joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463950
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x4639a2
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov esi, dword [ebx + 8]
mov edx, dword [ebx]
shl ecx, 3
mov dword [ebp + 0xc], ecx
mov eax, dword [esi + ecx]
cmp eax, edx
jne 0x4639b8
mov esi, edx
jmp 0x4639be
mov esi, dword [esi + ecx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x4639d0
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x463a1e
cmp esi, eax
jne 0x4639c4
push edi
push dword [edx]
mov ecx, ebx
call fcn.004638d0
mov edi, dword [ebx]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x463a05
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x463a2e
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [edx + eax + 4], edi
jmp 0x463a50
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
pop ebp
ret 0xc
cmp eax, esi
jne 0x463a36
mov dword [ecx], edi
jmp 0x463a50
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x463a50
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.00469920
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0xc
Function at 0x463a70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x463ac2
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov esi, dword [ebx]
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x463af0
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x463af0
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x463b33
cmp esi, eax
jne 0x463ae4
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x463b1d
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 8]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x463b61
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x463b83
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
pop ebp
ret 0xc
cmp eax, esi
jne 0x463b69
mov dword [ecx], edi
jmp 0x463b83
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x463b83
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.00469920
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0xc
Function at 0x469f20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x469f73
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
inc ecx
lea ecx, [edx + ecx*4]
mov dword [ebp + 0xc], ecx
cmp edi, esi
jne 0x469f8f
mov ecx, esi
jmp 0x469f93
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x469fe3
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx]
je 0x469fa5
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
jmp 0x469f87
mov ecx, dword [ebx]
mov edx, eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
nop
cmp edi, esi
jne 0x469fb8
mov ecx, esi
jmp 0x469fbc
mov ecx, dword [ebx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x469fcc
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jne 0x469fcc
mov eax, dword [eax]
jmp 0x469fb0
cmp edx, eax
je 0x469fe3
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
mov dword [eax + 4], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46a060
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x46a0b3
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x46a0df
cmp dword [ecx], edi
jne 0x46a0d7
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
mov dword [ecx + edx + 4], eax
jmp 0x46a0e7
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x46a0e7
cmp dword [ecx], edi
jne 0x46a0ea
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x46a180
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x46a1d2
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x46a1ea
mov ecx, esi
jmp 0x46a1ef
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x46a21c
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x46a1fe
mov eax, dword [eax]
jmp 0x46a1e2
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], esi
jne 0x46a20e
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x46a230
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 8], ecx
push edi
mov edi, dword [eax + 0x10]
mov dword [ebp - 4], edi
cmp ecx, 0x10
jb 0x46a253
mov esi, dword [eax]
jmp 0x46a255
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x46a271
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x46a260
mov ecx, dword [ebx + 0x14]
mov edi, ecx
and edi, edx
cmp dword [ebx + 0x18], edi
ja 0x46a286
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add edi, eax
mov ecx, dword [ebx + 8]
lea eax, [edi + edi]
mov edx, dword [ebx]
lea eax, [eax + 1]
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov esi, dword [ecx + edi*8]
mov edi, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], eax
cmp edi, edx
jne 0x46a2af
mov eax, edx
jmp 0x46a2b3
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x46a3d3
cmp dword [ebp - 8], 0x10
lea ecx, [esi + 8]
jb 0x46a2cb
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
jmp 0x46a2ce
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
mov dword [ebp - 4], eax
jb 0x46a2dc
mov ecx, dword [ecx]
cmp eax, ebx
mov edx, ebx
cmovb edx, eax
test edx, edx
je 0x46a343
sub edx, 4
jb 0x46a301
lea esp, [esp]
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x46a306
add ecx, 4
add edi, 4
sub edx, 4
jae 0x46a2f0
cmp edx, 0xfffffffc
je 0x46a33a
mov al, byte [ecx]
cmp al, byte [edi]
jne 0x46a333
cmp edx, 0xfffffffd
je 0x46a33a
mov al, byte [ecx + 1]
cmp al, byte [edi + 1]
jne 0x46a333
cmp edx, 0xfffffffe
je 0x46a33a
mov al, byte [ecx + 2]
cmp al, byte [edi + 2]
jne 0x46a333
cmp edx, 0xffffffff
je 0x46a33a
mov al, byte [ecx + 3]
cmp al, byte [edi + 3]
je 0x46a33a
sbb eax, eax
or eax, 1
jmp 0x46a33c
xor eax, eax
test eax, eax
jne 0x46a353
mov eax, dword [ebp - 4]
cmp eax, ebx
jb 0x46a353
xor eax, eax
cmp dword [ebp - 4], ebx
setne al
test eax, eax
je 0x46a363
mov esi, dword [esi]
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
jmp 0x46a2a7
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
mov edi, dword [ecx + 0x10]
jb 0x46a371
mov ecx, dword [ecx]
cmp dword [ebp - 8], 0x10
jb 0x46a37f
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
cmp ebx, edi
mov eax, edi
cmovb eax, ebx
push eax
push ecx
push dword [ebp + 0xc]
call fcn.00405960
add esp, 0xc
test eax, eax
jne 0x46a3ba
cmp ebx, edi
jb 0x46a3ba
cmp ebx, edi
setne al
test eax, eax
jne 0x46a3ba
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
pop edi
mov dword [ebp + 0xc], esi
mov ecx, dword [ecx]
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0xc]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x46c310
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, edi
sar ecx, 2
test ecx, ecx
je 0x46c37e
push ebx
push esi
mov ebx, ecx
mov eax, dword [edi]
lea edi, [edi + 4]
movzx esi, cl
movzx edx, al
xor esi, edx
shr ecx, 8
mov dword [ebp - 4], eax
movzx eax, ah
xor ecx, dword [esi*4 + 0x478ac8]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 2]
xor ecx, dword [edx*4 + 0x478ac8]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 1]
xor ecx, dword [edx*4 + 0x478ac8]
movzx edx, cl
xor edx, eax
shr ecx, 8
xor ecx, dword [edx*4 + 0x478ac8]
dec ebx
jne 0x46c327
pop esi
pop ebx
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x4da360
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x98000]
push edi
jmp 0x4da37a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4da381
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4da370
mov eax, 1
add ebx, ebx
jne 0x4da393
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4da3a4
jne 0x4da3c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4da3c3
dec eax
add ebx, ebx
jne 0x4da3b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4da388
add ebx, ebx
jne 0x4da3bf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4da415
xor ecx, ecx
sub eax, 3
jb 0x4da3db
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4da44a
sar eax, 1
mov ebp, eax
jmp 0x4da3e6
add ebx, ebx
jne 0x4da3e6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4da3b4
inc ecx
add ebx, ebx
jne 0x4da3f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4da3b4
add ebx, ebx
jne 0x4da401
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4da3f6
jne 0x4da412
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4da3f6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4da434
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4da426
jmp 0x4da376
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4da434
add edi, ecx
jmp 0x4da376
pop esi
mov edi, esi
mov ecx, 0x3726
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4da452
cmp byte [edi], 0x22
jne 0x4da452
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4da457
lea edi, [esi + 0xd6000]
mov eax, dword [edi]
or eax, eax
je 0x4da4cf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x104adc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x104c30]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4da484
mov ecx, edi
jns 0x4da4b3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x104c34]
or eax, eax
je 0x4da4c9
mov dword [ebx], eax
add ebx, 4
jmp 0x4da4a1
call dword [esi + 0x104c44]
mov ebp, dword [esi + 0x104c38]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4da503
sub esp, 0xffffff80
jmp 0x416781
Function at 0xa1ae42
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], bx
xchg edx, ebx
lea edx, reloc.MSVFW32.dll_DrawDibDraw
push ecx
xchg word [esp + 1], dx
jmp 0xa1affa
lea ebx, reloc.MSVFW32.dll_DrawDibDraw
mov edx, 0xb0fd2db
lea esp, [esp + 1]
jmp 0xa1af5e
mov bh, byte [esp + 0x14]
lea ebx, reloc.MSVFW32.dll_DrawDibDraw
mov edx, ebx
sub esp, 0x19
jo 0xa1af4b
mov bh, byte [esp + 0x14]
jmp 0xa1af1b

Function at 0xa5dd67
Capabilities:
Encode data using xor

Disassembly:
call fcn.00a5db89
mov edx, 0x53612572
mov edx, dword [ebp - 4]
jne 0xa5dd02
je 0xa5da93
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
xchg ecx, eax
adc eax, dword [ebx + reloc.MSVFW32.dll_DrawDibDraw]
add dword [eax + 3], 0x8d2434ff
push dword [esp]
lea esp, [esp + 8]
call fcn.00a5dc06
lea esp, [esp + 2]
jmp 0xa5dbd9
mov dword [ebp - 4], 0x10
not dh
mov dl, 0xbe
jmp 0xa5db04
push ecx
neg dx
lea edx, [ebx*4]
push ecx
jmp 0xa5daca
mov ax, di
mov ax, dx
mov eax, esi
jmp 0xa5db42
mov edx, dword [ebp - 4]
test edx, edx
jne 0xa5da5e
je 0xa5daee
enter 0xffffffffffffde48, 0xffffffffffffffb9
dec eax
mul byte [esi - 0x1b]
jne 0xa5db37
out dx, eax
pop esp
xchg esp, eax
pop es
scasb al, byte es:[edi]
mov ecx, 0x648dfb98
and al, 4
lea esp, [esp + 4]
push ebp
mov ebp, esp
jmp 0xa5dae0
xchg ebx, eax
dec eax
int 0x5d
and al, 0xd7
imul ebx, esp, 0x2f
and dword ss:[ebx], esi
ror cl, 0xc3
xor eax, eax
leave
ret
mov dl, byte [eax]
push bp
mov byte [esp], bh
lea esp, [esp + 2]
cmp dl, byte [ecx]
call fcn.00a5db87
loop 0xa5dbcb
pop ss
loop 0xa5dbb1
movsb byte es:[edi], byte [esi]
daa
mov bh, 0xd2
and esp, ebp
fidiv dword [reloc.MSVFW32.dll_DrawDibDraw]
mov word [esp + 1], di
jmp 0xa5db23
invalid
push sp
add esp, 0
push word [esp]
mov dword [esp], edi
and al, 0x89
cmp al, 0x24
jmp 0xa5dbe2
push edx
mov edx, eax
movzx eax, byte [edx]
pop edx
jmp 0xa5dbc3
movzx ecx, byte [ecx]
sub eax, ecx
push ax
lea esp, [esp + 2]
jmp 0xa5dc10
lea esp, [esp + 8]
leave
ret
call fcn.00a5db2c
jmp 0xa5dd5d
test eax, eax
jne 0xa5de11
je fcn.00a5dd96
lea esp, [esp + 2]
jmp 0xa5dd9d
Function at 0xb010e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ecx
jmp 0xb010ef
bsf edi, ebx
dec cl
bt ebx, esp
setp dl
pop word [esp]
lea esp, [esp + 2]
jmp 0xb01135
shl ch, cl
rcr edx, 0x10
xchg ecx, esi
neg ebp
mov al, 0x52
stc
jmp 0xb01149
mov byte [esp], cl
mov byte [esp], bl
bsr si, bx
not eax
xchg ebp, ebx
mov di, word [esp]
jmp 0xb0111f
mov dx, bp
mov cx, bp
lea esi, [ebx + ebp]
bswap ecx
mov eax, dword [esp]
add esp, 0
jmp 0xb0118c
mov bp, 0x5e13
btr edi, ebx
inc bp
mov dh, byte [esp]
mov ecx, 0x187474de
jmp 0xb011a0
not dh
mov byte [esp], ah
and edx, ebx
mov ecx, 0x8dd39e03
seto bh
bsr ecx, edx
jmp 0xb01174
not bl
stc
lea eax, [esi - 0x90]
lea eax, [ecx + ecx]
mov esi, 0x6aebdab6
jmp 0xb011e8
bt edi, ebp
call fcn.00b0120e
bsf si, sp
mov al, ch
call fcn.00b011f8
sbb dl, byte [eax + 0x72906106]
lea ebx, [edi + ebp*2]
jbe 0xb01249
shl bx, 2
rdtsc
mov bh, byte [esp]
std
rdtsc
xchg cx, ax
jmp 0xb011ca
xor byte [edx - 0x15], dl
out 0x66, eax
push dword [esp + 0x10]
pop esi
lea ebp, [edx + ebp]
mov dword [esp + 9], ebp
jmp 0xb012a3
mov di, bp
mov dh, byte [esp]
call fcn.00b012cf
dec esi
lds edx, [ebp + 0x3c]
iretd
rcl edi, cl
not esi
mov byte [esp], bh
stc
lea esp, [esp]
lea eax, [edi + ebp]
jmp 0xb01276
xchg byte [esp + 0xc], cl
mov esi, 0xa5a67cee
xchg dword [esp + 0xc], ecx
xchg esi, eax
add esp, 0x13
mov ch, byte [esp]
jmp 0xb0128c

Function at 0xb013ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 3], bl
xchg dword [esp + 2], ebp
mov dx, sp
xchg word [esp + 3], bx
jmp 0xb0138a
add esp, 4
mov edi, 0x9ed39bb7
pop esi
not di
clc
neg eax
jmp 0xb0134d
btr bx, sp
mov al, byte [esp + 8]
cpuid
mov al, 0x7d
lea esp, [esp]
jmp 0xb013c3
mov ax, word [esp + 1]
btr cx, di
mov bx, 0x25ed
cpuid
push word [esp + 2]
setge dl
jmp 0xb01374
cmp di, 0xb2a3
xchg dword [esp + 1], ecx
cpuid
rdtsc
lea ebx, [edi*4]
bsr cx, sp
jmp 0xb01363
xchg bl, dh
rdtsc
push word [esp + 1]
add esp, 7
inc dx
sub esp, 0x12
jmp 0xb0140d
rdtsc
rol dh, 2
lea eax, [eax + edi]
lea esi, [ebp*4]
xchg byte [esp + 0xc], dl
jmp 0xb013f7
xchg ecx, ebp
mov cl, 0x39
cpuid
jmp 0xb013a9
not bp
setno bl
mov ebp, 0xb9f6b82a
xchg bh, ah
bt esi, ebp
jmp 0xb0141f
std
cld
rcr ebp, 0xa
mov edi, eax
push word [esp + 2]
mov dword [esp + 0xc], esi
jmp 0xb013d6
dec di
xchg byte [esp + 0xc], dh
mov cx, 0x51ee
xchg esi, eax
bswap edi
mov si, 0xb982
jmp 0xb01747
pop dword [esp + 0x10]
pop word [esp + 1]
mov dx, word [esp + 0xc]
mov esi, dword [esp + 0x10]
xchg word [esp + 9], bx
or dword [esi + 0xf], esp
mov bl, 0xf3

Function at 0xb0171e
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xb02457
lea esp, [esp + 1]
add esp, 0
lea ebp, reloc.MSVFW32.dll_DrawDibDraw
rdtsc
shl bp, 0xa
xchg byte [esp + 1], dl
jmp 0xb01a02
setb bh
call fcn.00b01858
neg di
xchg word [esp + 1], bp
xchg si, dx
mov byte [esp + 0x1a], ch
jmp 0xb01a49
cpuid
call fcn.00b01a70
les edx, [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
mov ah, 0x56
invalid
xchg byte [esp + 8], dh
pop eax
rol bh, cl
pop cx
bsr cx, bp
bswap edx
jmp 0xb01a33
stc
mov ah, bl
rdtsc
mov cx, word [esp + 3]
mov ecx, eax
add esp, 0xb
jmp 0xb01723
Function at 0xb01858
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], cl
pop dword [esp + 2]
mov dword [esp + 9], esi
mov dl, cl
bt di, di
clc
mov di, cx
cld
jmp 0xb01767
neg di
not dx
push dword [esp + 6]
sub esp, 9
mov bh, byte [esp + 0x13]
jmp 0xb01790

Function at 0xb01c95
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ebp
xchg word [esp + 2], ax
mov cx, 0xdb2a
pop bx
jmp 0xb01d7b
mov ah, 0x33
lea esp, [esp + 3]
not si
sub esp, 0xa
xchg dword [esp + 6], eax
mov dword [esp + 7], eax
jmp 0xb01c31
mov dh, byte [esp + 0xf]
cpuid
xchg ecx, ebp
add esp, 0xa
jmp 0xb01c47
xchg dword [esp], ebx
call 0xb01c95
xor byte [ebx + 0x52bd4e2b], bh
push ss
pushfd
xor dl, byte [ebp - 0x5c]
inc esi
imul ecx, dword [eax + reloc.MSVFW32.dll_DrawDibDraw], 0x3246486
xchg byte [esp + 6], ah
jmp 0xb01cd3
xchg dword [esp + 1], edi
pop ebx
mov ecx, eax
push word [esp]
xchg esi, ecx
add esp, 3
jmp 0xb01c7f
add esp, 4
rdtsc
cpuid
mov edi, dword [esp]
lea edi, [ebx + edi]
sub esp, 1
jmp 0xb01d2b
mov dx, 0x2895
xchg si, ax
push bx
cpuid
cpuid
add esp, 4
jmp 0xb01cbd
lea ebp, [eax + esi]
neg edx
mov di, word [esp + 6]
xchg dx, bx
pop bx
jmp 0xb01d11
bswap edx
mov dword [esp + 0x13], ebx
setb bh
mov byte [esp + 0xf], cl
mov bx, word [esp + 0x1a]
rdtsc
jmp 0xb01ce5
lea ebp, reloc.MSVFW32.dll_DrawDibDraw
lea edx, reloc.MSVFW32.dll_DrawDibDraw
xchg bp, cx
rcl cl, 6
jmp 0xb01d53
mov ecx, ebp
xchg byte [esp], ah
sub esp, 0x19
sbb ecx, esp
mov ch, byte [esp + 0x17]
xchg ah, dl
jmp 0xb01cfb
pop bp
mov al, 0x48
lea esi, reloc.MSVFW32.dll_DrawDibDraw
dec ebp
mov bl, byte [esp + 0xe]
jmp 0xb01dae
mov dx, 0xce6c
xchg dword [esp + 0x12], ebx
lea ebx, [ecx + edx]
rdtsc
ror bl, 1
mov bx, 0xedd
jmp 0xb01d3d
mov word [esp + 7], di
mov byte [esp], dl
mov dword [esp + 1], esp
mov ah, byte [esp + 5]
cld
pop word [esp]
jmp 0xb01cab
sub esp, 6
std
rcr ch, 5
mov bp, ax
pushal
xchg dword [esp + 0x14], ebp
jmp 0xb01dc4
mov eax, esi
cld
lea esp, [esp]
mov ecx, dword [esp]
xchg dword [esp + 0x11], edx
lea esi, [esi*4]
jmp 0xb01d95
cmp di, 0xba64
mov byte [esp + 0x24], ch
dec bx
sete bh
pop word [esp + 0x2d]
popal
jmp 0xb01e92
add esp, 0x30
bt si, bx
mov bp, 0x500f
call fcn.00b01dfb
popal
int1
popal
add bl, dh
adc esi, dword [eax + 0x73]
push 0xffffffffffffff85
xor al, 0xf
xor dword [edi - reloc.MSVFW32.dll_DrawDibDraw], ecx
rdtsc
pop dword [esp + 7]
cld
sub cl, 0x8f
sub esp, 0x11
xchg dword [esp + 0x20], ebp
jmp 0xb01e11
mov cl, byte [esp + 0xa]
mov cx, 0x3043
clc
xchg dl, ah
sub esp, 0xa
mov dword [esp + 8], ebx
jmp 0xb01e2c