joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ab4e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ea88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push str.AlwaysReloadMsgs
mov edx, str.Debugging
mov ecx, str..ddraw.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x100ab55d
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x100ab606
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov esi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x100ab58b
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
test esi, esi
je 0x100ab606
cmp byte [0x10174f84], 0
je 0x100ab5da
test byte [0x10174f88], 1
je 0x100ab5da
mov edx, str.Applying_always_reload_messages_patch.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x100ab5da
mov edx, str.Applying_always_reload_messages_patch.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x4a6b8d
call esi
lea eax, [ebp - 0x10]
mov byte [0x4a6b8d], 0
push eax
push dword [ebp - 0x10]
push 1
push 0x4a6b8d
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100ac040
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43ef84
call esi
mov eax, 0x100abad0
sub eax, 0x43ef88
mov dword [0x43ef84], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x43ef84
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43f142
call esi
mov eax, 0x100abaf0
sub eax, 0x43f146
mov dword [0x43f142], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x43f142
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x43ef76
call esi
lea eax, [esp + 4]
mov byte [0x43ef76], 0x32
push eax
push dword [esp + 8]
push 1
push 0x43ef76
call esi
lea eax, [esp + 0x10]
mov dword [esp + 4], 0x43efa4
push eax
lea edx, [esp + 8]
mov dword [esp + 0xc], 0x43efb9
mov ecx, 0x101755b0
mov dword [esp + 0x10], 0x43f2fc
call fcn.10011f50
lea eax, [esp + 0xc]
mov dword [esp + 4], 0x43efea
push eax
lea edx, [esp + 8]
mov dword [esp + 0xc], 0x43f315
mov ecx, 0x101755b8
call fcn.10011f50
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43f309
call esi
lea eax, [esp + 4]
mov dword [0x43f309], 0x101755b4
push eax
push dword [esp + 8]
push 4
push 0x43f309
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43f438
call esi
mov dword [0x43f438], 0x10175420
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x43f438
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43f475
call esi
lea eax, [esp + 4]
mov dword [0x43f475], 0x10175424
push eax
push dword [esp + 8]
push 4
push 0x43f475
call esi
lea eax, [esp + 0xc]
mov dword [esp + 4], 0x43f65e
push eax
lea edx, [esp + 8]
mov dword [esp + 0xc], 0x43f6bb
mov ecx, 0x10175350
call fcn.10011f50
push 2
push 0x100abb10
mov edx, 0x43f05d
mov cl, 0xe8
call fcn.10012100
push 2
push 0x100abb30
mov edx, 0x43f184
mov cl, 0xe8
call fcn.10012100
push 2
push 0x100abb50
mov edx, 0x43f1e4
mov cl, 0xe8
call fcn.10012100
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100ad280
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov edx, dword [0x10154a2c]
mov eax, 0x3a196b1f
push ebx
mov ebx, dword [0x10154a28]
sub edx, ebx
imul edx
push ebp
push esi
sar edx, 5
xor esi, esi
push edi
mov edi, ecx
mov dword [esp + 0x10], esi
mov ecx, edx
mov dword [esp + 0x14], edi
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x10175fe4]
cmp edx, ecx
jae 0x100ad2e3
imul eax, edx, 0x8d
add eax, ebx
sub ecx, edx
cmp byte [eax + 0x8c], 0
je 0x100ad2d9
cmp dword [eax], 0
je 0x100ad2d9
inc esi
mov dword [esp + 0x10], esi
add eax, 0x8d
sub ecx, 1
jne 0x100ad2c6
push edi
push 1
lea eax, [esp + 0x18]
push 4
push eax
call fcn.100f5ff9
mov ebp, dword [0x10154a2c]
mov eax, 0x3a196b1f
mov edi, dword [0x10154a28]
mov ecx, ebp
mov ebx, dword [0x10175fe4]
sub ecx, edi
imul ecx
add esp, 0x10
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x100ad390
imul esi, ebx, 0x8d
cmp byte [esi + edi + 0x8c], 0
je 0x100ad370
cmp dword [esi + edi], 0
je 0x100ad370
mov ebp, dword [esp + 0x14]
lea eax, [edi + 4]
push ebp
push 1
add eax, esi
push 0x88
push eax
call fcn.100f5ff9
mov eax, dword [0x10154a28]
push ebp
push 1
push dword [esi + eax + 4]
push dword [esi + eax]
call fcn.100f5ff9
mov ebp, dword [0x10154a2c]
add esp, 0x20
mov edi, dword [0x10154a28]
mov ecx, ebp
mov eax, 0x3a196b1f
sub ecx, edi
inc ebx
imul ecx
add esi, 0x8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x100ad326
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100b6560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1013caa8]
sub esp, 0x114
mov eax, dword [eax]
add eax, dword [0x101822e4]
push esi
push 0x1012cfa8
push eax
push dword [0x5193cc]
lea eax, [ebp - 0x110]
push str._s_savegame_slot_.2d_sfall_s.sav
push eax
call fcn.1000d880
add esp, 0x14
lea eax, [ebp - 0x110]
push eax
push 0
push str.Saving_game:__s_n
call fcn.10012410
add esp, 0xc
lea eax, [ebp - 0x110]
push 0x10124840
push eax
call fcn.100f224d
mov esi, eax
add esp, 8
test esi, esi
je 0x100b6719
mov ecx, esi
call fcn.1009d160
push esi
push 1
push 4
push 0x1013cf90
call fcn.100f5ff9
mov eax, dword [0x101751f4]
push esi
shl eax, 0x10
push 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
call fcn.100f5ff9
add esp, 0x20
mov ecx, esi
call fcn.100bf100
mov ecx, esi
call fcn.100d5330
mov ecx, esi
call fcn.100a1660
push esi
call fcn.100f22da
mov eax, dword [0x1013caa8]
add esp, 4
mov eax, dword [eax]
add eax, dword [0x101822e4]
push 0x1012db6c
push eax
push dword [0x5193cc]
lea eax, [ebp - 0x110]
push str._s_savegame_slot_.2d_sfall_s.sav
push eax
call fcn.1000d880
add esp, 0x14
lea eax, [ebp - 0x110]
push 0x10124840
push eax
call fcn.100f224d
mov esi, eax
add esp, 8
test esi, esi
je 0x100b6719
mov ecx, esi
call fcn.1009a330
mov ecx, esi
call fcn.10088380
push esi
push 1
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x70005cc
push 4
push eax
call fcn.100f5ff9
push esi
call fcn.100f22da
mov ecx, dword [0x10154a2c]
mov eax, 0x3a196b1f
sub ecx, dword [0x10154a28]
add esp, 0x14
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, dword [0x10175fe4]
test eax, eax
jle 0x100b6759
mov eax, dword [0x1013caa8]
push 0x1012ceb4
mov eax, dword [eax]
add eax, dword [0x101822e4]
push eax
push dword [0x5193cc]
lea eax, [ebp - 0x110]
push str._s_savegame_slot_.2d_sfall_s.sav
push eax
call fcn.1000d880
add esp, 0x14
lea eax, [ebp - 0x110]
push 0x10124840
push eax
call fcn.100f224d
mov esi, eax
add esp, 8
test esi, esi
je 0x100b6719
mov ecx, esi
call fcn.100ad280
push esi
call fcn.100f22da
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x110]
push eax
push 0
push str.ERROR_creating:__s_n
call fcn.10012410
add esp, 0xc
mov eax, 0x10153e68
cmp dword [0x10153e7c], 0x10
cmovae eax, dword [0x10153e68]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call dword [0x1012171c]
mov eax, str.IISXXXX1
call dword [0x101215bc]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100b8690
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x100b86ff
cmp dword [ecx], edi
jne 0x100b86f7
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x100b8707
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x100b8707
cmp dword [ecx], edi
jne 0x100b870b
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x100b872f
push 8
push eax
call fcn.100e9b90
add esp, 8
push edi
call fcn.100e9b9e
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
ret 8

Function at 0x100b8830
Capabilities:
Hash data using fnv

Disassembly:
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [0x10154e64]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
push edi
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
mov edx, dword [0x10154e6c]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x10154e78]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [esp + 0x14]
nop dword [eax]
cmp edi, esi
jne 0x100b8898
mov ecx, esi
jmp 0x100b889d
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100b88e7
mov ecx, dword [eax + 8]
cmp ecx, dword [edx]
je 0x100b88ac
mov eax, dword [eax]
jmp 0x100b8890
mov edx, dword [edx]
mov ecx, eax
mov dword [esp + 0x14], edx
cmp edi, esi
jne 0x100b88bc
mov edx, esi
jmp 0x100b88c1
mov edx, dword [ebx + 4]
mov edx, dword [edx]
cmp eax, edx
je 0x100b88d2
mov edx, dword [esp + 0x14]
cmp edx, dword [eax + 8]
jne 0x100b88d2
mov eax, dword [eax]
jmp 0x100b88b4
cmp ecx, eax
je 0x100b88e7
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword [edx + 4], eax
mov eax, edx
mov dword [edx], ecx
ret 8
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], esi
mov dword [eax + 4], esi
pop esi
pop ebx
ret 8
Function at 0x100b8900
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [0x10154e6c]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x10154e78]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x10154e64]
cmp edi, edx
jne 0x100b8960
mov ecx, edx
jmp 0x100b8965
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100b898a
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x100b8974
mov eax, dword [eax]
jmp 0x100b8958
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
mov ecx, dword [esp + 0x10]
pop edi
cmovne eax, edx
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], edx
ret 8
Function at 0x100b8a40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [esp + 0xc], edi
jb 0x100b8a5b
mov esi, dword [ebx]
jmp 0x100b8a5d
mov esi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x100b8a79
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100b8a68
mov ecx, dword [0x10154e58]
and ecx, edx
mov edx, dword [0x10154e4c]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov esi, dword [edx + ecx*4]
inc ecx
mov dword [esp + 0x10], esi
lea ecx, [edx + ecx*4]
mov dword [esp + 0x14], ecx
nop dword [eax + eax]
mov edx, dword [0x10154e44]
cmp esi, edx
jne 0x100b8aae
mov ecx, edx
jmp 0x100b8ab2
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100b8bf7
cmp dword [ebx + 0x14], 0x10
lea edx, [eax + 8]
jb 0x100b8ac7
mov edi, dword [ebx]
jmp 0x100b8ac9
mov edi, ebx
cmp dword [edx + 0x14], 0x10
lea ecx, [edx + 0x10]
jb 0x100b8ad4
mov edx, dword [edx]
mov ecx, dword [ecx]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xc]
mov esi, ecx
cmp dword [esp + 0x20], ecx
cmovb esi, dword [esp + 0x20]
test esi, esi
je 0x100b8b46
sub esi, 4
jb 0x100b8b03
mov ecx, dword [edx]
cmp ecx, dword [edi]
jne 0x100b8b08
add edx, 4
add edi, 4
sub esi, 4
jae 0x100b8af2
cmp esi, 0xfffffffc
je 0x100b8b3c
mov cl, byte [edx]
cmp cl, byte [edi]
jne 0x100b8b35
cmp esi, 0xfffffffd
je 0x100b8b3c
mov cl, byte [edx + 1]
cmp cl, byte [edi + 1]
jne 0x100b8b35
cmp esi, 0xfffffffe
je 0x100b8b3c
mov cl, byte [edx + 2]
cmp cl, byte [edi + 2]
jne 0x100b8b35
cmp esi, 0xffffffff
je 0x100b8b3c
mov cl, byte [edx + 3]
cmp cl, byte [edi + 3]
je 0x100b8b3c
sbb ecx, ecx
or ecx, 1
jmp 0x100b8b3e
xor ecx, ecx
test ecx, ecx
jne 0x100b8b50
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x20]
cmp edx, ecx
jb 0x100b8b50
jbe 0x100b8b5f
mov eax, dword [eax]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jmp 0x100b8aa0
cmp dword [eax + 0x1c], 0x10
lea edx, [eax + 8]
lea edi, [edx + 0x10]
jb 0x100b8b6d
mov edx, dword [edx]
cmp dword [ebx + 0x14], 0x10
jb 0x100b8b75
mov ebx, dword [ebx]
mov edi, dword [edi]
cmp ecx, edi
mov esi, edi
cmovb esi, ecx
test esi, esi
je 0x100b8bdb
sub esi, 4
jb 0x100b8b98
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x100b8b9d
add ebx, 4
add edx, 4
sub esi, 4
jae 0x100b8b87
cmp esi, 0xfffffffc
je 0x100b8bd1
mov cl, byte [ebx]
cmp cl, byte [edx]
jne 0x100b8bca
cmp esi, 0xfffffffd
je 0x100b8bd1
mov cl, byte [ebx + 1]
cmp cl, byte [edx + 1]
jne 0x100b8bca
cmp esi, 0xfffffffe
je 0x100b8bd1
mov cl, byte [ebx + 2]
cmp cl, byte [edx + 2]
jne 0x100b8bca
cmp esi, 0xffffffff
je 0x100b8bd1
mov cl, byte [ebx + 3]
cmp cl, byte [edx + 3]
je 0x100b8bd1
sbb ecx, ecx
or ecx, 1
jmp 0x100b8bd3
xor ecx, ecx
test ecx, ecx
jne 0x100b8be1
mov ecx, dword [esp + 0xc]
cmp ecx, edi
jb 0x100b8be1
jbe 0x100b8be6
mov eax, dword [0x10154e44]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
add esp, 0xc
ret 8
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword [eax], edx
add esp, 0xc
ret 8
Function at 0x100b8de0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010f8b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], esp
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x18], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edx, [ecx*8]
mov dword [ebp + 0xc], edx
cmp eax, dword [ebx + 4]
jne 0x100b8e61
mov esi, dword [ebx + 4]
jmp 0x100b8e67
mov esi, dword [esi + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x100b8e7c
mov ecx, dword [edi]
nop dword [eax]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x100b8ec3
cmp esi, eax
jne 0x100b8e70
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x100b8eac
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x100b8f0f
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x100b8f31
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x100b8eea
push 8
push eax
call fcn.100e9b90
add esp, 8
push edi
call fcn.100e9b9e
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x100b8f17
mov dword [ecx], edi
jmp 0x100b8f31
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x100b8f31
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.100b8f80
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100b9a50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x663974], 0
jne 0x100b9a66
cmp dword [0x638e74], 0
jne 0x100b9aa4
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4f5f40
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
mov byte [0x4f5f40], 0xc3
push eax
push dword [ebp - 4]
push 1
push 0x4f5f40
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0
call dword [0x101215cc]
mov dword [0x10176040], eax
mov esp, ebp
pop ebp
ret
Function at 0x100b9acb
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [0x1013d350]
sub esp, 0x20c
push esi
mov esi, ecx
cmp eax, 0xffffffff
jne 0x100b9b5f
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0x10113558
push 3
push 0
push 0x1012e0b4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x100b9b12
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [0x1013d350], 0
jmp 0x100b9b63
mov edx, str.Error:_Video_Mixing_Renderer__VMR9__capabilities_are_required.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x100b9b4b
mov edx, str.Error:_Video_Mixing_Renderer__VMR9__capabilities_are_required.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
mov dword [0x1013d350], 1
xor eax, eax
pop esi
add esp, 0x20c
ret
test eax, eax
jne 0x100b9b55
mov edx, dword [0x5193cc]
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [edx + ecx]
test al, al
je 0x100b9bd7
cbw
mov word [esp + ecx*2 + 8], ax
mov al, byte [edx + ecx + 1]
test al, al
je 0x100b9bd6
cbw
mov word [esp + ecx*2 + 0xa], ax
mov al, byte [edx + ecx + 2]
test al, al
je 0x100b9bd1
cbw
mov word [esp + ecx*2 + 0xc], ax
mov al, byte [edx + ecx + 3]
test al, al
je 0x100b9bcc
cbw
mov word [esp + ecx*2 + 0xe], ax
mov al, byte [edx + ecx + 4]
test al, al
je 0x100b9bc7
cbw
mov word [esp + ecx*2 + 0x10], ax
add ecx, 5
cmp ecx, 0x104
jl 0x100b9b70
jmp 0x100b9bd7
add ecx, 4
jmp 0x100b9bd7
add ecx, 3
jmp 0x100b9bd7
add ecx, 2
jmp 0x100b9bd7
inc ecx
lea edx, [ecx + 0xa]
cmp edx, 0x104
jge 0x100b9b55
movups xmm0, xmmword [str._artcuts_]
mov eax, dword [0x1012df80]
movups xmmword [esp + ecx*2 + 8], xmm0
mov dword [esp + ecx*2 + 0x18], eax
mov ax, word [0x1012df84]
mov word [esp + ecx*2 + 0x1c], ax
mov ecx, dword [esi*4 + 0x1016eba0]
sub ecx, edx
cmp edx, 0x104
jge 0x100b9b55
nop dword [eax + eax]
mov al, byte [ecx + edx]
test al, al
je 0x100b9c41
cbw
mov word [esp + edx*2 + 8], ax
inc edx
cmp edx, 0x104
jl 0x100b9c20
xor eax, eax
pop esi
add esp, 0x20c
ret
cmp edx, 0x104
jge 0x100b9b55
mov eax, dword [0x1012df88]
mov dword [esp + edx*2 + 2], eax
mov eax, dword [0x1012df8c]
mov dword [esp + edx*2 + 6], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x100b9b55
mov edx, 0x10154a7c
lea ecx, [esp + 8]
call fcn.100b9700
test eax, eax
jne 0x100b9c96
mov ecx, 0x10154a7c
call fcn.100b9650
pop esi
add esp, 0x20c
ret
mov edx, 0x100b9ab0
mov ecx, 0x44e932
call fcn.10012200
mov edx, 0x100b9a40
mov ecx, 0x44e949
call fcn.10012200
mov edx, 0x100b9a30
mov ecx, 0x44e937
call fcn.10012200
mov eax, dword [0x10154a94]
push 0x1016ec28
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov dword [0x1016ec20], 1
mov eax, 1
pop esi
add esp, 0x20c
ret
Function at 0x100b9cf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x44e933
call esi
lea eax, [ebp - 4]
mov dword [0x44e933], 0x39191
push eax
push dword [ebp - 4]
push 4
push 0x44e933
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x44e938
call esi
lea eax, [ebp - 4]
mov dword [0x44e938], 0x3934c
push eax
push dword [ebp - 4]
push 4
push 0x44e938
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x44e94a
call esi
lea eax, [ebp - 4]
mov dword [0x44e94a], 0x7a22a
push eax
push dword [ebp - 4]
push 4
push 0x44e94a
call esi
cmp dword [0x663974], 0
jne 0x100b9d88
cmp dword [0x638e74], 0
jne 0x100b9dc8
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4f5f40
call esi
lea eax, [ebp - 4]
mov byte [0x4f5f40], 0x53
push eax
push dword [ebp - 4]
push 1
push 0x4f5f40
call esi
mov eax, dword [0x10176040]
test eax, eax
je 0x100b9dc8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call dword [0x101215cc]
mov dword [0x10176040], eax
mov ecx, 0x10154a7c
mov dword [0x1016ec20], 0
call fcn.100b9650
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100b9e90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ea88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push str.SkipOpeningMovies
mov edx, str.Misc
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x100b9f0a
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x100b9f06
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
xor esi, esi
jmp 0x100b9f3d
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov esi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x100b9f38
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x100b9f75
cmp eax, 1
je 0x100b9f75
push str..ddraw.ini
push 0
mov edx, str.SkipOpeningMovies
mov ecx, str.Misc
call fcn.10005480
mov esi, eax
mov dword [0x1016ec30], esi
test esi, esi
je 0x100ba012
cmp byte [0x10174f84], 0
je 0x100b9fd4
test byte [0x10174f88], 1
je 0x100b9fd4
mov edx, str.Skipping_opening_movies.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x100b9fce
mov edx, str.Skipping_opening_movies.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
mov esi, dword [0x1016ec30]
cmp esi, 1
je 0x100ba012
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x4426a1
call esi
lea eax, [ebp - 0x10]
mov dword [0x4426a1], 0x441f0f
push eax
push dword [ebp - 0x10]
push 4
push 0x4426a1
call esi
mov dword [0x1016ec30], 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret