joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7351e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 1]
jmp 0x735239
pop word [esp + 1]
push dword [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 4], edx
jmp 0x735270
jle 0x73520c
pop word [esp + 1]
push dword [esp + 1]
jmp 0x735262
lea esp, [esp + 2]
mov dword [esp + 4], edx
jmp 0x7354d1
push cx
lea esp, [esp]
mov word [esp], cx
pushfd
lea esp, [esp + 2]
mov dword [esp + 4], ebx
call 0x7353a4
outsb dx, byte [esi]
jns 0x7352e2
and al, 3
push cx
jmp 0x735272

Function at 0x735255
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 5]
mov dword [esp + 4], eax
mov dword [esp], ecx
jmp 0x735234
pop word [esp + 2]
pop word [esp + 5]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.007351e8
push dword [esp + 4]
jo 0x735223
pop word [esp + 2]
jmp 0x7351fe
Function at 0x73528a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0728298
jmp 0x73532e
call fcn.00735255
jmp 0x7352f6
pop word [esp + 7]
jmp 0x735307
pop word [esp + 7]
lea esp, [esp + 3]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x735344
mov dword [esp + 8], esi
pushal
lea esp, [esp + 0xb]
push dword [esp + 0xf]
jg 0x7352d0
jle 0x7352db
lea esp, [esp + 3]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x735344
not ecx
btc bp, bp
jb 0x735360
jae 0x73534a
push 0xf0728298
jmp 0x736b0f
pushfd
jmp 0x7351ee
rdtsc
jmp 0x735387
rdtsc
jmp 0x735387
mov ebp, dword [esp + 0x2c]
lea edi, [ebx*4]
rdtsc
and si, sp
jg 0x735446
jle 0x7353ce
mov ds, word [ecx]
js 0x7353fe
mov dl, 0xeb
shl dword [esi - 9], 1
fucompi st(3)
popal
lodsd eax, dword [esi]
mov esp, 0xf766168f
fucompi st(3)
pop eax
neg di
jmp 0x73540c
neg di
jmp 0x73540c
sub esp, 3
jae 0x7353f0
lea esp, [esp + 3]
jmp 0x7353f4
lea esi, [esp]
mov dh, 0x4a
bsf edx, eax
jle 0x7353a6
jg 0x7353af
bswap edx
sub esp, 0x14
jg 0x73541f
mov dl, 0x95
jmp 0x73542e
lea esp, [esp + 3]
mov ebx, ebp
mov ax, si
jmp 0x7353da
add edx, dword [eax]
jmp 0x738bc1
sub esp, 0xc0
mov edi, esp
lea ecx, [ebp*4]
rdtsc
jmp 0x7353b4
mov dl, 0x95
lea eax, [edi*4]
jmp 0x7354a5
lea eax, [edi*4]
not ch
mov dx, di
jmp 0x7354aa
jmp 0x7353ce
neg edx
jmp 0x73547b
neg edx
lea edx, [ecx + ebx]
jmp 0x73547e
seto ah
xchg al, ch
setle al
bsr ax, si
je 0x735448
jne 0x735450
lea edx, [ecx + ebx]
not ebp
bsr ecx, ecx
jmp 0x7354ae
mov ax, cx
not ax
mov edx, esp
pushfd
pop word [esp]
mov ecx, esi
jmp 0x7354bb
not ch
mov dx, di
not ebp
jmp 0x73546b
jb 0x735489
mov ax, cx
not ax
jmp 0x735b09
rdtsc
xor edx, ebp
jo 0x735881
lea esp, [esp + 2]
jmp 0x735885
mov dh, 0xe1
setbe ch
push si
call fcn.0073551f
not cx
lea ecx, reloc.MSVFW32.dll_DrawDibDraw
call fcn.007355fe
invalid
add ebp, 0x78d1e2b0
mov cl, byte [esp]
lea eax, [esi*4]
xor ebp, 0x4e383841
jmp 0x7355b9
dec ebp
sete ah
lea eax, [ecx + ebx]
lea ecx, [edx + edi]
mov ah, bl
mov eax, dword [esp]
jmp 0x735625
lea esp, [esp + 2]
jmp 0x73578e
mov edx, esp
pushfd
pop word [esp]
jmp 0x735496
xchg bl, dl
dec cx
jg 0x736f99
bsr esi, esp
jmp 0x736f83
mov edi, dword [esp + 0x2c]
call fcn.00736fbd
mov al, byte [edi]
xchg edi, eax
add dword [eax + reloc.MSVFW32.dll_DrawDibDraw], ecx
mov eax, 0xbd0f15da
hlt
bsr esi, esp
jmp 0x736f83
mov ecx, ebp
lea ecx, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x738954
mov ecx, 0xb7961d78
mov ecx, ebp
lea ecx, reloc.MSVFW32.dll_DrawDibDraw
mov ecx, esp
push eax
ret
mov esp, ebp
dec cx
ja 0x738947
mov ecx, 0xb7961d78
jmp 0x7388c7
push ebp
xchg word [esp], cx
mov cx, 0x4814
jmp 0x738b3e
push ebp
xchg word [esp], cx
mov cx, 0x4814
jmp 0x7389e4
bsr cx, bx
je 0x738b35
jne 0x738ab3
lea ecx, [ebx + esi]
call fcn.00738c1a
dec edi
leave
pop ecx
cmp bl, cl
cmpsd dword [esi], dword es:[edi]
out dx, eax
push 0xfffffffffffffff8
lahf
push 0x75
add ecx, dword [edi - reloc.MSVFW32.dll_DrawDibDraw]
mov byte [0xf2802cdd], al
sub byte [edx - 0x137cdbdc], cl
add dh, byte [edx - 0x51]
not eax
lea ecx, [ebx + esi]
jmp 0x738bd4
Function at 0x73528f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0728298
jmp 0x73532e
call fcn.00735255
jmp 0x7352f6
pop word [esp + 7]
jmp 0x735307
pop word [esp + 7]
lea esp, [esp + 3]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x735344
mov dword [esp + 8], esi
pushal
lea esp, [esp + 0xb]
push dword [esp + 0xf]
jg 0x7352d0
jle 0x7352db
lea esp, [esp + 3]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x735344
not ecx
btc bp, bp
jb 0x735360
jae 0x73534a
push 0xf0728298
jmp 0x736b0f
pushfd
jmp 0x7351ee
rdtsc
jmp 0x735387
rdtsc
jmp 0x735387
mov ebp, dword [esp + 0x2c]
lea edi, [ebx*4]
rdtsc
and si, sp
jg 0x735446
jle 0x7353ce
mov ds, word [ecx]
js 0x7353fe
mov dl, 0xeb
shl dword [esi - 9], 1
fucompi st(3)
popal
lodsd eax, dword [esi]
mov esp, 0xf766168f
fucompi st(3)
pop eax
neg di
jmp 0x73540c
neg di
jmp 0x73540c
sub esp, 3
jae 0x7353f0
lea esp, [esp + 3]
jmp 0x7353f4
lea esi, [esp]
mov dh, 0x4a
bsf edx, eax
jle 0x7353a6
jg 0x7353af
bswap edx
sub esp, 0x14
jg 0x73541f
mov dl, 0x95
jmp 0x73542e
lea esp, [esp + 3]
mov ebx, ebp
mov ax, si
jmp 0x7353da
add edx, dword [eax]
jmp 0x738bc1
sub esp, 0xc0
mov edi, esp
lea ecx, [ebp*4]
rdtsc
jmp 0x7353b4
mov dl, 0x95
lea eax, [edi*4]
jmp 0x7354a5
lea eax, [edi*4]
not ch
mov dx, di
jmp 0x7354aa
jmp 0x7353ce
neg edx
jmp 0x73547b
neg edx
lea edx, [ecx + ebx]
jmp 0x73547e
seto ah
xchg al, ch
setle al
bsr ax, si
je 0x735448
jne 0x735450
lea edx, [ecx + ebx]
not ebp
bsr ecx, ecx
jmp 0x7354ae
mov ax, cx
not ax
mov edx, esp
pushfd
pop word [esp]
mov ecx, esi
jmp 0x7354bb
not ch
mov dx, di
not ebp
jmp 0x73546b
jb 0x735489
mov ax, cx
not ax
jmp 0x735b09
rdtsc
xor edx, ebp
jo 0x735881
lea esp, [esp + 2]
jmp 0x735885
mov dh, 0xe1
setbe ch
push si
call fcn.0073551f
not cx
lea ecx, reloc.MSVFW32.dll_DrawDibDraw
call fcn.007355fe
invalid
add ebp, 0x78d1e2b0
mov cl, byte [esp]
lea eax, [esi*4]
xor ebp, 0x4e383841
jmp 0x7355b9
dec ebp
sete ah
lea eax, [ecx + ebx]
lea ecx, [edx + edi]
mov ah, bl
mov eax, dword [esp]
jmp 0x735625
lea esp, [esp + 2]
jmp 0x73578e
mov edx, esp
pushfd
pop word [esp]
jmp 0x735496
xchg bl, dl
dec cx
jg 0x736f99
bsr esi, esp
jmp 0x736f83
mov edi, dword [esp + 0x2c]
call fcn.00736fbd
mov al, byte [edi]
xchg edi, eax
add dword [eax + reloc.MSVFW32.dll_DrawDibDraw], ecx
mov eax, 0xbd0f15da
hlt
bsr esi, esp
jmp 0x736f83
mov ecx, ebp
lea ecx, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x738954
mov ecx, 0xb7961d78
mov ecx, ebp
lea ecx, reloc.MSVFW32.dll_DrawDibDraw
mov ecx, esp
push eax
ret
mov esp, ebp
dec cx
ja 0x738947
mov ecx, 0xb7961d78
jmp 0x7388c7
push ebp
xchg word [esp], cx
mov cx, 0x4814
jmp 0x738b3e
push ebp
xchg word [esp], cx
mov cx, 0x4814
jmp 0x7389e4
bsr cx, bx
je 0x738b35
jne 0x738ab3
lea ecx, [ebx + esi]
call fcn.00738c1a
dec edi
leave
pop ecx
cmp bl, cl
cmpsd dword [esi], dword es:[edi]
out dx, eax
push 0xfffffffffffffff8
lahf
push 0x75
add ecx, dword [edi - reloc.MSVFW32.dll_DrawDibDraw]
mov byte [0xf2802cdd], al
sub byte [edx - 0x137cdbdc], cl
add dh, byte [edx - 0x51]
not eax
lea ecx, [ebx + esi]
jmp 0x738bd4
Function at 0x7353a4
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0728298
jmp 0x73532e
call fcn.00735255
jmp 0x7352f6
pop word [esp + 7]
jmp 0x735307
pop word [esp + 7]
lea esp, [esp + 3]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x735344
mov dword [esp + 8], esi
pushal
lea esp, [esp + 0xb]
push dword [esp + 0xf]
jg 0x7352d0
jle 0x7352db
lea esp, [esp + 3]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x735344
not ecx
btc bp, bp
jb 0x735360
jae 0x73534a
push 0xf0728298
jmp 0x736b0f
pushfd
jmp 0x7351ee
rdtsc
jmp 0x735387
rdtsc
jmp 0x735387
mov ebp, dword [esp + 0x2c]
lea edi, [ebx*4]
rdtsc
and si, sp
jg 0x735446
jle 0x7353ce
mov ds, word [ecx]
js 0x7353fe
mov dl, 0xeb
shl dword [esi - 9], 1
fucompi st(3)
popal
lodsd eax, dword [esi]
mov esp, 0xf766168f
fucompi st(3)
pop eax
neg di
jmp 0x73540c
neg di
jmp 0x73540c
sub esp, 3
jae 0x7353f0
lea esp, [esp + 3]
jmp 0x7353f4
lea esi, [esp]
mov dh, 0x4a
bsf edx, eax
jle 0x7353a6
jg 0x7353af
bswap edx
sub esp, 0x14
jg 0x73541f
mov dl, 0x95
jmp 0x73542e
lea esp, [esp + 3]
mov ebx, ebp
mov ax, si
jmp 0x7353da
add edx, dword [eax]
jmp 0x738bc1
sub esp, 0xc0
mov edi, esp
lea ecx, [ebp*4]
rdtsc
jmp 0x7353b4
mov dl, 0x95
lea eax, [edi*4]
jmp 0x7354a5
lea eax, [edi*4]
not ch
mov dx, di
jmp 0x7354aa
jmp 0x7353ce
neg edx
jmp 0x73547b
neg edx
lea edx, [ecx + ebx]
jmp 0x73547e
seto ah
xchg al, ch
setle al
bsr ax, si
je 0x735448
jne 0x735450
lea edx, [ecx + ebx]
not ebp
bsr ecx, ecx
jmp 0x7354ae
mov ax, cx
not ax
mov edx, esp
pushfd
pop word [esp]
mov ecx, esi
jmp 0x7354bb
not ch
mov dx, di
not ebp
jmp 0x73546b
jb 0x735489
mov ax, cx
not ax
jmp 0x735b09
rdtsc
xor edx, ebp
jo 0x735881
lea esp, [esp + 2]
jmp 0x735885
mov dh, 0xe1
setbe ch
push si
call fcn.0073551f
not cx
lea ecx, reloc.MSVFW32.dll_DrawDibDraw
call fcn.007355fe
invalid
add ebp, 0x78d1e2b0
mov cl, byte [esp]
lea eax, [esi*4]
xor ebp, 0x4e383841
jmp 0x7355b9
dec ebp
sete ah
lea eax, [ecx + ebx]
lea ecx, [edx + edi]
mov ah, bl
mov eax, dword [esp]
jmp 0x735625
lea esp, [esp + 2]
jmp 0x73578e
mov edx, esp
pushfd
pop word [esp]
jmp 0x735496
xchg bl, dl
dec cx
jg 0x736f99
bsr esi, esp
jmp 0x736f83
mov edi, dword [esp + 0x2c]
call fcn.00736fbd
mov al, byte [edi]
xchg edi, eax
add dword [eax + reloc.MSVFW32.dll_DrawDibDraw], ecx
mov eax, 0xbd0f15da
hlt
bsr esi, esp
jmp 0x736f83
mov ecx, ebp
lea ecx, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x738954
mov ecx, 0xb7961d78
mov ecx, ebp
lea ecx, reloc.MSVFW32.dll_DrawDibDraw
mov ecx, esp
push eax
ret
mov esp, ebp
dec cx
ja 0x738947
mov ecx, 0xb7961d78
jmp 0x7388c7
push ebp
xchg word [esp], cx
mov cx, 0x4814
jmp 0x738b3e
push ebp
xchg word [esp], cx
mov cx, 0x4814
jmp 0x7389e4
bsr cx, bx
je 0x738b35
jne 0x738ab3
lea ecx, [ebx + esi]
call fcn.00738c1a
dec edi
leave
pop ecx
cmp bl, cl
cmpsd dword [esi], dword es:[edi]
out dx, eax
push 0xfffffffffffffff8
lahf
push 0x75
add ecx, dword [edi - reloc.MSVFW32.dll_DrawDibDraw]
mov byte [0xf2802cdd], al
sub byte [edx - 0x137cdbdc], cl
add dh, byte [edx - 0x51]
not eax
lea ecx, [ebx + esi]
jmp 0x738bd4
Function at 0x736fbd
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
jmp 0x736fdb
rdtsc
jmp 0x736fdb
pushal
sub bp, bx
jbe 0x736f9e
ja 0x736fa6
xchg bx, ax
jmp 0x737379
lea esi, [esp + 0x24]
neg cl
jns 0x736fc5
xchg bx, ax
lea ebp, [ebp*4]
push sp
lea esp, [esp + 2]
jmp 0x737326
mov ax, cx
mov dx, 0x10c1
jmp 0x737149
sub esp, 0x9c
mov ebp, esp
bt ecx, ebx
jne 0x7372d1
mov ax, cx
mov dx, 0x10c1
jmp fcn.00737150
lea ebp, [ebp*4]
push sp
lea esp, [esp + 2]
jmp 0x737326
Function at 0x74325c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
not al
jmp 0x74335d
jmp 0x74338f
lea eax, [esi*4]
lea esp, [esp + 3]
neg cl
xor ax, si
jl 0x743347
mov ah, 0xf
dec ah
mov ax, bx
jmp 0x7433c2
jmp 0x743398
mov ah, 0xf
dec ah
mov ax, bx
jmp 0x7433c2
shr ax, 2
bswap eax
add bl, cl
jmp 0x743425
sub eax, 0x6c0495da
mov ah, 0x9f
bt cx, dx
jmp 0x7433dc
xor cl, 0x7f
lea eax, [edx + 0xe5]
mov eax, ebp
and eax, 0x4f1eafb0
js 0x743378
shr ax, 2
bswap eax
jmp 0x74339e
dec edi
mov eax, ebx
inc ecx
jp 0x74340e
jnp 0x7433f8
mov ebp, 0x46cbac3e
push ecx
lea edx, [ebx]
and esi, 0x15
cmp byte [esi], dl
and dword [esi + 0xf], 0xe4ebd1a3
bt cx, dx
jmp 0x7433dc
mov ax, sp
clc
mov cx, word [esp]
jmp 0x743434
mov ax, sp
clc
mov cx, word [esp]
setbe cl
sub esp, 0x13
jmp 0x743464
jno 0x7433a6
sub eax, 0x6c0495da
mov ah, 0x9f
jmp 0x7433f2
setbe cl
sub esp, 0x13
jmp 0x743464

Function at 0x744343
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc eax, edi
jbe 0x744376
ja 0x744376
dec ebp
invalid
ror edx, 0
jmp fcn.00744360

Function at 0x779591
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp]
push esi
mov esi, ecx
jmp 0x7795a9
shr edi, 0x10
stc
stc
jmp 0x779593
jmp 0x77956f
and edi, esi
jmp 0x7795f6
lea esi, [esi*4]
lea esi, reloc.MSVFW32.dll_DrawDibDraw
mov ecx, dword [esi]
pop esi
jmp 0x779577
push edx
mov edx, edi
lea edx, [edx*4]
jmp 0x7795e0

Function at 0x779682
Capabilities:
Encrypt data using aes

Disassembly:
cmc
jmp 0x7796a1
mov edx, dword [edx*4 + reloc.MSVFW32.dll_DrawDibDraw]
jmp 0x77966c
movzx edi, byte [edi*4 + 0x732fc8]
jmp 0x7796d9
shr edi, 0x18
jmp 0x77968b
xor ecx, edx
jmp 0x7796fa
xor ecx, edi
inc di
and edx, ebp
lea edi, [esp + ebx]
jmp 0x7796c3
lea edi, [eax + 0x10]
bswap edx
mov edx, esp
jmp 0x779733
lea esp, [esp + 0xc]
xor ecx, dword [ebx]
mov dh, dl
bswap edi
jmp 0x7796e4
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
jmp 0x77971d
Function at 0x7f28ad
Capabilities:
Encode data using xor

Disassembly:
call [edx - 0xdd1396f]
jno 0x7f28a6
add byte [edi - 0x5bd30f90], bh
retf 0x3c0
cmpsb byte [esi], byte es:[edi]
push ebp
sbb byte [edx + 0x51ddcc35], 0x7e
loop 0x7f2878
lodsd eax, dword [esi]
mov word [eax], gs
sub dword [esi - reloc.MSVFW32.dll_DrawDibDraw], 0xffffff9b
wait
cmp al, 0x56
sahf
mov bh, 0x2b
div dword [ebp - 0x1d]
jne 0x7f2892
jne 0x7f2892
fisubr dword [ebp + reloc.MSVFW32.dll_DrawDibDraw]
scasd eax, dword es:[edi]
pop ss
jb 0x7f2937
mov ecx, 0x55f5067c
mov dword [esp + edi*4 - 0x71], eax
add eax, 0xe27d9de1
mov esp, 0x9de1058f
jge 0x7f28a9
outsd dx, dword [esi]
cmp dword [ebp - 0x15], 0x1d
in al, 0x31
xor al, 0xaa
mov cl, 0x28
pop esi
adc ebp, dword [edx]
pop es
cwde
and eax, edx
stosb byte es:[edi], al
sub eax, 0xf24a1640
xor byte [ecx - 0x6b], 0x69
pop esi
mov dh, 0x3f
je 0x7f28c0
rcr dword [ebp + ecx*4 - 0x13], cl
sbb ecx, dword [ecx]
push ebx
mov edx, 0x9a379597
xor al, 0x8b
cmp byte [esi], dl
cmp al, 0x41
jnp 0x7f295a
mov ebp, 0x591b50
salc
xchg ebp, eax
dec ebp
sti
fld dword [ebp - 0x38d90b01]
or eax, 0x764b8a8
sal dword [eax + 0x77], cl
clc
push esi
sar byte [esi + 0xd], 1
pop eax
push 1
retf 0x1603
in al, dx
test eax, 0x8522148e
adc dword [esp + esi*8 - reloc.MSVFW32.dll_DrawDibDraw], ebp
inc ecx
cld
xor ah, bh
salc
fist dword [edi + esi*2 + reloc.MSVFW32.dll_DrawDibDraw]
outsd dx, dword cs:[si]
mov bl, 0x25
stosb byte es:[edi], al
stc
cmpsd dword [esi], dword es:[edi]
invalid
mov al, 0xa5
pop ebx
push edx
mov dl, 0x97
and esi, eax
and eax, 0xd681aa60
mov esi, 0x7176c483
mov eax, 0x41e13bf3
pop ds
invalid

Function at 0x7f5557
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xfdf09200
xlatb
and byte [ebp - 0x7f], dl
fcom st(4)
wait
out 0xae, eax
add byte [edx + 0x20d7fdf0], dl
push ebp
sbb eax, 0xaee79bd4
fmul dword [ecx]
adc eax, 0x66d1a061
pop es
pop es
or esi, dword [edx*2 - reloc.MSVFW32.dll_DrawDibDraw]
aam 0x12
push ebp
pop ebx
xor edx, dword [edx - reloc.MSVFW32.dll_DrawDibDraw]
push ecx
add byte [ebp + 0x2020e89b], ch
mov ss, word [edx]
or eax, 0xffb53793
sub ebp, ebx
test ch, bh
insd dword es:[edi], dx
cdq
imul ecx, dword [eax - reloc.MSVFW32.dll_DrawDibDraw], 0x5aad8f10
mov al, 0x83
jp 0x7f556a
inc esp
xor dl, byte [edx + 0x3a]
and byte [esp + ecx + 0x3f], ch
push ds
leave
xor byte [ebx + ecx*2], bl
out 0xd8, al
fild qword [ebp - 0x44]
idiv dword [ebx + 0x3b]
push ebp
stosd dword es:[edi], eax
xchg edx, eax
xchg bl, cl
pop ecx
daa
and al, 0xbc
push edi
pop bx
sub bl, byte [edx - 0x588606d1]
not ecx
cli
jnp 0x7f5556
loopne 0x7f555d
stosb byte es:[edi], al
leave
xlatb
invalid
Function at 0x7f5673
Capabilities:
Encode data using xor

Disassembly:
inc ebx
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
dec edi
mov byte [0x4f8186d8], al
cwde
xor eax, 0x2b6569e9
cmp eax, ebp
jp 0x7f565d
adc ah, bl
inc ebx
jecxz 0x7f56b2
jecxz 0x7f565b
outsb dx, byte [esi]
or dword [reloc.MSVFW32.dll_DrawDibDraw], eax
add eax, 0x2151fd59
add eax, 0x2151fd59
xchg edi, eax
fistp word [eax]
cmp dword [ebx], esi
clc
sbb byte [ecx], bh
xor edi, eax
jle 0x7f5687
push ds
jp 0x7f567a
and dh, dh
mov bl, 0x71
scasb al, byte es:[edi]
sub byte [eax + 0x33], bh
dec ebx
inc edi
add byte [edi - 0x47], dh
stosb byte es:[edi], al
cmp ecx, dword [edx + reloc.MSVFW32.dll_DrawDibDraw]
loopne 0x7f566d
cdq
invalid
mov al, byte [0x50a54e9d]
ljmp 0xa03b

Function at 0x7f842b
Capabilities:
Encode data using xor

Disassembly:
iretd
mov esi, dword [edx + 7]
movsd dword es:[edi], dword [esi]
fmul qword [esi - 0x1d]
fmul dword [esi + reloc.MSVFW32.dll_DrawDibDraw]
pop edx
ficomp dword [edi + 0x28]
mov dl, 0x5d
xor dword [edi - 0x3f], ebx
add eax, 0x4a65ccbe
jmp dword [ecx + 0x71c11daf]
xor ch, byte [ebx - 5]
out dx, al
loope 0x7f83a9
mov esi, 0xbd0d840
adc al, 0x47
salc
lodsd eax, dword [esi]
mov byte [0x1481de50], al
xchg esp, eax
mov edi, 0x4ece316e
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
int 0x37
jo 0x7f838e
add eax, 0xbf0a5474
fsub dword [ecx - reloc.MSVFW32.dll_DrawDibDraw]
je 0x7f844f
or bh, byte [edi + 0x7130a1d8]
stc
out dx, eax
push 7
sbb bh, ch
lodsb al, byte [esi]
cmpsd dword [esi], dword es:[edi]
test eax, 0x42ff9528
xor byte [bp + si + 0x64], 0x18
inc dword [edx + 0x67]
xor byte [edx + 0x64], 0x18
or dword [edx - reloc.MSVFW32.dll_DrawDibDraw], esi
movsb byte es:[edi], byte [esi]
movlps qword [edx - 0x17], xmm4
dec eax
popal
je 0x7f840d
lea edx, reloc.MSVFW32.dll_DrawDibDraw
xchg esi, eax
not dword [edi - 0x2f]
push edi
ror dword [reloc.MSVFW32.dll_DrawDibDraw], 1
jne 0x7f8468
das
pop edi
fbld tbyte [0x3680a268]
and edx, dword [esi + esi*2 - reloc.MSVFW32.dll_DrawDibDraw]
mov edi, 0xe7025c5d
ja 0x7f83f9
push es
xchg ecx, eax
mov esp, 0xc46fa960
jns 0x7f84d0
test eax, 0x7d79c46f
outsd dx, dword [esi]
les edi, [ecx + 0x7d]
or byte [eax - 0x646d6910], al
lea ebp, [ebx]
nop
add byte [eax + 0x560881ad], dl
dec ebp
out dx, al
jle 0x7f844e
adc al, 0x62
int3
dec ebx
dec edi
out dx, eax
invalid

Function at 0x7f9e73
Capabilities:
Encode data using xor

Disassembly:
aaa
in al, dx
jo 0x7f9eb1
mov ecx, 0x3273722d
invalid
test dword [edx], esi
or dl, byte [edi + 6]
Function at 0x7fc2df
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0xaaddf63a
adc byte [edx], al
cli
inc edx
popfd
cmp dh, byte [ecx - 0x71]
xor byte [edi + 0x67], ah
invalid
jg 0x7fc2cd
idiv byte [eax]
pop esp
sub ah, byte [esi + 0x46]
stosb byte es:[edi], al
dec ebp
jl 0x7fc319
mov bh, 0x39
push ebp
add byte [edx - 0x52], 0xb0
je 0x7fc364
invalid
invalid
mov eax, 0x101ae96a
push edx
dec esp
cwde
scasb al, byte es:[edi]
lea ecx, [ebx - 0x5f]
inc esi
xchg ecx, eax
jbe 0x7fc38f
dec ebp
scasb al, byte es:[edi]
stc
push edi
dec edi
pop ebx
punpcklwd mm0, dword [edx]
fidiv word [ecx]
lahf
mov ah, 0xe4
invalid
add ebx, dword [ecx - reloc.MSVFW32.dll_DrawDibDraw]
cmp eax, 0x6ec717ce
loopne 0x7fc339
into
pop ss
invalid
movsb byte es:[edi], byte [esi]
and al, 0x28
je 0x7fc3ef
cwde
xchg dword [esi + ecx*8 + 0x269f1bae], edi
inc ecx
mov ebx, 0xfb58ed89
aam 0xe4
outsb dx, byte [esi]
xchg esp, eax
jl 0x7fc3f8
mov dl, 0x2a
cmp dword [esi + edi], esi
xor al, 0x3e
xchg edx, edx
jae 0x7fc36b
mov ebx, 0xcff36278
cmp al, byte [ecx]
and esp, ebx
movsd dword es:[edi], dword [esi]
and eax, 0xe8116cdb
int1
pop esp
dec esi
test byte [eax - 0xd], cl
shr dword [edx + reloc.MSVFW32.dll_DrawDibDraw], 1
fcmovnu st(0), st(0)
in al, dx
dec esp
inc esp
sbb edx, dword [edx]
ja 0x7fc418
push ds
or dh, byte es:[eax]
or bl, byte [ecx + 0x47]
add esp, dword [ecx + 0x7f]
cmp dword [ebp - 0x1a], edi
sub byte [ebx - 0xb7eb01a], bl
mov ecx, 0x5b887e76
adc eax, 0xa5498fec
test byte [ebx + 0x6b51898c], ah
mov ebp, 0x9eccbf8b
stc
movsb byte es:[edi], byte [esi]
sahf
arpl word [edx + 0x4ba5dcc1], ax
test al, 0x77
div dword [ecx - 0x7e]
push edi
scasd eax, dword es:[edi]
mov esi, 0xeae4add3
and byte [edx - 0x32], bl
into
stosd dword es:[edi], eax
xor dword [ebx - reloc.MSVFW32.dll_DrawDibDraw], ebp
shr dword [ebx + 0xd], cl
xor dword [edi + reloc.MSVFW32.dll_DrawDibDraw], esi
or eax, 0x95ab731
test al, 0x45
fdivr qword [eax + 2]
or eax, 0x42eb2a8d
mov dh, byte [esp + ecx]
sub byte [ecx], dh
cmc
stosb byte es:[edi], al
sub al, 0xea
mov bh, 0x32
push ebx
cli
pop edx
imul ebp, dword [edx - reloc.MSVFW32.dll_DrawDibDraw], 0x6e
pop ebp
pop ecx
je 0x7fc43e
je 0x7fc43e
push esp
int3
jo 0x7fc429
cmpsd dword [esi], dword es:[edi]
mov dh, 0xe0
adc eax, 0xfa8c75fe
mov ebp, 0x4f7d100b
imul word [esi - 0x25]
xchg edi, eax
inc edi
cli
lea esi, [edx + 0x46]
mov dl, 0x1b
repne lodsd eax, dword [esi]
daa
sar byte [0xa837ce05], 1
and edi, dword [ebp + reloc.MSVFW32.dll_DrawDibDraw]
scasd eax, dword es:[edi]
lahf
dec ecx
loope 0x7fc402
retf 0x98eb

Function at 0x7fd2b1
Capabilities:
Encode data using xor

Disassembly:
aas
mov esi, 0xe7160aa2
in eax, dx
mov byte [0xede7160a], al
xor ch, byte [bx + 0x44]
jb 0x7fd2b3
fstp qword [ecx - 0x132b0c53]
dec ebp
add byte [esi + 0x15], dl
ret

Function at 0x7ff95a
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [ebx]
nop
fsub st(0)
and eax, 0xbbc6481d
invalid
Function at 0x8092ec
Capabilities:
Encode data using xor

Disassembly:
and ebx, edi
popfd
pop edx
sub edi, ebx
invalid
xor dword [ebp + reloc.MSVFW32.dll_DrawDibDraw], edi
std
scasb al, byte es:[edi]
cmp ah, byte [edi + esi]
and cl, byte [ecx + 0x79]
jp 0x809336
faddp st(1)
lodsb al, byte [esi]
jp 0x8092b5
sbb edx, dword [edx]
mov dl, 0x12
rcr dl, 0x32
outsd dx, dword [esi]
and dl, byte [eax]
wait
and esp, dword [edx + 0x22]
int 0xcf
pop ecx
sahf
cmp al, 0xff
mov ah, 0x22
adc dword [edi - 5], edi
push ds
insd dword es:[edi], dx
cmp byte [ebx + 0x7a85bd24], dh
dec byte [ecx - 0x6e]
adc al, 0xe7
in al, dx
mov byte [0x83425065], al
mov al, byte [0xe4e51756]
ret
out dx, eax
sbb dl, al
cli
xor al, 0xa6
pop ebp
cdq
imul ebx, dword [ecx], reloc.MSVFW32.dll_DrawDibDraw
imul byte [ecx + 0x56357360]
rcl ebp, 1
imul esi, dword [edi], reloc.MSVFW32.dll_DrawDibDraw
aad 0xc8
adc al, 0x3c
rol esi, 0x14
or byte [ebp + 0x74], bl
sbb dword [esi*2 + 0x1199757], eax
sti
int1
dec eax
and ecx, esi
mov al, byte [0x89eb617e]
xchg edi, eax
lds ecx, [esi - 0x17f2c33c]
out dx, al
dec edi
pop edx
pop edx
inc eax
adc ebx, dword [ebx - 0x1c]
mov ah, byte [ecx - 0x21]
or eax, dword [edx - 0x5a]
dec edi
mov edx, 0x3f8e99ee
and edi, dword [ebp + reloc.MSVFW32.dll_DrawDibDraw]
div byte [edi + 0x75]
cdq
rep stosd dword es:[edi], eax
in al, dx
clc
test al, 0x28
sbb dword [edi], esi
ret
Function at 0x80fe53
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
jmp 0x63cb86a1
and ecx, dword [edi - 0x19]
mov dword [edx], esp
jge 0x80fea4
sub eax, 0x2b610d53
xor edi, esp
pop edx
inc edx
mov edi, 0xef14783a
push eax
lodsd eax, dword [esi]
shl byte [esp + esi - 0x473e0ba2], cl
and ecx, ebp
jb 0x80fee4
adc esp, dword [eax]
rol byte [0xf044d977], cl
and byte [esi], ch
hlt
jno 0x80fe28
pop edx
pop esi
push esp
push esi
aad 0x2d
xor dword [esi + reloc.MSVFW32.dll_DrawDibDraw], ecx
inc edi
in al, 0xf4
enter 0x5266, 0xffffffffffffffd4
mov bh, 0xc7
enter 0xffffffffffffb2cd, 0x4a
cld
mov byte [0x7fa66979], al
outsd dx, dword [esi]
mov ecx, 0x87bc9805
mov cl, 0x62
dec edx
cdq
sub al, 0x2b
sub byte [ebx + 0x6206501a], dh
xor ebx, dword [edi]
adc byte [ebp + 0x1e], 0xb1
insd dword es:[edi], dx
cmp esp, dword [edi + reloc.MSVFW32.dll_DrawDibDraw]
jg 0x80feb1
int3
scasb al, byte es:[edi]
sub eax, 0x675332b3
push edx
mov ecx, 0x9b4bd042
dec edx
aam 0xc
std
xor byte [ecx], ch
xor edi, ebp
imul esp, dword [ebp - reloc.MSVFW32.dll_DrawDibDraw], 0x9f7b5d07
jle 0x80ff58
pop edx
jno 0x80ff65
inc edx
dec ebx
fsub dword [ebx]
inc esi
xchg dl, dl
bound esi, qword [esp + ecx - 0x59]
xchg esp, eax
push ds
lds esi, [edi + 0x7e]
push esp
adc al, 0xd
xchg esi, eax
sub cl, byte [ecx - 0x5a]
daa
iretd
movsb byte es:[edi], byte [esi]
add byte [edi + ecx*4], bl
adc al, 0x9b
das
in eax, 0xa3
jbe 0x80ffb4
ret
mov dh, byte [edi + 0x77]
int 0xa6
push edi
and dword [ebp + ebx*4 + 0x25], esi
bound ebx, qword [ebx]
xchg ecx, eax
cmp ecx, dword [edx]
adc esi, dword [ebx]
push es
cwde
pop edi
psubq mm7, qword [ecx - 0x3967b3de]
dec esp
invalid
rol dword [edi + 0x2e], cl
and eax, 0x2dd31fe2
jecxz 0x80ffef
mov byte [ebp + 0x7bc3d8a7], ch
dec esp
sbb ecx, dword [edi]
mov ecx, 0xc1788dcd
sti
popal
sbb ch, bh
inc edx
dec eax
xchg ebp, eax
outsb dx, byte [esi]
cwde
shr dh, cl
invalid
dec ecx
retf 0xe94b