joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10088c90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010f210
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], esp
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x18], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edx, [ecx*8]
mov dword [ebp + 0xc], edx
cmp eax, dword [ebx + 4]
jne 0x10088d11
mov esi, dword [ebx + 4]
jmp 0x10088d17
mov esi, dword [esi + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x10088d2c
mov ecx, dword [edi]
nop dword [eax]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x10088d73
cmp esi, eax
jne 0x10088d20
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x10088d5c
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x10088dc4
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x10088de6
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x10088d9f
push eax
call fcn.100e9b8b
add esp, 4
mov dword [edi + 0xc], 0
push edi
call fcn.100e9b9e
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x10088dcc
mov dword [ecx], edi
jmp 0x10088de6
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x10088de6
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.10088e30
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1008a530
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
push ebx
mov bl, byte [0x41b966]
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor bl, 4
push eax
push 0x40
push 1
push 0x41b966
call esi
lea eax, [esp + 8]
mov byte [0x41b966], bl
push eax
push dword [esp + 0xc]
push 1
push 0x41b966
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x4d5ebf
call esi
lea eax, [esp + 8]
mov byte [0x4d5ebf], 1
push eax
push dword [esp + 0xc]
push 1
push 0x4d5ebf
call esi
mov bl, byte [0x481cec]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x481cec
or bl, 1
call esi
lea eax, [esp + 8]
mov byte [0x481cec], bl
push eax
push dword [esp + 0xc]
push 1
push 0x481cec
call esi
mov bl, byte [0x44e7d2]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x44e7d2
or bl, 1
call esi
lea eax, [esp + 8]
mov byte [0x44e7d2], bl
push eax
push dword [esp + 0xc]
push 1
push 0x44e7d2
call esi
mov bl, byte [0x42f869]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x42f869
xor bl, 0x21
call esi
lea eax, [esp + 8]
mov byte [0x42f869], bl
push eax
push dword [esp + 0xc]
push 1
push 0x42f869
call esi
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x435160
mov dword [esp + 0xc], 0x435189
lea edx, [esp + 8]
push eax
mov cl, 0x7f
call fcn.10084100
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x1008a8f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edx, str.CombatPanelAnimDelay
push str.._sfall.ini
push 0x3e8
mov ecx, str.Misc
mov dword [esp + 0x1c], esi
call fcn.10005480
cmp byte [0x10153f67], 0
je 0x1008a94a
cmp dword [0x10154e3c], 1
je 0x1008a94a
push str..ddraw.ini
push 0x3e8
mov edx, str.CombatPanelAnimDelay
mov ecx, str.Misc
call fcn.10005480
movzx ebx, ax
mov eax, 0x3e8
cmp bx, ax
je 0x1008a9fa
movzx eax, bx
push eax
push str.CombatPanelAnimDelay
push str.Applying_patch:__s___d.
push 0xffffffffffffffff
lea eax, [esp + 0x28]
push 0xff
push eax
call fcn.10013420
add esp, 0x18
cmp byte [0x10174f84], 0
je 0x1008a9c6
test byte [0x10174f88], 1
je 0x1008a9c6
lea edx, [esp + 0x18]
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x1008a9c6
lea edx, [esp + 0x18]
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edi, edi
nop
mov esi, dword [esi + edi*4]
lea eax, [esp + 0x10]
push eax
push 0x40
push 2
push esi
call ebp
lea eax, [esp + 0x10]
mov word [esi], bx
push eax
push dword [esp + 0x14]
push 2
push esi
call ebp
mov esi, dword [esp + 0x14]
inc edi
cmp edi, 2
jl 0x1008a9d0
pop edi
mov ax, bx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1008aa10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edx, str.DialogPanelAnimDelay
push str.._sfall.ini
push 0x21
mov ecx, str.Misc
mov dword [esp + 0x1c], esi
call fcn.10005480
cmp byte [0x10153f67], 0
mov ebx, eax
je 0x1008aa68
cmp dword [0x10154e3c], 1
je 0x1008aa68
push str..ddraw.ini
push 0x21
mov edx, str.DialogPanelAnimDelay
mov ecx, str.Misc
call fcn.10005480
mov bl, al
cmp bl, 0x21
je 0x1008ab0d
movzx eax, bl
push eax
push str.DialogPanelAnimDelay
push str.Applying_patch:__s___d.
push 0xffffffffffffffff
lea eax, [esp + 0x28]
push 0xff
push eax
call fcn.10013420
add esp, 0x18
cmp byte [0x10174f84], 0
je 0x1008aadc
test byte [0x10174f88], 1
je 0x1008aadc
lea edx, [esp + 0x18]
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x1008aadc
lea edx, [esp + 0x18]
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edi, edi
mov esi, dword [esi + edi*4]
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push esi
call ebp
lea eax, [esp + 0x10]
mov byte [esi], bl
push eax
push dword [esp + 0x14]
push 1
push esi
call ebp
mov esi, dword [esp + 0x14]
inc edi
cmp edi, 2
jl 0x1008aae4
pop edi
mov al, bl
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1008cc40
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x1008cc99
mov ecx, esi
jmp 0x1008cc9e
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1008ccc3
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x1008ccad
mov eax, dword [eax]
jmp 0x1008cc91
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
mov ecx, dword [esp + 0x10]
cmovne eax, esi
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
ret 8
Function at 0x1008cd60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010f320
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], esp
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x18], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edx, [ecx*8]
mov dword [ebp + 0xc], edx
cmp eax, dword [ebx + 4]
jne 0x1008cde1
mov esi, dword [ebx + 4]
jmp 0x1008cde7
mov esi, dword [esi + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x1008cdfc
mov ecx, dword [edi]
nop dword [eax]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x1008ce43
cmp esi, eax
jne 0x1008cdf0
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1008ce2c
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x1008ce7d
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x1008ce9f
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.100e9b9e
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x1008ce85
mov dword [ecx], edi
jmp 0x1008ce9f
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1008ce9f
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1008cef0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1008cf90
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x1008cfff
cmp dword [ecx], edi
jne 0x1008cff7
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x1008d007
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1008d007
cmp dword [ecx], edi
jne 0x1008d00b
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.100e9b9e
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
ret 8
Function at 0x1008f5e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x20
push 0
mov edx, str.BoostScriptDialogLimit
mov dword [esp + 8], 0x4a50c2
mov ecx, str.Misc
mov dword [esp + 0xc], 0x4a5169
mov dword [esp + 0x10], 0x4a52fa
mov dword [esp + 0x14], 0x4a5302
mov dword [esp + 0x18], 0x4a6b86
mov dword [esp + 0x1c], 0x4a6be0
mov dword [esp + 0x20], 0x4a6c37
call fcn.1000dcb0
test eax, eax
je 0x1008f75e
cmp byte [0x10174f84], 0
je 0x1008f67f
test byte [0x10174f88], 1
je 0x1008f67f
mov edx, str.Applying_script_dialog_limit_patch.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x1008f67f
mov edx, str.Applying_script_dialog_limit_patch.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
push 0x13880
call fcn.100ea148
add esp, 4
mov dword [esp], eax
test eax, eax
je 0x1008f6b7
mov ecx, eax
mov edx, 0x2710
nop word [eax + eax]
mov dword [ecx], 0
lea ecx, [ecx + 8]
mov dword [ecx - 4], 0
sub edx, 1
jne 0x1008f6a0
jmp 0x1008f6b9
xor eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x101750bc], eax
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4a50e3
call esi
lea eax, [esp + 4]
mov dword [0x4a50e3], 0x2710
push eax
push dword [esp + 8]
push 4
push 0x4a50e3
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4a519f
call esi
lea eax, [esp + 4]
mov dword [0x4a519f], 0x2710
push eax
push dword [esp + 8]
push 4
push 0x4a519f
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4a534f
call esi
lea eax, [esp + 4]
mov dword [0x4a534f], 0x13880
push eax
push dword [esp + 8]
push 4
push 0x4a534f
call esi
mov ecx, dword [0x101750bc]
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0xc]
call fcn.10011f50
pop esi
add esp, 0x20
ret
Function at 0x1008f8c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ea88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov dword [ebp - 0x10], 0x4606a5
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push str.InstantWeaponEquip
mov edx, str.Misc
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x1008f941
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f93d
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
xor esi, esi
jmp 0x1008f974
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov esi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008f96f
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x1008f9ac
cmp eax, 1
je 0x1008f9ac
push str..ddraw.ini
push 0
mov edx, str.InstantWeaponEquip
mov ecx, str.Misc
call fcn.10005480
mov esi, eax
test esi, esi
je 0x1008fa4f
cmp byte [0x10174f84], 0
je 0x1008f9ff
test byte [0x10174f88], 1
je 0x1008f9ff
mov edx, str.Applying_instant_weapon_equip_patch.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x1008f9ff
mov edx, str.Applying_instant_weapon_equip_patch.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
lea eax, [ebp - 0xc]
mov cl, 0xeb
push eax
lea edx, [ebp - 0x10]
call fcn.10084100
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push 0x415238
call esi
mov eax, 0x1008eb00
mov byte [0x415238], 0xe9
sub eax, 0x41523d
mov dword [0x415239], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 5
push 0x415238
call esi
mov byte [0x1015fe3d], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1008fa60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ea88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push str.PlayIdleAnimOnReload
mov edx, str.Misc
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x1008fada
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008fad6
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
xor esi, esi
jmp 0x1008fb0d
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov esi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008fb08
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x1008fb45
cmp eax, 1
je 0x1008fb45
push str..ddraw.ini
push 0
mov edx, str.PlayIdleAnimOnReload
mov ecx, str.Misc
call fcn.10005480
mov esi, eax
test esi, esi
je 0x1008fbc8
cmp byte [0x10174f84], 0
je 0x1008fb94
test byte [0x10174f88], 1
je 0x1008fb94
mov edx, str.Applying_idle_anim_on_reload_patch.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x1008fb94
mov edx, str.Applying_idle_anim_on_reload_patch.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x460b8d
call esi
mov eax, 0x1008eb30
sub eax, 0x460b91
mov dword [0x460b8d], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 4
push 0x460b8d
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1008fbe0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ea88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push str.MotionScannerFlags
mov edx, str.Misc
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x1008fc5e
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008fc57
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
mov ebx, 1
jmp 0x1008fc94
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edx, 1
cmovae ecx, dword [ebp - 0x28]
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov ebx, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008fc8f
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x1008fccc
cmp eax, 1
je 0x1008fccc
push str..ddraw.ini
push 1
mov edx, str.MotionScannerFlags
mov ecx, str.Misc
call fcn.10005480
mov ebx, eax
test ebx, ebx
je 0x1008fddd
cmp byte [0x10174f84], 0
je 0x1008fd1f
test byte [0x10174f88], 1
je 0x1008fd1f
mov edx, str.Applying_MotionScannerFlags_patch.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x1008fd1f
mov edx, str.Applying_MotionScannerFlags_patch.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test bl, 1
je 0x1008fd5f
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push 0x41bbe9
call esi
mov eax, 0x1008eb90
mov byte [0x41bbe9], 0xe9
sub eax, 0x41bbee
mov dword [0x41bbea], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 5
push 0x41bbe9
call esi
test bl, 2
je 0x1008fddd
lea eax, [ebp - 0x10]
push eax
push 0x40
push 2
push 0x41bc24
call esi
mov eax, 0x9090
mov word [0x41bc24], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 2
push 0x41bc24
call esi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x41bc3c
call esi
lea eax, [ebp - 0x10]
mov dword [0x41bc3c], 0x441f0f
push eax
push dword [ebp - 0x10]
push 4
push 0x41bc3c
call esi
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x4794b3
call esi
lea eax, [ebp - 0x10]
mov byte [0x4794b3], 0x5e
push eax
push dword [ebp - 0x10]
push 1
push 0x4794b3
call esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1008fe00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ea88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
mov dword [ebp - 0x48], 0x4bd1a3
mov dword [ebp - 0x44], 0x4bd1d9
mov dword [ebp - 0x40], 0x4bd270
mov dword [ebp - 0x3c], 0x4bd604
mov dword [ebp - 0x38], 0x4bda14
mov dword [ebp - 0x34], 0x4bda44
mov dword [ebp - 0x30], 0x4be707
mov dword [ebp - 0x2c], 0x4c0fd4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push str.EncounterTableSize
mov edx, str.Misc
mov ecx, str.._sfall.ini
call fcn.100052a0
mov dword [0x10154e3c], eax
cmp eax, 1
je 0x1008feb2
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008feae
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
xor ebx, ebx
jmp 0x1008fee5
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
call fcn.10005410
mov dword [ebp - 4], 0xffffffff
mov ebx, eax
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1008fee0
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.1000d8e0
mov eax, dword [0x10154e3c]
cmp byte [0x10153f67], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
je 0x1008ff1d
cmp eax, 1
je 0x1008ff1d
push str..ddraw.ini
push 0
mov edx, str.EncounterTableSize
mov ecx, str.Misc
call fcn.10005480
mov ebx, eax
cmp ebx, 0x28
jle 0x1008ffe6
cmp byte [0x10174f84], 0
je 0x1008ff71
test byte [0x10174f88], 1
je 0x1008ff71
mov edx, str.Applying_EncounterTableSize_patch.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x1008ff71
mov edx, str.Applying_EncounterTableSize_patch.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp ebx, 0x32
jle 0x1008ff99
mov eax, 0x64
mov dword [ebp - 0x10], 0x4c102c
cmp ebx, eax
lea ecx, [ebp - 0x10]
cmovg ebx, eax
lea eax, [ebp - 0xc]
push eax
push ecx
mov ecx, 0x1008fdf0
call fcn.10012340
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x4bdb17
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
mov byte [0x4bdb17], bl
push eax
push dword [ebp - 0x10]
push 1
push 0x4bdb17
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
imul ecx, ebx, 0xb4
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x48]
add ecx, 0x104
call fcn.10011f50
lea eax, [ebx + 1]
mov dword [0x1013cf80], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret