joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5247a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0x78], ebp
je 0x52495d
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x90]
cmp eax, ebp
je 0x5248d6
mov ecx, dword [esi + 0x94]
sub ecx, eax
mov eax, dword [esp + 0x14]
sar ecx, 4
cmp eax, ecx
jae 0x5248d6
xor ebx, ebx
mov edx, dword [esi + 0x90]
mov eax, dword [esp + 0x10]
add eax, edx
mov ecx, dword [eax + 4]
cmp ecx, ebp
je 0x5248bd
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
cmp ebx, edx
jae 0x5248bd
mov eax, ecx
mov ecx, esi
mov edi, dword [eax + ebx*4]
push edi
call fcn.00525a10
mov ebp, eax
test ebp, ebp
je 0x5248b5
push ebp
mov ecx, esi
call fcn.00526ea0
test eax, eax
je 0x5248b5
mov edx, dword [esi + 0x74]
cmp edi, edx
je 0x5248b5
mov eax, dword [esp + 0x10]
xor ecx, ecx
test ebx, ebx
sete cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x90]
add eax, ecx
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x524876
xor eax, eax
jmp 0x52487e
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
dec eax
xor ecx, ecx
cmp ebx, eax
lea eax, [edi + 1]
sete cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp eax, edx
sete cl
dec edi
mov dword [esp + 0x30], ecx
xor eax, eax
cmp edi, edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x18]
sete al
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x3c], eax
call fcn.00527870
inc ebx
xor ebp, ebp
jmp 0x524807
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc ecx
add eax, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x5247e0
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
call fcn.00525d20
test eax, eax
pop ebx
je 0x52495d
mov ecx, dword [esi + 0x74]
push ecx
mov ecx, esi
call fcn.00525a10
mov edi, eax
cmp edi, ebp
je 0x52495d
push edi
mov ecx, esi
call fcn.00526ea0
test eax, eax
je 0x52495d
mov eax, 1
lea edx, reloc.MSVFW32.dll_DrawDibDraw
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
call fcn.00525f60
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x20], eax
push ecx
mov ecx, esi
call fcn.00525fd0
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push eax
call fcn.00527870
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
Function at 0x52eac0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x59a8c7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x6b7434
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + reloc.MSVFW32.dll_DrawDibDraw], ebx
call fcn.0058291a
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.0058291a
call fcn.0085b7c5
dec edx
push 7
mov byte [esp + 0x170], 2
mov dword [esi], 0x6b7420
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call fcn.00844d27
sbb byte [ebp + 0xb0248c], cl
add byte [eax], al
push ecx
call fcn.0084c7b7
mov dh, 0x8b
into
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.0052f5e0
mov eax, esi
mov ecx, dword [esp + reloc.MSVFW32.dll_DrawDibDraw]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x568640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59d140
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.005681f0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00568270
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00568270
lea ecx, [esi + 0xc]
call fcn.00584a95
lea ecx, [esi + 0x10]
call fcn.00584a95
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00569670
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00569670
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00569670
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00584b0a
lea ecx, [esp + 4]
mov dword [esp + 0x14], reloc.MSVFW32.dll_DrawDibDraw
call fcn.00584b0a
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x75f079
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
jmp 0x75f080
mov byte [esp + 1], al
mov dword [esp + 0x20], esp
pushfd
mov dword [esp + 0x20], ebp
pushal
jmp 0x75f0a6
mov word [esp + 0x16], ax
lea esp, [esp + 7]
lea esp, [esp + 1]
mov dword [esp + 0x34], esi
call fcn.0075f1a8
push 0
jmp 0x76282a
mov bx, 0x9d7
xchg si, bp
cpuid
jmp 0x762864
cmc
jmp 0x76284d
rdtsc
mov cl, byte [esp]
jmp 0x762879
mov esi, dword [esp + 0x2c]
add bp, bx
jge 0x762846
cmc
rdtsc
mov cl, byte [esp]
jmp 0x762879
lea edi, [esp]
mov bx, word [esp]
mov ebx, esi
not bx
jmp 0x7628c0
jmp 0x7629c0
lea esp, [esp + 3]
mov edx, esi
mov bl, 0x27
bswap ecx
xchg cx, ax
call fcn.007628fb
dec esi
int3
sub esp, 0xc0
mov ebp, esp
add eax, 0x4eb55c0a
jno 0x76289d
rdtsc
mov ch, 0xdd
sub esp, 0xb
lea esp, [esp + 3]
jmp 0x7628a6
rdtsc
mov ch, 0xdd
sub esp, 0xb
jmp 0x7628a2

Function at 0x762796
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xc], esp
push esp
mov dword [esp], ebx
pop word [esp]
lea esp, [esp + 1]
jmp 0x7627e9
pushfd
pop word [esp]
mov word [esp], si
push word [esp]
jmp 0x7628ed
lea esp, [esp + 1]
mov dword [esp + 8], ebp
pushal
pop word [esp + 7]
pop word [esp + 0x14]
mov dword [esp + 0x20], esi
jmp 0x7627d3
mov byte [esp], dl
mov dword [esp], ecx
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x762840
pushfd
jmp 0x75f0bc
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x762840
jp 0x762802
mov byte [esp], dl
mov dword [esp], ecx
jmp 0x762893

Function at 0x76281b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 8], ecx
mov dword [esp], eax
push word [esp]
jnp 0x7627c6
jp 0x76278c
Function at 0x7735b6
Capabilities:
Encode data using xor

Disassembly:
push 0xeb558940
call fcn.0077732d
test dword [edi], esi
dec esi
insd dword es:[edi], dx
jle 0x7735a0
cmpsb byte [esi], byte es:[edi]
dec esi
add dword [ecx + ebp], esp
ror dword [eax + 0x73], cl
popal
xor cl, byte [edi - 0x53]
push eax
xchg byte [eax + 0x90f5268], dl
add al, 0x1a
xor byte [ebp + 0xa6b296c], bh
mov edi, 0x93d33c02
or dh, byte [ecx]
xchg esi, eax
cmp eax, 0x169ae694
sbb edx, dword [ebx - 0x52a93fd]
enter 0x7cff, 0xffffffffffffffc3
or bl, byte [0x6b9522c7]
invalid
xchg ebx, eax
push eax
stosb byte es:[edi], al
ljmp 0xc3ae
jmp 0x773512

Function at 0x77cdd3
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x77cdee
mov dword [esp + 3], edx
lea esp, [esp + 6]
mov byte [esp], bh
push word [esp]
ja 0x77cdbd
pop word [esp]
jmp 0x77ce21
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esp
jmp 0x77ce0b
lea esp, [esp + 2]
mov dword [esp + 0x14], ebx

Function at 0x77ceb4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, dword [esp + 0x30]
jmp 0x77cee7
neg cx
ja 0x77ced1
rdtsc
jmp 0x77cef4

Function at 0x77f3fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
push di
call fcn.0077f391
push 0xf076a3b8
jmp 0x77f433
pop word [esp]
push di
jmp 0x77f362
mov dword [esp], esp
push bp
push word [esp]
jge 0x77f35c
jl 0x77f3c0
pushfd
jmp 0x77f367
mov si, 0xe970
rdtsc
inc dx
jno 0x77f508
mov cl, byte [esp]
jmp 0x77f4b6
jmp 0x77f460
mov cl, byte [esp]
mov ebp, dword [esp + 0x2c]
and edx, esp
jle 0x77f476
rcr eax, 3
ror eax, cl
sub esp, 6
lea esp, [esp + 2]
jmp 0x77f492
jmp 0x77f4b3

Function at 0x77f421
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0x77f40b
Function at 0x791539
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.007801e5
jmp fcn.007801f1
mov ax, 0x5637
shr ax, cl
jns 0x78015c
js 0x78018b
push ebp
xlatb
inc edi
and dl, cl
mov cl, 0xca
lea eax, gs:[edi + 0x50]
lea eax, [edi + 0x50]
bsf edx, ebx
je 0x780161
mov edx, 0x5fc127b5
mov edx, 0xfce3e7e3
jmp fcn.0078024c
adc al, 0x3b
jl 0x791523
jge 0x791523
wait
in eax, dx
cld
aas
rol dword [ebx + ebp*2 + reloc.MSVFW32.dll_DrawDibDraw], 0x3f
iretd
call 0x791539
movsb byte es:[edi], byte [esi]
jo 0x7914b0
stosb byte es:[edi], al
std
cmp eax, dword cs:[ecx - reloc.MSVFW32.dll_DrawDibDraw]
cli
aad 0x44
neg dword [edx - 0x73]
and al, 4
inc al
mov edx, ecx
jmp 0x791562
lea edx, [esp + edi]
mov dx, 0x190c
lea edx, reloc.MSVFW32.dll_DrawDibDraw
neg edx
jmp 0x79150d
mov dh, ah
neg edx
jmp 0x7915da
mov edx, dword [esp]
sub esp, 0xa
dec edx
bswap edx
neg edx
lea esp, [esp + 2]
jmp 0x79159d
add cl, al
neg al
jae 0x7915ba
bsf edx, edi
lea eax, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x7915fa
dec edx
bswap edx
neg edx
jmp 0x791577
bsf edx, edi
jmp 0x7915c3
lea eax, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x7915fa
jns 0x79156c
mov edx, dword [esp]
sub esp, 0xa
jmp 0x7915b3
lea eax, [esi + 0xc7]
jmp 0x7916ff
inc ebp
inc edx
je 0x7915e4
lea eax, [esi + 0xc7]
lea edx, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x791670
lea edx, reloc.MSVFW32.dll_DrawDibDraw
neg ax
call int.00791640
rol bl, 0
bsr edx, edi
jb 0x7916c3
xchg edx, eax
jmp 0x7916ad
mov dx, 0xaa99
rdtsc
mov ax, word [esp]
jmp 0x7916cf
xchg edx, eax
mov dx, 0xaa99
rdtsc
mov ax, word [esp]
jmp 0x7916e5
ror bl, 0
setle dl
sub esp, 0x17
jno 0x791784
pop dword [esp + 0xb]
jmp 0x791713
lea edx, reloc.MSVFW32.dll_DrawDibDraw
lea edx, reloc.MSVFW32.dll_DrawDibDraw
neg ax
jmp 0x79167e
xchg dx, ax
lea esp, [esp + 3]
jmp 0x791730
xchg dx, ax
lea esp, [esp + 3]
lea esp, [esp + 0x10]
inc bl
jmp 0x791752
bswap edx
neg bl
lea edx, [eax*4]
not dh
bswap eax
jmp 0x79176b
bswap eax
rdtsc
mov dx, word [esp]
cmc
jns 0x791738
js 0x791767
jle 0x791760
jmp [edi + 0xa]
outsd dx, dword [esi]
or bh, cl
sub byte [edx - 0x33], dl
bswap edx
jmp 0x79173a
mov eax, dword [esp]
bts dx, dx
jns 0x7917fb
js 0x7917fb
pop esp
scasd eax, dword es:[edi]
mov dh, 0xa1
loopne 0x7917a7
pop dword [esp + 0xb]
jmp 0x791729
xchg dl, ah
sub al, 8
jmp 0x7917c6
sub esp, 0
ja 0x79178a
xchg dl, ah
sub al, 8
jmp 0x7917c6
mov edx, eax
jmp 0x7917d3
mov dl, byte [esp]
mov edx, edi
jmp 0x7917d8
xchg ebx, eax
shl dl, cl
js 0x7917ab
mov edx, eax
jmp 0x7917af
mov dl, byte [esp]
mov edx, edi
cbw
mov edx, dword [esp]
jmp 0x7917e3
sub esp, 0x14
jne 0x791817
and edx, 0xa7e291a9
jmp 0x79181d
dec bl
rdtsc
jmp 0x7917a0
bsf dx, di
jno 0x791843
sub esp, 1
sub esp, 0x1b
jmp 0x791820
and edx, 0xa7e291a9
xchg ebx, eax
jmp 0x791801
mov word [esi], bx
bsr edx, eax
jmp 0x791861
bt dx, cx
sub esp, 0x10
jmp 0x780178
sub esp, 1
sub esp, 0x1b
jmp 0x791820
jp 0x79182c
bt dx, cx
sub esp, 0x10
jmp 0x780178
Function at 0x831ad5
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
invalid
outsb dx, byte [esi]
cmp eax, 0x1dcec81a
mov edx, esp
jae 0x831b13
jl 0x831b36
jnp 0x831aab
jo 0x831acd
invalid
jp 0x831b64
add dword [eax - reloc.MSVFW32.dll_DrawDibDraw], edx
cli
and eax, 0x8efd280b
and eax, 0x8efd280b
mov al, byte [0xd5ad5c8]
xor dh, byte [edi]
mov ch, 0x46
adc ch, cl
add al, byte [ebx + 0x50]
pop esp
insb byte es:[edi], dx
and al, 0xe9
aas
add eax, 0xc4b37d0d
invalid
or eax, 0x8cc4b37d
jo 0x831b46
pushfd
movsd dword es:[edi], dword [esi]
mov ecx, 0x8c5124a2
sti
xor dword [edx - 1], esp
or al, 0xfe
jp 0x831b1d
invalid
pushfd
add byte [eax - 0x5a605a6b], 0x89
adc eax, 0x4d728176
fdiv qword [0x72b91cac]
sbb al, ch
in al, dx
das
mov byte [0x64b5238e], al
popfd
push esi
test eax, 0xeaff7940
cmp eax, 0x14cd3813
mov al, byte [0x54d9e601]
pop ds
sbb eax, 0xe134038b
aaa
cli
and dword [ecx + 0x37], 0xbf737193
cdq
leave
and eax, 0x9e7c721b
arpl word [edi + 0x4f], si
hlt
Function at 0x833076
Capabilities:
Encode data using xor

Disassembly:
sbb ch, byte [edx - 0x5250e9ce]
fprem
push ecx
xchg ebp, eax
mov al, byte [0x2d47d670]
pop esp
inc esi
stc
cmp eax, dword [edx]
pop esi
jecxz 0x833056
cmc
dec esi
loopne 0x832ff8
cmp eax, 0xa151045a
sal ah, cl
push eax
xchg ecx, eax
lea ebx, reloc.MSVFW32.dll_DrawDibDraw
invalid
sub ebp, dword [edx - reloc.MSVFW32.dll_DrawDibDraw]
into
loopne 0x833072
sbb byte [eax + 0x7d], ah
cmc
pop ds
xor bh, cl
dec edx
push esp
pop ss
push edi
dec byte [ebx + 0x7ee7ae8a]
adc esp, edx
fdiv dword [esi - reloc.MSVFW32.dll_DrawDibDraw]
arpl word [edx - 0x117b8a53], bp
add dword [esi - 0x33], eax
sub al, 0xef
cmp cl, byte [ecx]
adc ch, byte [ebx]
inc dword [esi + reloc.MSVFW32.dll_DrawDibDraw]
sub edi, edi
xchg ch, dh
inc esi
js 0x833085
cmp edx, dword [bp + si]
out 0x6c, al
insb byte es:[edi], dx
jle 0x833066
scasd eax, dword es:[edi]
cmpsb byte [esi], byte es:[edi]
aaa
invalid
jge 0x833097
inc eax
jg 0x83303f
test esp, ecx
jb 0x833004
dec esi
xchg ebp, eax
sal dword [ecx + edi*8 + reloc.MSVFW32.dll_DrawDibDraw], 0xaa
stosb byte es:[edi], al
add ebx, ebx
or dword [eax + reloc.MSVFW32.dll_DrawDibDraw], edx
pushal
jns 0x8330d0
jns 0x833084
mov dh, 7
dec esi
ror byte [eax + 0x73], 0x6f
dec eax
jae 0x8330e8
jge 0x8330cf
imul ecx, dword [edi], 0x65
xor ecx, dword [reloc.MSVFW32.dll_DrawDibDraw]
xor al, 0x17
pop ss
imul esp, ebx, 0x1e
out dx, al
mov edi, 0x9a32553c
aas
loopne 0x833055
cld
cmc
leave
pop esi
add dword [edi - 0x33], edx
jecxz 0x833034
out dx, al
popfd
insd dword es:[edi], dx
ficomp dword [ecx + 0x57c50afd]
cmc
inc ebx
jb 0x83306e
jno 0x83311c
hlt
shl byte [esi + 0x5e], cl
pop si
cmp dh, byte [edi + edi*8]
sub byte [esi - 0x762e188e], cl
imul ebp, dword [ebx + 0x20], 0x7e
ffree st(4)
ficom word [ecx]
dec esp
fucomp st(5)
fiadd word [eax]
pushfd
jne 0x833162
lahf
ror byte [edx + 0x71], 1
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
imul edx, dword [ecx + reloc.MSVFW32.dll_DrawDibDraw], 0xffffffc1
aas
add eax, 0xc3523b9a
sub dl, dl
push ecx
or al, 0xc2
invalid
mov eax, 0x44843d40
stc
pop esi
pop edi
and eax, 0x1373ac97
pop ebx
xor dword [edx], edi
rol dword [eax], 0xa
xchg ecx, eax
inc esi
movaps xmmword [eax - 0x29], xmm6
sub esi, 0x15e20657
dec edi
popal
mov ebx, 0xc31c6403
lodsb al, byte [esi]
retf
call [eax + 0x3a6d0ec3]
cmp byte [ebp - 3], ch
sub eax, 0xb4c8a799
dec ecx
pop ecx
test al, 0x28
invalid
Function at 0x838001
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0x93
pop edi
jo 0x838053
mov ch, 0x27
or edi, dword [ebx + eax + reloc.MSVFW32.dll_DrawDibDraw]
jne 0x838087
xchg dl, cl
rcl byte [edx - 0x471e8de]
mov dword [reloc.MSVFW32.dll_DrawDibDraw], eax
sti
test eax, 0x3cdca6f0
js 0x838006
sub byte [ebx], bh
dec ecx
or eax, 0xa211835f
mov ebp, 0xfa2499a5
sbb al, 0xbc
xchg ebx, eax
stosd dword es:[edi], eax
daa
sbb eax, 0x861b7ab2
pushal
aad 0x57
sub dword [edx], esp
sal dword [ecx - reloc.MSVFW32.dll_DrawDibDraw], 1
mov al, 0xf9
invalid
or dh, byte cs:[ebx]
sbb ebp, dword [edx]
test byte [ecx + 0x5e], 0xf4
mov al, byte [0xf95886a0]
xor edx, dword [edx + reloc.MSVFW32.dll_DrawDibDraw]
push ecx
mov cl, 0xbf
adc edx, esi
lahf
invalid
std
sbb al, 0x66
out 0xb1, eax
push ecx
dec ecx
out 0xf8, al
loop 0x8380ae
shr dword [eax - 0xd], cl
idiv edi
nop
sub al, 0xd5
outsb dx, byte [esi]
cmp eax, 0xa20e4b95
mov bl, 0x29
in al, dx
aas
lds eax, [eax]
mov byte [0x53a62957], al
push ecx
mov ecx, 0x65489dbf
popal
popfd
dec eax
popal
pop esi
test eax, 0xfd34417a
jmp 0x8380cb
sub dword [edx - 0xa], reloc.MSVFW32.dll_DrawDibDraw
ja 0x8380ab
lahf
xlatb
mov ah, 0xda
fnstsw word [eax + 0x15f653b7]
outsb dx, byte [esi]
loope 0x8380f8
add al, 0xcb
int3
xchg edi, eax
lcall 0xd962, 0xdfb7d838
sbb dword [edi - 0x17], eax
xor eax, 0x9da9648
jo 0x838127
bound edi, qword [edx + 0x1e]
pop esi
lea ebx, reloc.MSVFW32.dll_DrawDibDraw
loop 0x838174
pop es
push cs
inc ebp
dec esi
dec esi
xchg edx, eax
mov word [edi], es
and dl, byte [edx + ebx - 0x5c546b12]
dec ecx
cli
test dword [eax - reloc.MSVFW32.dll_DrawDibDraw], eax
pop edx
mov ah, 0xe4
sub dl, cl
xchg ebx, eax
rcl dword [ebx], cl
xchg ebx, eax
mov dl, byte [esi - 0x40bfa69f]
lock adc dword [ebx - 0x2b], esi
push esi
wait
xchg ebx, esi
or byte [edx + ebp*8 - 0x53], dh
inc ecx
add dword [ebp + 0x30], ebp
xlatb
stc
stosd dword es:[edi], eax
in eax, 0x57
sbb cl, byte [ecx - 0x6a]
xor al, 0x44
jo 0x83813c
jmp 0x34407cf

Function at 0x844d8d
Capabilities:
Encode data using xor

Disassembly:
lea esi, [ecx]
in eax, dx
sub ebx, dword [ecx]
push edi
adc al, 0x56
movsd dword es:[edi], dword [esi]
inc ebp
sbb dword [ecx + edx*4 + 0x5c7933c], 0xffffffa1
sub dword [ecx + ecx*4 + 0x63], edx
imul edi, dword [ecx + 0x71], 0xffffffe8
dec esp
fdiv dword [edx + 0x5a]
fcomp dword [ecx + ebp*4 - 0x3ed69593]
cld
or dword [ebx], ebp
dec esp
or ebx, dword [edx - reloc.MSVFW32.dll_DrawDibDraw]
invalid

Function at 0x8450da
Capabilities:
Encode data using xor

Disassembly:
dec edx
mov ecx, 0xcf40574e
mov cl, byte [esi - 0x74]
inc esi
xor byte [ebx - 0x1605577d], 0x19
jo 0x845053
dec esi
push edi
inc eax
iretd
or cl, ah
inc esi
or dword [edi + ebx - reloc.MSVFW32.dll_DrawDibDraw], ebp
push ss
jl 0x8450ed
arpl word [esi + edx*2 - 0x36], bx
into
invalid
pop ds
in al, dx
je 0x845050
invalid
loope 0x8450c3
sahf
xor dword [edi], edx
adc dh, byte [edx - 6]
sub ch, byte cs:[edi]
cmpsb byte [esi], byte es:[edi]
add al, ch
in al, dx
cmp byte [ebx], 0xae
xlatb
shr byte [edi + edi*4 + 0x6b], 0x67
rep outsd dx, dword [esi]
jmp 0xeffb1bfa
Function at 0x84747c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
rcr byte [edx + 0x2d], cl
add dword [eax - 0x73], 0xf00e6361
push 0xffffffffffffffde
invalid

Function at 0x84d3c7
Capabilities:
Encode data using xor

Disassembly:
push 4
pop es
pop es
mov al, 0x18
test byte [ecx + 0x25], 0x5a
notrack jmp 0xa3d30c5e
dec edx
add ah, byte [esi]
mov byte [0xc808892d], al
pushal
xchg edx, eax
or dword [edi - reloc.MSVFW32.dll_DrawDibDraw], 0xf
dec esi
cwde
aad 0xc0
push ebx
ja 0x84d37e
outsd dx, dword [esi]
invalid

Function at 0x84d6b8
Capabilities:
Encode data using xor

Disassembly:
out 0x15, eax
pop ebx
inc eax
ret 0xac62
jo 0x84d67a
sahf
shl dword [eax + 0x29], 1
add ebx, esp
mov dword [eax - reloc.MSVFW32.dll_DrawDibDraw], 0xe107b83a
out dx, al
or dword [edx + reloc.MSVFW32.dll_DrawDibDraw], eax
clc
mov ecx, 0xdedc8488
loope 0x84d71f
add byte [ecx], bh
mov esp, 0xfa064e55
cli
pop esi
push ebp
sub dword [ebx + 0x67], eax
mov al, 0xe0
dec ebx
out 0xc8, eax
push ss
arpl word [esi], ax
fnstsw word [esi]
out dx, al
mov dl, 0xa7
inc esp
outsb dx, byte [esi]
lea ecx, [ecx - 0x12]
shr byte [ebx + 0x569e8175], cl
pushfd
jle 0x84d73c
idiv byte [ebx - 0x2a]
lodsd eax, dword [esi]
push edx
pop esi
adc ebp, esi
sahf
insd dword es:[edi], dx
inc esp
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
out 0x67, eax
lodsd eax, dword [esi]
xor cl, al
or al, 0x42
jle 0x84d6d7
invalid
pop edi
wait
or eax, 0xb0d0508c
cmp dl, ah
shl dword [ebx + 0x25], 1
inc ebx
out 0x74, al
add eax, 0x39109f2f
movsb byte es:[edi], byte [esi]
xlatb
jne 0x84d75e
daa
or esi, 0x2bebc768
pop edi
push 0x5f2bebc7
cwde
jnp 0x84d6e0
call 0xc4ca9a64
and dl, byte [esi - 0x10]
inc ebp
aas
in al, 9
shr dword [edi - 0x77], cl
xor eax, 0x553482b2
add esi, esi
xor dword [edx], esi
adc ebx, dword [esi - reloc.MSVFW32.dll_DrawDibDraw]
jl 0x84d74b
invalid
xor al, byte [ecx - 0x1883678c]
push ss
xor al, 0xb8
jo 0x84d708
push ss
or al, 0x7f
mov al, 0xed
inc eax
mov esp, 0x1499b116
pop es
iretd

Function at 0x850cbc
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x793f03b]
or byte [edx], dh
sbb word [esi + esi*4], di
xor ah, byte [esi + 0x19]
cmp al, 0xb6
daa
out 0x1c, eax
jp 0x850cc2
mov al, byte [0xebf0e56e]
adc edx, dword [edx - 0x3b]
test al, 0xc5
inc esi
mov dword [reloc.MSVFW32.dll_DrawDibDraw], eax
cmpsb byte [esi], byte es:[edi]
mov edi, dword [ebp + 0x58]
xchg ebx, eax
stosb byte es:[edi], al
push edi
rol edx, 0x5e
dec ebx
into
test al, 0xba
sahf
lea ecx, [edx]
insb byte es:[edi], dx
salc
imul esi, dword [esi], reloc.MSVFW32.dll_DrawDibDraw
sub eax, 0x70604c82
movsb byte es:[edi], byte [esi]
ret 0xa2c2
Function at 0x8594c5
Capabilities:
Encode data using xor

Disassembly:
cli
stc
mov esi, dword [eax]
out dx, al
int 0x6d
push 0xffffffffffffffac
jg 0x8594cf
shr ebp, cl
aam 0x63
sti
cmp eax, 0x2204f0f3
outsd dx, dword [esi]
stosd dword es:[edi], eax
jg 0x859471
cld
add eax, 0xd57ea273
or byte [ebp - 0x1aa42063], dh
salc
inc ebx
mov dh, byte [esi]
daa
dec ebx
xor byte [edi - 0x4a], dh
mov esp, 0xc3cb6db0
rol dword [edx], cl
les esi, [edx - 0x42c8ee1f]
mov dh, cl
xchg esp, eax
not dword [edi + 0x6d]
aaa
mov ebp, 0xf794f18a
push edi
insd dword es:[edi], dx
inc esp
pop ds
xchg ebx, eax
push 0x900fa1db
pushfd
int 0x67
push ebp
jb 0x859494
rcl dword [ebx - 0x37], 0xe3
mov ebx, 0x93e8ffd6
dec esp
xchg byte [ebp - 0x562904b8], al
enter 0xffffffffffffb95a, 0x5d
salc
test eax, 0x5db95ac8
add dword [ecx + 6], esp
jns 0x85945b
pop edi
in al, dx
sbb dword [edx - 0xf1a2ac5], 0xffffff8c
popfd
jne 0x859535
shr byte gs:[ebx], 0x79
shr byte [ebx], 0x79
jo 0x8594b8
pushfd
xrelease xchg dword [0xd0c4581c], ebp
push 0x4196f4ce
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
push ecx
add dword [ecx - reloc.MSVFW32.dll_DrawDibDraw], esi
shl dword [edx + 0x7a], 1
adc bl, 0x6a
adc dl, byte [ebx + 0x12ca80fd]
adc ecx, 0x62
jp 0x859474
shr dword [edx + 0x12], cl
xchg ebx, eax
std
or dl, 0x12
xchg ecx, eax
in al, 0x63
push ebx
jbe 0x8594b9
test bh, dl
or eax, 0xb669147c
das
mov ah, 0x2f
das
pop es
mov al, byte [0xfbcdf220]
push edx
insb byte es:[edi], dx
test al, 0x6e
add eax, dword [ebx - 0x30]
pushal
add ch, dl
outsd dx, dword [esi]
push edx
add eax, 0x12c90190
das
cmp esp, 0xe2fd350
xor al, cl
jb 0x859509
adc esp, dword [eax]
cmpsb byte [esi], byte es:[edi]
sbb eax, 0x6bcbb0da
insb byte es:[edi], dx
jg 0x8594ed
mov al, 0xcb
imul ebp, dword [edi + edi*2 - 0x4e], 0x2f
das
invalid