So I've disassembled SCIV.EXE in IDA and found three subroutines where the program pulls the time from DOS.
seg000:8714 ; =============== S U B R O U T I N E =======================================
seg000:8714
seg000:8714 ; Attributes: bp-based frame
seg000:8714
seg000:8714 sub_18714 proc near ; CODE XREF: seg000:loc_157C4 p
seg000:8714 push si
seg000:8715 push di
seg000:8716 push bp
seg000:8717 mov bp, sp
seg000:8719 mov bx, ds:750h
seg000:871D
seg000:871D loc_1871D: ; CODE XREF: sub_18714+13 j
seg000:871D or bx, bx
seg000:871F jnz short loc_18729
seg000:8721 mov ah, 2Ch
seg000:8723 int 21h ; DOS - GET CURRENT TIME
seg000:8723 ; Return: CH = hours, CL = minutes, DH = seconds
seg000:8723 ; DL = hundredths of seconds
seg000:8725 mov bx, dx
seg000:8727 jmp short loc_1871D
seg000:8729 ; ---------------------------------------------------------------------------
seg000:8729
seg000:8729 loc_18729: ; CODE XREF: sub_18714+B j
seg000:8729 mov ax, 7C4Dh
seg000:872C mul bx
seg000:872E mov ds:750h, ax
seg000:8731 mov al, ah
seg000:8733 mov ah, dl
seg000:8735 pop bp
seg000:8736 pop di
seg000:8737 pop si
seg000:8738 retn
This first one is the one that updates the the RNG seed based on the previous (lines 8729 onward. It calls the DOS time if the RNG seed is 0 (line 871d-8727)
The next two are other subroutines that call for the DOS time.
seg000:9B03 ; =============== S U B R O U T I N E =======================================
seg000:9B03
seg000:9B03 ; Attributes: bp-based frame
seg000:9B03
seg000:9B03 sub_19B03 proc near ; CODE XREF: seg000:5205 p
seg000:9B03
seg000:9B03 arg_0 = word ptr 8
seg000:9B03
seg000:9B03 push si
seg000:9B04 push di
seg000:9B05 push bp
seg000:9B06 mov bp, sp
seg000:9B08 cmp [bp+arg_0], 3
seg000:9B0C jz short loc_19B3F
seg000:9B0E mov ah, 2Ch
seg000:9B10 int 21h ; DOS - GET CURRENT TIME
seg000:9B10 ; Return: CH = hours, CL = minutes, DH = seconds
seg000:9B10 ; DL = hundredths of seconds
seg000:9B12 mov ah, cl
seg000:9B14 xor al, al
seg000:9B16 shr ax, 1
seg000:9B18 shr ax, 1
seg000:9B1A or al, dh
seg000:9B1C cmp [bp+arg_0], 2
seg000:9B20 jnz short loc_19B28
seg000:9B22 shr ax, 1
seg000:9B24 mov cl, 3
seg000:9B26 jmp short loc_19B39
seg000:9B28 ; ---------------------------------------------------------------------------
seg000:9B28
seg000:9B28 loc_19B28: ; CODE XREF: sub_19B03+1D j
seg000:9B28 or ch, ch
seg000:9B2A jnz short loc_19B2F
seg000:9B2C add ch, 0Ch
seg000:9B2F
seg000:9B2F loc_19B2F: ; CODE XREF: sub_19B03+27 j
seg000:9B2F cmp ch, 0Ch
seg000:9B32 jle short loc_19B37
seg000:9B34 sub ch, 0Ch
seg000:9B37
seg000:9B37 loc_19B37: ; CODE XREF: sub_19B03+2F j
seg000:9B37 mov cl, 4
seg000:9B39
seg000:9B39 loc_19B39: ; CODE XREF: sub_19B03+23 j
seg000:9B39 shl ch, cl
seg000:9B3B or ah, ch
seg000:9B3D jmp short loc_19B53
seg000:9B3F ; ---------------------------------------------------------------------------
seg000:9B3F
seg000:9B3F loc_19B3F: ; CODE XREF: sub_19B03+9 j
seg000:9B3F mov ah, 2Ah
seg000:9B41 int 21h ; DOS - GET CURRENT DATE
seg000:9B41 ; Return: DL = day, DH = month, CX = year
seg000:9B41 ; AL = day of the week (0=Sunday, 1=Monday, etc.)
seg000:9B43 mov ah, dh
seg000:9B45 xor al, al
seg000:9B47 shr ax, 1
seg000:9B49 shr ax, 1
seg000:9B4B shr ax, 1
seg000:9B4D or al, dl
seg000:9B4F shl cx, 1
seg000:9B51 or ah, cl
seg000:9B53
seg000:9B53 loc_19B53: ; CODE XREF: sub_19B03+3A j
seg000:9B53 pop bp
seg000:9B54 pop di
seg000:9B55 pop si
seg000:9B56 retn
And the last...
seg000:8684 ; =============== S U B R O U T I N E =======================================
seg000:8684
seg000:8684 ; Attributes: bp-based frame
seg000:8684
seg000:8684 sub_18684 proc near ; CODE XREF: seg000:4E09 p
seg000:8684 ; seg000:59F3 p ...
seg000:8684
seg000:8684 arg_0 = word ptr 8
seg000:8684 arg_2 = word ptr 0Ah
seg000:8684
seg000:8684 push si
seg000:8685 push di
seg000:8686 push bp
seg000:8687 mov bp, sp
seg000:8689 mov ax, [bp+arg_0]
seg000:868C mov dx, [bp+arg_2]
seg000:868F or dx, dx
seg000:8691 jnz short loc_186A7
seg000:8693 or ah, ah
seg000:8695 jz short loc_1869E
seg000:8697 mov al, ah
seg000:8699 mov si, 772h
seg000:869C jmp short loc_186B7
seg000:869E ; ---------------------------------------------------------------------------
seg000:869E
seg000:869E loc_1869E: ; CODE XREF: sub_18684+11 j
seg000:869E or al, al
seg000:86A0 jz short loc_186EE
seg000:86A2 mov si, 762h
seg000:86A5 jmp short loc_186B7
seg000:86A7 ; ---------------------------------------------------------------------------
seg000:86A7
seg000:86A7 loc_186A7: ; CODE XREF: sub_18684+D j
seg000:86A7 mov ax, dx
seg000:86A9 or ah, ah
seg000:86AB jnz short loc_186B2
seg000:86AD mov si, 782h
seg000:86B0 jmp short loc_186B7
seg000:86B2 ; ---------------------------------------------------------------------------
seg000:86B2
seg000:86B2 loc_186B2: ; CODE XREF: sub_18684+27 j
seg000:86B2 mov al, ah
seg000:86B4 mov si, 792h
seg000:86B7
seg000:86B7 loc_186B7: ; CODE XREF: sub_18684+18 j
seg000:86B7 ; sub_18684+21 j ...
seg000:86B7 mov cx, 9
seg000:86BA
seg000:86BA loc_186BA: ; CODE XREF: sub_18684+38 j
seg000:86BA shr al, 1
seg000:86BC loopne loc_186BA
seg000:86BE shl cx, 1
seg000:86C0 sub si, cx
seg000:86C2 lodsw
seg000:86C3 mov bx, ax
seg000:86C5 mov ax, [bp+arg_0]
seg000:86C8 mov cx, bx
seg000:86CA div bx
seg000:86CC xor dx, dx
seg000:86CE add ax, cx
seg000:86D0 adc dx, 0
seg000:86D3 shr dx, 1
seg000:86D5 rcr ax, 1
seg000:86D7 mov bx, ax
seg000:86D9 mov ax, [bp+arg_0]
seg000:86DC mov dx, [bp+arg_2]
seg000:86DF mov cx, bx
seg000:86E1 div bx
seg000:86E3 xor dx, dx
seg000:86E5 add ax, cx
seg000:86E7 adc dx, 0
seg000:86EA shr dx, 1
seg000:86EC rcr ax, 1
seg000:86EE
seg000:86EE loc_186EE: ; CODE XREF: sub_18684+1C j
seg000:86EE pop bp
seg000:86EF pop di
seg000:86F0 pop si
seg000:86F1 retn
seg000:86F1 sub_18684 endp
seg000:86F1
seg000:86F2 ; ---------------------------------------------------------------------------
seg000:86F2 push si
seg000:86F3 push di
seg000:86F4 push bp
seg000:86F5 mov bp, sp
seg000:86F7 mov ax, ds:74Eh
seg000:86FA
seg000:86FA loc_186FA: ; CODE XREF: seg000:8704 j
seg000:86FA or ax, ax
seg000:86FC jnz short loc_18706
seg000:86FE mov ah, 2Ch
seg000:8700 int 21h ; DOS - GET CURRENT TIME
seg000:8700 ; Return: CH = hours, CL = minutes, DH = seconds
seg000:8700 ; DL = hundredths of seconds
seg000:8702 mov ax, dx
seg000:8704 jmp short loc_186FA
seg000:8706 ; ---------------------------------------------------------------------------
seg000:8706
seg000:8706 loc_18706: ; CODE XREF: seg000:86FC j
seg000:8706 shr ax, 1
seg000:8708 jnb short loc_1870D
seg000:870A xor ax, 0B400h
seg000:870D
seg000:870D loc_1870D: ; CODE XREF: seg000:8708 j
seg000:870D mov ds:74Eh, ax
seg000:8710 pop bp
seg000:8711 pop di
seg000:8712 pop si
seg000:8713 retn
Using 0 as initial RTC: Unless my math is wrong, neither of the last two subroutines yield 29317 for the initial seed that results according to the lua script. (I tried calculating through using the following values for the DOS time when the RNG is first called: 14469 ms, 14470 ms, and 14483)
Any help or suggestions on the next direction to look would be appreciated.
I've begun brute force testing and gotten the first 33 seeds thus far, but have found no lasting pattern. I'll keep working on this unless someone can figure out the assembly better than I did.