d650c], 0xe9
sub eax, 0x4d6511
mov dword [0x4d650d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4d650c
call esi
pop esi
pop ecx
ret
Function at 0x100786a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.100798f0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c1a64
call esi
mov eax, 0x10077e90
mov byte [0x4c1a64], 0xe9
sub eax, 0x4c1a69
mov dword [0x4c1a65], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c1a64
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4bfb08
call esi
mov eax, 0x10078670
mov byte [0x4bfb08], 0xe9
sub eax, 0x4bfb0d
mov dword [0x4bfb09], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4bfb08
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c59a4
call esi
mov eax, 0x10078680
mov byte [0x4c59a4], 0xe9
sub eax, 0x4c59a9
mov dword [0x4c59a5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c59a4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4c4634
call esi
mov eax, 0x10078690
mov byte [0x4c4634], 0xe9
sub eax, 0x4c4639
mov dword [0x4c4635], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4c4634
call esi
pop esi
pop ecx
ret
Function at 0x100798f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ea88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
call fcn.1005f530
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push str.TownMapHotkeys
mov edx, str.Debugging
mov ecx, str..ddraw.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x10079968
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1007999a
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
jmp 0x1007999a
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov esi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x10079996
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
test esi, esi
jne 0x100799ec
cmp byte [0x10174f84], 0
je 0x100799e5
test byte [0x10174f88], 0x10
je 0x100799e5
mov edx, str.Applying_town_map_hotkeys_fix_patch.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x100799e5
mov edx, str.Applying_town_map_hotkeys_fix_patch.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
mov byte [0x1017503d], 1
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push 0x4c1e54
call esi
mov eax, 0x100798d0
mov byte [0x4c1e54], 0xe9
sub eax, 0x4c1e59
mov dword [0x4c1e55], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 5
push 0x4c1e54
call esi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push 0x4bfe10
call esi
mov eax, 0x100798e0
mov byte [0x4bfe10], 0xe9
sub eax, 0x4bfe15
mov dword [0x4bfe11], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 5
push 0x4bfe10
call esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10079b80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push esi
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 0x436c8e
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0x437045
push eax
push ecx
mov ecx, 0x10079a70
mov dword [esp + 0x20], 0x43769b
mov dword [esp + 0x24], 0x43800a
mov dword [esp + 0x28], 0x41e027
mov dword [esp + 0x2c], 0x41ec22
call fcn.100122c0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x41d105
call esi
mov eax, 0x10079ae0
sub eax, 0x41d109
mov dword [0x41d105], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x41d105
call esi
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x43ae93
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x43af59
push eax
push ecx
mov ecx, 0x10079af0
call fcn.100122c0
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43cb5d
call esi
mov eax, 0x10079b70
sub eax, 0x43cb61
mov dword [0x43cb5d], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43cb5d
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1007ac80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ecx, ecx
push edi
mov edi, edx
xor ebx, ebx
sub ebp, edi
add ebp, 3
shr ebp, 2
cmp edi, dword [esp + 0x10]
cmova ebp, ecx
test ebp, ebp
je 0x1007acd4
push esi
mov esi, dword [edi]
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x14]
mov dword [esi], 0x1013cef8
push eax
push dword [esp + 0x18]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebx
lea edi, [edi + 4]
cmp ebx, ebp
jne 0x1007aca1
pop esi
pop edi
pop ebp
pop ebx
ret 4

Function at 0x1007aee0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x443fb3
call esi
mov eax, 0x1007ace0
sub eax, 0x443fb7
mov dword [0x443fb3], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x443fb3
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x44401e
call esi
mov eax, 0x1007ad80
sub eax, 0x444022
mov dword [0x44401e], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x44401e
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x444078
call esi
mov eax, 0x1007aed0
sub eax, 0x44407c
mov dword [0x444078], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x444078
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x443fef
call esi
lea eax, [esp + 4]
mov dword [0x443fef], 0xfffd516d
push eax
push dword [esp + 8]
push 4
push 0x443fef
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 2
push 0x443fec
call esi
mov eax, 0xca89
mov word [0x443fec], ax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 2
push 0x443fec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x444039
call esi
mov dword [0x444039], 0x441f0f
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x444039
call esi
pop esi
pop ecx
ret
Function at 0x1007b220
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x40
mov dword [esp], ecx
push ebx
push ebp
mov ebp, edx
mov edx, ecx
push esi
push edi
test cl, 3
je 0x1007b239
and edx, 0xfffffffc
add edx, 4
mov edi, dword [esp + 0x5c]
mov eax, edx
sub eax, ecx
imul edx, ebp
mov dword [esp + 0x14], eax
mov eax, 0x4d42
mov word [esp + 0x18], ax
push edi
push 1
push 0xe
mov dword [esp + 0x2e], 0x436
mov dword [esp + 0x34], 0x28
lea eax, [edx + 0x436]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x26], eax
xor eax, eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], 0x80001
mov dword [esp + 0x4c], edx
mov dword [esp + 0x58], 0x100
call fcn.100f5ff9
push edi
push 1
lea eax, [esp + 0x40]
push 0x28
push eax
call fcn.100f5ff9
mov esi, dword [esp + 0x78]
add esp, 0x20
add esi, 2
mov ebx, 0x100
nop dword [eax + eax]
movzx ecx, byte [esi - 2]
movzx eax, byte [esi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
push edi
shl ecx, 8
or ecx, eax
lea eax, [esp + 0x60]
push 1
shl ecx, 2
push 4
push eax
mov dword [esp + 0x6c], ecx
call fcn.100f5e80
add esp, 0x10
lea esi, [esi + 3]
sub ebx, 1
jne 0x1007b2d0
mov eax, dword [esp + 0x10]
lea ebx, [ebp - 1]
imul ebx, eax
add ebx, dword [esp + 0x54]
test ebp, ebp
jle 0x1007b34a
push edi
push eax
push 1
push ebx
dec ebp
call fcn.100f5e80
mov eax, dword [esp + 0x24]
add esp, 0x10
test eax, eax
je 0x1007b340
mov esi, eax
push edi
push 0
call fcn.100ef585
add esp, 8
sub esi, 1
jne 0x1007b330
mov eax, dword [esp + 0x10]
sub ebx, eax
test ebp, ebp
jg 0x1007b318
push edi
call fcn.100f22da
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
Function at 0x1007b7d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
push edi
push 9
mov ebx, edx
mov edi, ecx
push 0
push str.__restart
mov ecx, ebx
call fcn.10007920
cmp eax, 0xffffffff
je 0x1007b816
push 1
mov edx, edi
lea ecx, [esp + 0xc]
call fcn.1007b410
mov edx, dword [esp + 0x1c]
cmp edx, 0x10
jb 0x1007b816
mov ecx, dword [esp + 8]
inc edx
push 1
call fcn.1000d8e0
cmp dword [0x4e4480], 0x278805c7
je 0x1007b897
push str.f2_res.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1007b897
cmp byte [0x10174f82], 0
mov ecx, str.The_enabled_High_Resolution_Patch_by_Mash_is_no_longer_supported__it_will_be_automatically_disabled__n_nNote:_sfall_has_its_own_High_Resolution_patch__which_is_compatible_with_Mash_High_Resolution_Patch.
push 0x2030
push str.SFALL:_High_Resolution_patch
mov eax, 0x101248b0
cmove eax, ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp + 8]
mov edx, ebx
mov ecx, edi
call fcn.1007b540
test al, al
jne 0x1007b88f
cmp byte [0x10174f82], 0
mov ecx, str.Failed_to_disable_the_High_Resolution_Patch_by_Mash._nDo_it_manually_or_delete_the_file_f2_res.dll_from_the_game_folder.
push 0x2010
push str.Error_disable_HRP_by_Mash
mov eax, 0x10124a70
cmove eax, ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4