joyce8/EMBER2024-capa huggingface dataset:
Function at 0x78cd26
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, reloc.MSVFW32.dll_DrawDibDraw
mov dword [esp], edx
pushal
rdtsc
mov ecx, dword [esp]
rdtsc
call fcn.0078cd3e
call fcn.0078cd1d
jmp 0x78cd02

Function at 0x83227a
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 4], dx
xchg word [esp + 2], ax
mov edx, dword [esp]
jmp 0x8322ad
mov dx, word [esp]
not ah
mov ax, cx
add esp, 8
jno 0x832296
jo 0x8322c5
mov ecx, 0x3bc8a939

Function at 0x83237b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp fcn.0083226b
push dword [esp + 0x11]
call fcn.00832360
imul ebp, esi, 0x7c
sbb esi, esi
jno 0x8323a8
add edx, dword [ebx + reloc.MSVFW32.dll_DrawDibDraw]
les ebx, [edx + 0x3d]
int3
push eax
push word [esp + 2]
mov byte [esp + 3], ch
lea esp, [esp + 2]
xchg dword [esp + 0xc], eax
pushal
jmp 0x832319
lea esp, [esp]
pushfd
mov word [esp + 4], ax
lea eax, [eax - 0x23]
jmp 0x832335
add bh, byte [0x3257c746]
sar dword [ebx - reloc.MSVFW32.dll_DrawDibDraw], 0x78
call edx
push ebp
lds ebp, [edi + ebx*2 - 0x2108bb26]
lea esp, [esp + 2]
mov dword [esp + 0x10], esi
popal
mov edi, dword [ebx]
dec ebx
jnp 0x8322dd
lea ecx, [edx*4]
xchg ch, bh
mov ax, word [esp]
jmp fcn.0083223a

Function at 0x8366f4
Capabilities:
Encode data using xor

Disassembly:
invalid
test al, 0xac
xor eax, 0x5c0f6328
add ebp, ebp
cmpsd dword [esi], dword es:[edi]
xchg esp, eax
mov ebp, 0x30a4b2f3
and byte [ebp + 0x26663859], dl
mov edi, 0x71e12da3
or eax, 0xdc47de1
dec ebp
insd dword es:[edi], dx
mov edi, 0x69201014
mov bl, 0x4e
shr dword [ebx + reloc.MSVFW32.dll_DrawDibDraw], 1
dec edx
mov dword [reloc.MSVFW32.dll_DrawDibDraw], eax
loope 0x83678f
les ecx, [0x14bf6d4d]
adc byte [eax], ah
imul esi, dword [ebx - reloc.MSVFW32.dll_DrawDibDraw], 0x4a425a77
push edi
cmpsd dword [esi], dword es:[edi]
xchg ebx, eax
xor byte [ecx - 0x20], 0x39
nop
salc
jg 0x83670b
adc edi, eax
adc dh, byte [edx + 0x8686905]
jge 0x8366d4
push edi
sub dh, ch
mov esp, dword [ecx + reloc.MSVFW32.dll_DrawDibDraw]
mov edi, dword [eax - reloc.MSVFW32.dll_DrawDibDraw]
jns 0x836782
mov ch, 0xab
add dh, byte [ebx + 0x327450ab]
je 0x836784
inc esp
push ecx
jge 0x836750
fsub dword [ebx - reloc.MSVFW32.dll_DrawDibDraw]
pushfd
mov eax, 0xde8bbed5
dec ecx
fxch st(6)
pop esp
mov esi, gs
mov esp, 0xaf2e425e
lodsb al, byte [esi]
or byte [esi + edi + 0x1769df86], 0xc
sbb ch, byte [esi]
out dx, al
fstpnce st(0), st(0)
popal
or al, byte [edx - 0x13f6fc7]
invalid
nop
sar dh, 0xc7
inc bh
push edi
sbb eax, 0x7e3ee2
in eax, dx
xchg edi, eax
add byte [eax], cl
push cs
or dl, dh
push cs
add ebx, dword [edi - 0xf]
mov edi, 0x1c5ea85c
dec edi
mov dl, 0xff
or bl, byte [ebx + 0x44]
xlatb
test al, 0x84
fadd dword [ebp - 0x46]
salc
imul edi, edx, 0xd86fa1ec
retf

Function at 0x838060
Capabilities:
Encode data using xor

Disassembly:
invalid
cmp ebp, esp
out 0xac, eax
push ecx
pop esp
add edi, dword gs:[eax]
out 0x3b, al
test eax, 0x3d722ae1
cmc
push esp
jo 0x838000
push ss
pop es
mov eax, 0x27920a8b
and dword [reloc.MSVFW32.dll_DrawDibDraw], 6
inc esp
invalid
Function at 0x83a01a
Capabilities:
Encode data using xor

Disassembly:
lcall 0x6eae, 0xbd002ee
push 0x47
push ds
or byte [ebp - 0x19], dh
jne 0x83a071
inc edx
add dword [esp + ebx*4 + 0x74], ebx
inc esp
cmp ecx, dword [ebp - reloc.MSVFW32.dll_DrawDibDraw]
fcom dword [esi - 0x31]
in al, dx
and eax, 0xfd15754
ror dword [edi], 1
sub eax, 0xbd55637
or bl, byte [edx]
xor cl, ah
invalid
mov fs, word [esi + esi*8 + 0x7b]
insd dword es:[edi], dx
or eax, 0x94d8532d
mov dl, 0xf5
salc
sub edi, dword [ebp + reloc.MSVFW32.dll_DrawDibDraw]
dec esp
dec ebx
pop edx
sub al, 0xae
scasd eax, dword es:[edi]
into
adc esi, dword [edi]
pop esp
fsubrp st(4)
std
and cl, byte [eax - 0x20f7b9b8]
xor eax, 0x20b6cf1e
or byte [edi - 0x4077ae9c], ch
inc esp
leave
stosd dword es:[edi], eax
push ecx
lodsd eax, dword [esi]
jecxz 0x83a03c
salc
push ss
pop ebp
xor eax, 0x511995e
int3

Function at 0x83aa55
Capabilities:
Encode data using xor

Disassembly:
inc ebp
mov bl, 0x8f
xchg ebx, eax
or byte [esi - 0x1c91810b], 0x84
push eax
bound edx, qword [edx + 0x56]
pop ebx
adc byte [edx], ch
or esi, ebp
sub eax, 0xa968dbdd
and dword [eax], ebx
xchg esp, eax
dec edi
lodsd eax, dword [esi]
sub eax, 0x6e4fea12
mov bl, 0x15
inc eax
iretd
jp 0x83aa7b
fmul qword [edx + 0x69]
push ss
pop es
invalid
invalid

Function at 0x83cfb3
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0x90
sub byte [ebx + ecx*2], al
push esp
and al, 1
push ds
mov fs, edx
xchg esp, eax
push 0xe29c8c91
out dx, eax
movsb byte es:[edi], byte [esi]
out 0x8c, eax
imul ebx, edx, 0x77931f35
movsb byte es:[edi], byte [esi]
and ebx, ebp
call 0x76247c8c
lodsb al, byte [esi]
mov al, byte [0xb8435d75]
arpl word [edx + 0x27899533], di
lodsb al, byte [esi]
mov al, byte [0xb8435d75]
arpl word [edx + 0x27899533], di
fsub qword [edx + 0x70]
xor ah, cl
adc ah, bh
cmp bh, bh
push 0xffffffffffffffb8
cwde
loope 0x83cfb9
cmpsd dword [esi], dword es:[edi]
les esp, [eax - 0x75ab6f29]
wait
cmp dword [edx - reloc.MSVFW32.dll_DrawDibDraw], edi
shr dword [ebp + reloc.MSVFW32.dll_DrawDibDraw], cl
pop ds
cli
jl 0x83cf92
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
dec eax
mov ch, 0xfb
out 0x3c, al
pushfd
fdiv qword [eax - 0x35]
mov al, byte [0xf3c627da]
adc eax, 0x2ce86e86
adc eax, 0x2ce86e86
sub al, 0x15
inc ebp
mov dword [edx], esp
pop esi
adc eax, 0x5e228945
jno 0x83d042
jmp 0x83d075
mov ebp, 0xa32db634
out dx, eax
and eax, 0x5173f579
push eax
inc ebx
aaa
xchg esp, eax
pop ds
dec ebx
scasd eax, dword es:[edi]
push 0xe7def615
out 0x12, eax
lodsb al, byte [esi]
aaa
push edi
mov cl, 0xd
movsb byte es:[edi], byte [esi]
push esp
in al, 0xc9
js 0x83d088
mov bh, byte [edi]
mov edx, 0x183387f5
xchg ebx, eax
xor eax, 0x1b1379b0
arpl dx, cx
in al, dx
aaa
sub ah, byte [esi - 0x4f]
jg 0x83cff8
shl bh, 0xa7
xor al, 0xfd
sbb dword [ecx + 0x59], esi
jnp 0x83d026
or ecx, dword [edx]
std
scasd eax, dword es:[edi]
fnsave dword [eax]
sal dword [esi], cl
and al, dl
scasd eax, dword es:[edi]
inc ebx
jne 0x83cffd
mul al
test eax, 0xef0dccbb
xchg edx, eax
retf
cmp dword [eax], ebp
dec ebp
mov al, 0xc8
sub ch, cl
sbb byte [edi + 0x59c5d818], 0x87
invalid
Function at 0x843449
Capabilities:
Encode data using xor

Disassembly:
xor cl, byte [ebp + 0x4c2030a4]
ret 0xea2d
and byte [eax + eax*4 + 0xa1f804b], bl
ja 0x8433fe
dec edi
push 0xfffffffffffffffa
sar dword [ebx - reloc.MSVFW32.dll_DrawDibDraw], cl
jno 0x843492
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
xor eax, 0x826b386c
insb byte es:[edi], dx
cmp byte [ebx - 0x7e], ch
push edi
test eax, 0xcfb17293
jg 0x843457
sub ecx, ebx
aad 0x6f
ror byte ss:[ebp - 0x6b], cl
add bh, byte [edx]
shr dword [ecx*8 - reloc.MSVFW32.dll_DrawDibDraw], 0x59
sub ebp, dword [edx]
cwde
movsd dword es:[edi], dword [esi]
invalid
pop ebp
iretd

Function at 0x8453c7
Capabilities:
Encode data using xor

Disassembly:
test dword ss:[ecx - reloc.MSVFW32.dll_DrawDibDraw], edx
adc eax, 0x80d7b89
jp 0x8453eb
mov dword [ebx + 0xd], edi
or byte [edx + 0x16], bh
pop eax
loop 0x8453cf
invalid
int 0xcd
scasb al, byte es:[edi]
mov esp, 0x3a971f73
pop esi
pop es
xor ebp, dword [edx + ecx - 0x2a]
pop esi
jae 0x845436
ret
setge byte [edi - 0x7549f484]
push esp
cmp eax, dword [ecx - reloc.MSVFW32.dll_DrawDibDraw]
push cs
add eax, 0x37f0569
cmpsd dword [esi], dword es:[edi]
sbb dword [0xd7f413ee], esp
xchg esp, eax
push es
dec esp
add ecx, dword [ecx + reloc.MSVFW32.dll_DrawDibDraw]
xor eax, 0x5158bb8e
mov word [edx - 0x77b88c6b], ss
adc dword [esi], esp
push ds
and al, 9
sub dword [edi + ebx*2 - reloc.MSVFW32.dll_DrawDibDraw], edx
push ss
jge 0x845492
aam 0x3d
sub al, 0xa2
sbb bl, cl
fnstsw word [esi]
and edx, dword [eax + reloc.MSVFW32.dll_DrawDibDraw]
mov dword [reloc.MSVFW32.dll_DrawDibDraw], ebx
adc al, 0xea
or al, 0x9c
jo 0x84543d
mov cs, word [0xceb069db]
jmp 0xca1b9963
imul esi, dword [eax + reloc.MSVFW32.dll_DrawDibDraw], 0xf66bc997
retf
Function at 0x848881
Capabilities:
Encode data using xor

Disassembly:
shr byte [esi - 0x58e0380d], 1
rcl dl, 1
pushfd
pushfd
push edx
sbb dword [esi - 0x4689ba91], edi
xor dword [ecx - reloc.MSVFW32.dll_DrawDibDraw], edx
add al, 0x11
aam 0x12
inc eax
push ecx
lea edi, [ebx]
sub eax, 0x1ef368bb
test eax, 0xaf908ba3
mov cl, 0x52
rcr dword [edx + 0x70], cl
nop
mov ah, 0x1e
xor dl, ah
xchg edi, eax
sbb dword [ebp + 0x3315cbb2], 0x65
push esi
and eax, 0x79d78140
cmc
pop ds
adc al, 0xd9
test dword [edx + 0x51], ebx
div dword [edi + 0x56]
lodsd eax, dword [esi]
sbb dl, byte [edx + 0x5ba74162]
xlatb
sahf
push edx
inc ecx
pushfd
insd dword es:[edi], dx
mov bh, 0x98
lodsd eax, dword [esi]
dec esp
push eax
cmp byte cs:[edi + 0xf04758], al
jg 0x848899
ja 0x848870
shl esp, 0xe6
test eax, 0x88644cf3
adc al, ah
js 0x84893e
int 0xc7
aad 0xa3
add dword [edi + 0x3b], 0x40
in eax, dx
stc
xchg edx, eax
xchg esp, eax
dec edi
fiadd dword [ebp - 0x2a6ae7d8]
or byte [ebx], al
mov byte [edi], bh
and ebp, dword [esp + ecx]
inc ebx
cmp dl, byte [edx + 0x4f]
sbb esp, dword [ebx]
sub dword [ecx], ebp
and dword [edi + eax*2], eax
sub dword [ecx], esp
add al, 0x47
cmp dh, 0x1e
pop esi
sub eax, 0x2b7bcc26
insb byte es:[edi], dx
int 0xb6
cwde
jg 0x848961
test eax, 0x4c61277c
fimul word [edi - 0x42]
shr bl, 1
aam 0x3a
jmp dword [edi - 0x3c434984]
adc esi, edi
inc eax
retf
xor byte [ecx + 0x11], bl
aam 0x69
jg 0x84899f
in al, 0xae
aam 0xd4
jge 0x84890a
cli
add byte [0xa623108e], dh
insb byte es:[edi], dx
imul ebx, dword [esi + 0x56], 0xe
salc
pop esi
invalid
invalid
int1
cmp ch, 0xb3
push ebx
std
mov bl, 0x53
insb byte es:[edi], dx
sub eax, 0xde53bc43
add eax, dword [edx]
popal
sbb dh, byte [ebx + 0x235797b2]
pop edi
push ebx
pop esp
leave
xchg ecx, eax
enter 0xffffffffffffa7b3, 1
or ax, 0x4027
sub eax, 0x525ba820
or bh, ch
cdq
sub byte ds:[ebp + 0x484c1aa0], bh
adc dword [ecx + ebp*2 - reloc.MSVFW32.dll_DrawDibDraw], edx
xor byte [ecx + 2], 0xc8
inc eax
fisubr word [edi + edi*4 - 0x41]
pushal
mov edi, 0x3b65f59a
sub ah, byte [edx + edi]
aas
jne 0x8489a1
in eax, dx
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
les esp, [esi + ebp*4 + 0x3b]
dec ebp
out dx, al
jno 0x84899d
invalid
Function at 0x861dfe
Capabilities:
Encode data using xor

Disassembly:
ret
hlt
adc eax, 0xc1b63bb4
mov dl, 0x77
mov edx, 0x98a78836
in al, 0xcc
sbb bh, byte [ebx + 0x663d1973]
dec ebp
cld
xchg ecx, eax
salc
and ch, byte [ebx - 0x44]
push ds
loop 0x861e0d
fistp dword [edx - reloc.MSVFW32.dll_DrawDibDraw]
stosd dword es:[edi], eax
and esp, edx
mov dword [reloc.MSVFW32.dll_DrawDibDraw], ebp
cmp al, 0x92
inc edi
sub dword [ebx + 0x1d], esp
loop 0x861db1
inc ecx
mov cl, 0x1f
mov dh, 3
push ds
push esp
add ebp, edx
aad 0xe3
invalid
aad 0xe3
aam 2
je 0x861d92
add dh, byte [esi + ecx*4 - 0x1b]
mov fs, ebp
in eax, 0x26
lodsb al, byte [esi]
lodsb al, byte es:[esi]
outsb dx, byte [esi]
sbb eax, 0xa0aa4167
loop 0x861e7f
inc edx
pop esi
jmp 0x861dc0
cmp esp, dword [edx]
fstp xword [ebx - 0x27]
stosd dword es:[edi], eax
and dword [ecx + reloc.MSVFW32.dll_DrawDibDraw], edx
push 0xeec3db8f
xor dword [edx], reloc.MSVFW32.dll_DrawDibDraw
invalid
dec ebx
xchg bx, ax
out dx, al
loopne 0x861e1a
stc
add dword [esp + edx*2], ebp
mov bl, 0x2a
ror al, cl
cmc
invalid
popal
pop ebp
sbb al, 0xac
mul byte [eax - 0x63]
cmpsb byte [esi], byte es:[edi]
ror dword [ebx - reloc.MSVFW32.dll_DrawDibDraw], 1
sar ecx, 1
add dword [ebp + 0x28], esp
jno 0x861e35
lcall 0x7e71, 0x9aed2f2d
call [esi - 0x35e36532]
sub esp, edi
iretd
pop ebx
jge 0x861e03
cmp dword [edi - 0x3c], 0
jecxz 0x861e8d
jg 0x861e46
add bl, ah
or byte [ebp + 0x20], dh
jne 0x861ea7
pop edi
mov al, 0x2e
out dx, al
retf
inc eax
jb 0x861e9b
mov byte [edi - 0x16d01b3d], bl
loope 0x861efe
cmp esi, dword [esi + reloc.MSVFW32.dll_DrawDibDraw]
aaa
and byte [edx], dh
aaa
pop ebp
and esp, dword [ecx + reloc.MSVFW32.dll_DrawDibDraw]
xor ch, byte [eax]
jno 0x861e7d
sub byte [ecx - 0x2d], dh
and eax, 0x7a4f7d67
or byte [esi + edx + 0x6c7878cf], ch
les ecx, [eax - 0x34]
lodsb al, byte [esi]
push es
xor dword [esi - 0x3f], eax
invalid
xor ebp, ecx
fidiv dword [esi - reloc.MSVFW32.dll_DrawDibDraw]
jne 0x861f1b
sub dword [ebp + reloc.MSVFW32.dll_DrawDibDraw], 0x74
scasb al, byte es:[edi]
adc bh, byte [ecx - 0x6114ea0f]
scasb al, byte es:[edi]
pop edx
and eax, 0x117cdb04
jl 0x861f2e
lahf
daa
mov al, byte [0x903160ee]
mov byte es:[ecx + 0x33], bh
pop es
Function at 0x881811
Capabilities:
Encode data using xor

Disassembly:
invalid
jecxz 0x8817fb
sbb al, 0xd8
cwde
inc eax
cmp eax, 0x3e1accef
fcomp dword [eax - 0x3310c2c0]
sbb bh, byte [esi]
popfd
push ds
out 0x14, eax
out 0xe7, eax
clc
add eax, 0x2ef9229
xor ch, ah
int3
mov dword [reloc.MSVFW32.dll_DrawDibDraw], eax
cli
jbe 0x8817f7
jecxz 0x881834
lodsd eax, dword [esi]
iretd
mov ch, byte [edx - 0xd0012fe]
call 0x98d9ff60
out 0x51, eax
cwde
add eax, 0xa7a99530
lahf
les edi, [edx + edi]
lcall 0xf099, 0xc2fac1d3
or byte [ebx - 0x548b6bd5], dh
je 0x8817d5
push esi
aas
xor eax, dword [edx]
sbb edx, ebx
jns 0x881828
xchg dword [ebx - 0x38], eax
test ah, bh
sub eax, 0x49e47c1
fisttp word [edi - 0x6a99da8d]
fnstsw word [ecx + 0x41]
push 0x350eec12
in al, dx
push cs
xor eax, 0x1748198
xchg edx, eax
int 0xd0
invalid
cli
shr edx, cl
fdivr st(7), st(0)
sbb bh, byte [edx + 0x65]
jne 0x8817de
cmp ch, byte [edx]
stosd dword es:[edi], eax
in eax, 0x9d
movsd dword es:[edi], dword [esi]
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
sub al, 0x9a
aad 0x18
jp 0x881809
cmpsd dword [esi], dword es:[edi]
fstp dword cs:[ecx]
push edi
pop ss
push ss
test eax, 0x5392670f
pop esi
or byte [ebx + 0x19d9c0b5], ah
or byte [ecx], ch
inc ebp
jle 0x88188d
movsb byte es:[edi], byte [esi]
push cs
pop edx
fcom dword [edi - 0x5158da37]
scasb al, byte es:[edi]
inc eax
xor eax, 0x3c72f500
and byte [edx], bh
inc eax
salc
xchg esi, eax
clc
sbb esp, dword [ecx + 0x7b143acc]
cmp byte [eax + 0x49], cl
fisttp qword [ebx - 0x7f]
into
ljmp 0x1047

Function at 0x888a5f
Capabilities:
Encode data using xor

Disassembly:
cmp ch, dl
or dh, byte gs:[ebp - 0x533d67ad]
stc
jns 0x888a9f
outsd dx, dword [esi]
invalid
pop esp
rol dword [ebx - reloc.MSVFW32.dll_DrawDibDraw], cl
out 0x40, al
repe cmpsb byte [esi], byte es:[edi]
loop 0x888a44
pop esi
imul eax, dword [ecx - reloc.MSVFW32.dll_DrawDibDraw], 0xffffffec
sbb esi, dword [ecx + 0x37b72c7a]
wait
sal dword [edi], 0xb8
push esp
sub eax, 0x265baf65
add edi, dword [edi + 0x30]
pop es
xor byte [edi], al
salc
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
invalid
aam 0xbc
insb byte es:[edi], dx
mov bh, 0xe1
or byte [esi + 0x62c2b675], dl
sal dword [edi + reloc.MSVFW32.dll_DrawDibDraw], 0xd7
cmpsb byte [esi], byte es:[edi]
stosb byte es:[edi], al
xchg esp, eax
jno 0x888a86
ljmp 0x7b8a:0xef26c5c4
Function at 0x889bba
Capabilities:
Encode data using xor

Disassembly:
div dword [esi - 0x18]
wait
rol dword [ecx], cl
and dl, bl
jbe 0x889b45
pop eax
mov eax, 0xe7dfb943
in eax, 0xc1
invalid
sbb ebx, dword [0x85870939]
or al, 0x6c
fadd st(4)
dec edi
je 0x889adc
cmc
bound bx, dword [ecx - 0x1060b976]
jle 0x889b81
hlt
mov al, 0xb6
in al, dx
inc ecx
das
dec edi
add al, 0xa7
loop 0x889b72
imul ecx, dword [ebx], reloc.MSVFW32.dll_DrawDibDraw
cmpsb byte [esi], byte es:[edi]
in al, 0xc3
or ebx, dword [ebx]
invalid
sbb eax, esi
xor ebp, dword [ebx - 0x6e]
or dword [ecx], esi
mov al, 0x59
add dword [esi + reloc.MSVFW32.dll_DrawDibDraw], 0x29
dec dword [esi + reloc.MSVFW32.dll_DrawDibDraw]
rol eax, 1
imul ebx, dword [ebp + edx*8 + 0x39], 0xc01defb
dec esi
sti
fiadd word [ecx]
or al, 0x4e
out 0xfd, al
jg 0x889b13
and dh, byte [edi - 0x57]
inc edi
rol byte [edi + 0x34c1a108], 0x6b
pop ebp
or byte [ecx + 0x5d6b34c1], ah
add ebx, ecx
stosb byte es:[edi], al
and dword [ebp - 0x31], ebx
test eax, 0xb277b5f7
lahf
add al, 0x25
and dh, byte [edi]
cmp ebx, dword [eax + reloc.MSVFW32.dll_DrawDibDraw]
push eax
and dword [ecx], reloc.MSVFW32.dll_DrawDibDraw
invalid
cmp al, 0x48
and al, 0xa3
cdq
xor eax, 0x9305547f
cmp dl, byte [eax + 0x6949c5c2]
jnp 0x889b56
xor ah, 0x7a
fsubr qword [edx - 0x2da355bb]
stosb byte es:[edi], al
pop esp
sal ch, cl
stosb byte es:[edi], al
pop esp
sal ch, cl
and dh, byte [edi - 0x1c]
loop 0x889bbb
jle 0x889ba2
xor al, 0x2a
or byte [esi], ah
scasb al, byte es:[edi]
cmc
pop ds
or bh, cl
js 0x889c35
xlatb
scasd eax, dword es:[edi]
push ebp
pushal
and dword [ecx + edx*8], ebp
mov dword [reloc.MSVFW32.dll_DrawDibDraw], eax
inc esp
pop edi
mov fs, edx
shr dword [eax], 1
rol dword [edi + ebp - 0x47], 0x47
xor al, byte [ecx + 0x7f17137f]
xor ecx, eax
call 0x5bf99d3a
inc ebp
add dword [ecx + 0x5b], esi
imul edi
and ebp, ecx
outsd dx, dword [esi]
adc al, 0xb9
in al, 0x23
xor al, 0x40
push esi
out 0x4c, eax
outsb dx, byte [esi]
xchg ebx, eax
cmpsb byte [esi], byte es:[edi]
pop ds
aam 0xff
sub eax, 0x778fa76e
scasd eax, dword es:[edi]
xlatb
test dword [ecx + reloc.MSVFW32.dll_DrawDibDraw], esp
dec ebp
add al, 0x49
pop edi
cmp dword [eax], edx
jb 0x889bf1
push ds
sal bl, cl
mov byte [ecx], al
adc byte [esp + edi*4 - 0x42], dl
test dword [ecx + 0x75], ecx
adc al, 0x51
dec esi
int 0x9f
mov ebx, 0xfce57ce0
cld
jnp 0x889c35
add ecx, esp
int3

Function at 0x88a155
Capabilities:
Encode data using xor

Disassembly:
lahf
mov edx, 0xebad2cbf
rol byte [ebp + 0x373dc06d], cl
in al, 0xfc
sub cl, dl
xchg ebp, eax
loopne 0x88a1ac
push ss
nop
rcr al, 0xf8
insb byte es:[edi], dx
adc dh, byte [eax + 0xbf94a47]
mov ecx, dword [ebx]
imul esi, eax, 0xffffff98
call dword [ebp - 0x5adec264]
ror byte [edx + 0x4f8ed2d9], 1
stosb byte es:[edi], al
sbb al, 0xc7
aad 0x65
rcr byte [ebx + 0x70], 0x60
wait
xor ah, byte [ecx + 0x6e]
add dword [esi - 9], eax
pop esi
xlatb
out 0x6c, al
das
xchg ecx, eax
invalid
in eax, dx
test eax, 0x25269b82
xchg ecx, eax
cdq
test byte [ebp + 0x28906450], cl
cld
Function at 0x88b50c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov bl, 0x67
lea esp, reloc.MSVFW32.dll_DrawDibDraw
inc ebx
push esi
xlatb
xor al, 0x50
jmp 0x88b52d
fdivrp st(4)
cli
cli
xor dword [eax], ecx
inc edi
inc ebx
pop ecx
sbb eax, 0x931ddeba
lodsb al, byte [esi]
invalid

Function at 0x94141f
Capabilities:
Parse pe header

Disassembly:
setne bh
std
push dword [esp + 6]
mov dx, di
not ebx
dec ebp
call fcn.00941483
lodsd eax, dword cs:[esi]
cmp eax, 0x3cd8b744
setbe byte [ecx]
shr bl, 0xe0
jmp 0x941401
jmp 0x941401

Function at 0x941421
Capabilities:
Parse pe header

Disassembly:
lea ebx, [ecx*4]
mov dword [esp + 2], ecx
bsr ebx, ecx
jmp 0x941435
xchg edx, ebx
dec bl
mov edx, dword [esp + 0xa]
mov edx, dword [esp + 0x19]
cld
jmp 0x941458
mov dword [esp + 0xe], ecx
stc
mov dl, byte [esp + 0x13]
xchg byte [esp + 5], bl
xchg bl, bh
mov dword [esp + 0xe], esi
jmp 0x94149b
lea ebx, [esi*4]
bswap ebx
bsr bx, cx
jmp 0x941485
btc bx, bp
mov byte [esp + 1], bl
not dh
mov bp, word [esp + 8]
pushfd
jmp 0x9414c5
sub esp, 0xa
mov dl, byte [esp + 0x1c]
neg dx
add esp, 0xb
setno bl
bswap ebx
jmp 0x94146d
mov bx, si
lea ebx, [ecx + esi]
bswap ebx
mov byte [esp + 0x13], cl
pop bp
jmp 0x9417aa
pop bx
setne dl
xchg byte [esp + 0x17], dh
mov ebp, 0xce7a8b4
shl ebx, cl
lea edx, [edx + ebp]
jmp 0x9414af
mov bh, al
xchg dword [esp], edx
pop ebx
xchg byte [esp], dh
lea esp, [esp + 1]
mov edx, eax
jmp 0x94157b
add esp, 0xf
not ebx
lea ebx, reloc.MSVFW32.dll_DrawDibDraw
pop dword [esp + 3]
pop bx
neg ebx
jmp 0x9414ec
xchg byte [esp + 0xe], dh
push dword [esp + 0xc]
lea ebp, [edx + ebx]
rol dx, 0xc
neg edx
mov dl, 0x9e
jmp 0x941502
pop word [esp]
mov bl, byte [esp + 1]
lea edx, [esi*4]
push esi
jmp 0x94155c
xor dh, 0xf5
sub esp, 5
sub esp, 2
lea ebx, [esp + edi]
pop bx
mov bx, 0xfe6a
jmp 0x941532
xchg word [esp + 1], bp
mov word [esp + 4], dx
mov ebx, dword [esp + 6]
mov byte [esp + 6], bl
xchg dh, bl
jmp 0x9415a4
mov edx, 0x59757eb1
bswap ebx
bt dx, si
stc
clc
mov bp, 0xa635
jmp 0x941548
mov bp, cx
btr edx, esp
xchg edx, ebp
mov ebx, 0xfddb5f7b
push dx
jmp 0x9415bb
mov edx, 0x4cd38858
xchg bl, dl
bswap ebp
dec bp
lea ebx, reloc.MSVFW32.dll_DrawDibDraw
pop dword [esp]
jmp 0x94158e
push word [esp + 1]
lea ebx, reloc.MSVFW32.dll_DrawDibDraw
mov byte [esp + 6], bh
bsr edx, edx
pop word [esp + 1]
jmp 0x941726
adc dl, 8
xchg word [esp + 9], bx
lea ebp, [edx + esi]
dec bx
xchg ebp, ebx
mov word [esp + 2], bp
jmp 0x94151d
lea ebp, reloc.MSVFW32.dll_DrawDibDraw
lea ebx, [ebx*4]
bswap ebx
sub esp, 5
mov bl, 0x37
bswap ebx
jmp 0x9416ee
mov bp, word [esp + 1]
mov dh, ah
pop dx
std
mov dh, dl
lea edx, [ebx + esi]
jmp 0x9415f3
neg dx
lea esp, [esp + 1]
mov ebx, dword [esp + 4]
mov bp, word [esp]
neg dh
lea ebp, [ecx + ecx]
call fcn.0094169f
not dx
xchg byte [esp + 4], dh
sub esp, 0xd
mov byte [esp + 0xe], ah
lea esp, [esp + 0x11]
mov edx, dword [esp]
jmp 0x941613
mov word [esp + 5], bp
pop word [esp + 0x13]
add dl, dh
lea ebx, reloc.MSVFW32.dll_DrawDibDraw
lea ebp, [ebp*4]
mov ebx, dword [esp + 8]
jmp 0x9415da
Function at 0x941483
Capabilities:
Parse pe header

Disassembly:
not bp
mov bx, ax
mov bh, dl
call fcn.00941421
jmp 0x94144b

Function at 0x94163a
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
neg ebp
xchg word [esp + 3], bp
lea esp, [esp + 2]
mov ebp, dword [esp + 0x27]
jmp 0x941678
setbe dl
rcr dh, 7
mov edx, dword [esp + 0x11]
sub esp, 0xe
stc
jmp 0x941624
push word [esp + 0x1b]
mov dword [esp + 0x11], esi
lea esp, [esp + 2]
jmp 0x941684
lea esp, [esp + 0x40]
popfd
lea esp, [esp + 4]
pushal
jmp 0x941662
mov dword [esp + 0x1c], eax
pushfd
push word [esp]
push esi
push word [esp + 9]
mov dword [esp + 6], esp
jmp 0x9416bb
push cx
pushal
lea esp, [esp + 0x1a]
mov word [esp + 1], bp
mov dword [esp + 0x3c], ebx
push bx
jmp 0x9416d3
pop dword [esp + 1]
mov dword [esp + 0x20], ecx
pushal
pop dword [esp + 0x11]
mov word [esp + 0xf], cx
mov dword [esp + 0x38], edx
jmp 0x9416a1
push cx
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x38], esp
mov dword [esp + 0x34], ebp
call fcn.00941707
or al, 0x9f
out 0x11, al

Function at 0x94169f
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
mov bp, word [esp + 2]
call fcn.0094163a
jmp 0x941658

Function at 0x941707
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.00940585
push eax
jmp 0x94170e
lea esp, [esp + 4]
mov byte [esp + 2], dl
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], edi
jmp 0x941756
mov eax, dword [eax + 0x1c]
jmp 0x94177b
lea esp, [esp + 0x30]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x941740
mov eax, dword [eax + 8]
jmp 0x941783
push edx
mov edx, eax
mov eax, dword [edx]
pop edx
jmp 0x941765
push eax
jmp 0x940580
Function at 0x941792
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x93c07b
jmp 0x941789
movzx ebx, word [eax + 0x3c]
jmp 0x941913
mov eax, dword [esp]
call 0x941792
call 0x8b87c23
jmp 0x9417cc
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x941855
je 0x9405b3
sub eax, 0x10000
jmp 0x9417cf
inc edi
and dl, cl
xchg esp, eax
retf
out dx, eax
sbb bl, byte [ebp - 0x75108005]
jns 0x941891
rcl dword [eax - 0x3a], cl
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
pop ebp
and al, 0xd7
sbb edi, 0x66abcc5e
or ebp, dword [ebx]
mov bl, 0x23
inc esi
mov ch, 0x8c
xor esi, dword [edx + ebp + reloc.MSVFW32.dll_DrawDibDraw]
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
loop 0x94195c
pop ss
loop 0x941954
mov dword [reloc.MSVFW32.dll_DrawDibDraw], eax
fistp dword fs:[eax - 0x32]
test eax, 0xb5372258
and eax, 0x27e9bf4c
cmpsb byte [esi], byte es:[edi]
xor al, 0x53
scasb al, byte es:[edi]
ret
add ebx, eax
cmp word [ebx], 0x4550
je 0x93bf38
jne 0x94185b
test dword [reloc.MSVFW32.dll_DrawDibDraw], esi
out dx, al
jl 0x941945
imul ebp, esi, 0x82f61b7c
jns 0x941931
test byte [edx - 0x96cfc87], 5
xchg ebx, eax
test byte [0x5ac44184], 0x3d
int3
test byte [ecx - 0x3c], al
pop edx
cmp eax, 0x71f14bcc
loope 0x9418bc
jae 0x941978
int1
jb 0x941921
xchg dword [edx + 8], esi
int1
ja 0x94192e
xor byte [ecx + 0x2b], 0xe9
push 0x56899fe
add dword [ebp - reloc.MSVFW32.dll_DrawDibDraw], eax
mov cl, 0x36
movsb byte es:[edi], byte [esi]
ret
invalid
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
lodsb al, byte [esi]
leave
dec esp
ret 0x54a5
iretd