joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402990
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x402a99
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x402a99
push ebx
call fcn.00409230
add esp, 4
test eax, eax
je 0x4029ea
xor ebp, ebp
mov ecx, 0x1505
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x4029f1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x4029d0
jmp 0x4029f3
mov esi, 0x1505
jmp 0x4029f3
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x402a99
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x402a24
inc ebp
dec ebx
je 0x402a97
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402a97
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402a20
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00409230
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402a20
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.00409250
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402a20
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x402a97
cmp dword [eax + 4], 5
mov edi, 0
jne 0x402a99
mov edi, dword [eax + 8]
jmp 0x402a99
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402ad0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x402bdc
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x402bdc
push ebx
call fcn.00409230
add esp, 4
test eax, eax
je 0x402b2a
xor ebp, ebp
mov ecx, 0x1505
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x402b31
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x402b10
jmp 0x402b33
mov esi, 0x1505
jmp 0x402b33
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x402bdc
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x402b64
inc ebp
dec ebx
je 0x402bd7
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402bd7
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402b60
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00409230
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402b60
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.00409250
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402b60
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x402bd7
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x402bdc
mov edi, dword [eax + 8]
jmp 0x402bdc
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402bf0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
push 0x2e
push edi
call fcn.004092a0
add esp, 8
test eax, eax
je 0x402c56
mov ebx, eax
jmp 0x402c34
mov edi, ebx
inc edi
push 0x2e
push edi
call fcn.004092a0
add esp, 8
mov ebx, eax
test eax, eax
je 0x402c56
mov eax, ebx
sub eax, edi
mov ecx, esi
mov edx, edi
push eax
call fcn.00402620
add esp, 4
xor esi, esi
test eax, eax
je 0x402c20
cmp dword [eax + 4], 4
jne 0x402c20
mov esi, dword [eax + 8]
jmp 0x402c20
xor eax, eax
test esi, esi
je 0x402cb6
test edi, edi
je 0x402cb6
push edi
call fcn.00409230
add esp, 4
test eax, eax
je 0x402c9a
xor ebp, ebp
mov ecx, 0x1505
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [edi + ebp]
test edx, edx
je 0x402ca1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc ebp
mov ecx, ebx
cmp eax, ebp
jne 0x402c80
jmp 0x402ca3
mov ebx, 0x1505
jmp 0x402ca3
mov ebx, ecx
mov dword [esp + 8], eax
mov ecx, dword [esi + 0x20]
lea ebp, [ecx - 1]
mov edx, ecx
sub edx, 1
jae 0x402cbe
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov dword [esp], esi
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 4], edx
jmp 0x402cd4
inc ebp
dec ecx
je 0x402cb4
mov eax, ebp
and eax, edx
mov esi, dword [esp + 0x14]
mov esi, dword [esi + eax*4]
cmp esi, 0xffffffff
je 0x402cb4
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + esi*4], ebx
jne 0x402cd0
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 0x10], eax
push eax
mov dword [esp + 0x10], ecx
call fcn.00409230
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
add esp, 4
cmp eax, dword [esp + 8]
jne 0x402cd0
push dword [esp + 8]
push dword [esp + 0x14]
push edi
call fcn.00409250
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x402cd0
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + esi*4]
jmp 0x402cb6
Function at 0x402de0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x402e4d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x402e4d
push esi
call fcn.00409230
add esp, 4
test eax, eax
je 0x402e2a
xor edi, edi
mov ecx, 0x1505
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x402e31
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x402e10
jmp 0x402e33
mov ebx, 0x1505
jmp 0x402e33
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x402e55
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x402e64
inc ebp
dec edi
je 0x402e4b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x402e4b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x402e60
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.00409230
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x402e60
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00409250
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402e60
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x402e4d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x402e4d
Function at 0x403070
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x403178
mov esi, edx
test edx, edx
je 0x403178
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x403178
push esi
call fcn.00409230
add esp, 4
test eax, eax
je 0x4030ca
xor edi, edi
mov ecx, 0x1505
movzx edx, byte [esi + edi]
test edx, edx
je 0x4030d1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x4030b0
jmp 0x4030d3
mov ebp, 0x1505
jmp 0x4030d3
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x403180
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x40313a
call fcn.00403270
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x403178
push ecx
call fcn.00409230
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x4031ef
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x403198
inc ebx
dec esi
je 0x4030ef
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x4030f4
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x403190
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00409230
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x403190
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00409250
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x403190
mov eax, 0xffffffff
jmp 0x403178
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x403208
inc ebx
dec esi
je 0x403135
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x40313a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x403200
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00409230
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x403200
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00409250
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x403200
jmp 0x40313a
Function at 0x403940
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x403ad6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x403acf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x4039d0
add ebp, dword [esp]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 8]
mov edx, 0x15b0
je 0x403acf
xor eax, eax
cmp edx, 8
mov dword [esp + 4], esi
jb 0x403a58
mov eax, edx
and eax, 0x1ff8
mov dword [esp], eax
xor esi, esi
nop
nop
nop
nop
nop
mov eax, edx
mov edx, esi
movzx esi, byte [ebp + esi]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + edx + 3]
add edi, esi
add ecx, edi
movzx ebx, byte [ebp + edx + 4]
add ebx, edi
mov esi, ecx
and esi, ebx
xor ecx, ebx
movzx edi, byte [ebp + edx + 5]
add edi, ebx
movzx ebx, byte [ebp + edx + 6]
add ebx, edi
add edi, ecx
lea ecx, [edi + esi*2]
movzx edi, byte [ebp + edx + 7]
add edi, ebx
add ecx, ebx
add ecx, edi
lea esi, [edx + 8]
add edx, 0xf
cmp edx, eax
mov edx, eax
jb 0x4039f0
add ebp, esi
mov esi, dword [esp + 4]
mov eax, dword [esp]
mov ebx, edx
sub ebx, eax
mov dword [esp + 8], edx
jbe 0x403997
mov esi, eax
not esi
add esi, edx
mov dword [esp + 0xc], esi
mov esi, edx
and esi, 3
mov dword [esp], ebx
mov ebx, ebp
je 0x403a8c
nop
nop
nop
nop
movzx edx, byte [ebx]
add edi, edx
add ecx, edi
inc ebx
inc eax
dec esi
jne 0x403a80
cmp dword [esp + 0xc], 3
jb 0x403990
mov edx, dword [esp + 8]
sub edx, eax
xor eax, eax
nop
movzx esi, byte [ebx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp edx, eax
jne 0x403aa0
jmp 0x403990
shl ecx, 0x10
or ecx, edi
jmp 0x403adb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403af0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x403b42
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test edx, edx
je 0x403b44
not eax
xor esi, esi
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43da18]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43da18]
inc esi
cmp edx, esi
jne 0x403b10
not eax
jmp 0x403b44
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x4097c0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x124
call fcn.00438150
test al, 1
jne 0x4097d4
jmp 0x40989f
call fcn.00430440
test al, 1
jne 0x4097e2
jmp 0x409898
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
sub esp, 8
cmp eax, 0
jl 0x409896
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
sub esp, 0x24
cmp eax, 0
setge al
test al, 1
jne 0x409863
jmp 0x409890
call fcn.0040a900
test al, 1
jne 0x40986e
jmp 0x40988e
lea eax, [esp + 0x24]
lea ecx, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004098b0
call fcn.0040fa00
call fcn.0040cbe0
jmp 0x409890
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x409898
call fcn.00438610
jmp 0x40989f
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x409a46
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40995c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x40998d
cmp cx, 0x7f
jbe 0x409950
movzx ecx, cx
cmp ecx, 0x7ff
ja 0x409980
add ebx, 2
jmp 0x409951
mov ecx, ebx
and ecx, 3
xor ebx, 3
lea ebx, [ebx + ecx*2]
jmp 0x409951
lea esi, [ebx + 1]
push esi
call fcn.00409080
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x409a54
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x4099c8
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x409a56
movzx edx, word [edi]
test dx, dx
je 0x409a56
cmp dx, 0x7f
jbe 0x4099b0
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
mov dword [esp + 4], esi
cmp esi, 0x7ff
ja 0x409a10
cmp ecx, 2
jb 0x409a10
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x4099b7
xor esi, esi
cmp ecx, 3
jb 0x4099b7
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x4099b7
push 1
call fcn.00409080
add esp, 4
mov ebp, eax
jmp 0x409a56
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x409a77
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x409a72
test eax, eax
jne 0x409a70
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00405c90
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x416680
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x4166a0
sar esi, 1
lea edi, [esp + 0x7c]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x44745c]
mov ebx, dword [esp + 0x7c]
test ebx, ebx
jns 0x4166cf
mov eax, 0xffffffff
jmp 0x4166d2
lea eax, [ebx + ebx]
push eax
call fcn.00409080
add esp, 4
push edi
push ebx
mov ebx, eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x44745c]
mov dword [esp + 0x38], 0xbb74b90a
mov dword [esp + 0x3c], 0xbf29bd19
mov dword [esp + 0x40], 0xa340a12a
mov dword [esp + 0x44], 0xa703a514
mov dword [esp + 0x48], 0xab3da934
mov dword [esp + 0x4c], 0xaf3dad01
mov dword [esp + 0x50], 0x93909100
lea eax, [esp + 0x54]
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0xb8], 0
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x23
ja 0x4167af
nop
mov edx, dword [esp + 0xb8]
mov ecx, dword [esp + 0xb8]
movzx esi, byte [esp + ecx + 0x38]
add edx, 0xd75c3b47
mov ecx, edx
and ecx, esi
xor edx, esi
lea edx, [edx + ecx*2]
add ecx, ecx
mov esi, edx
xor esi, ecx
not ecx
and ecx, edx
add ecx, ecx
sub ecx, esi
mov dword [esp + 0x90], ecx
mov ecx, dword [esp + 0x90]
add cl, 0xf
mov edx, dword [esp + 0xb8]
mov byte [esp + edx + 0x38], cl
inc dword [esp + 0xb8]
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x24
jb 0x416750
lea edi, [esp + 0xb8]
lea edx, [esp + 0x38]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xd4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x7c]
mov ecx, eax
add ecx, 0xd
mov dword [esp + 0x20], ebx
jns 0x4167e9
mov eax, 0xffffffff
jmp 0x4167ee
add eax, eax
add eax, 0x1a
push eax
call fcn.00409080
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x416821
mov eax, dword [esp + 0x20]
lea edx, [eax + 2]
mov eax, ebx
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416810
mov word [eax], 0
movzx ecx, word [esp + 0xb8]
test cx, cx
je 0x416851
lea edx, [esp + 0xba]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416840
mov word [eax], 0
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043af50
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44200c]
Function at 0x41ea60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0x73b36d49
mov dword [esp + 0x14], 0x77867180
mov dword [esp + 0x18], 0x7b9b75b0
mov dword [esp + 0x1c], 0x7f9f798c
mov dword [esp + 0x20], 0x3de7d59
mov dword [esp + 0x24], 0x7ee01d4
mov dword [esp + 0x28], 0xbf805f1
mov dword [esp + 0x2c], 0xfeb09ec
mov dword [esp + 0x30], 0x13f40dfa
mov dword [esp + 0x34], 0x17e011f9
mov dword [esp + 0x38], 0x1bc615f0
mov dword [esp + 0x3c], 0x1fe819c8
mov dword [esp + 0x40], 0x23c81def
mov dword [esp + 0x44], 0x27ca21c9
mov dword [esp + 0x48], 0x2bdd25c1
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0x2928
mov dword [esp + 0x4e], 0
mov word [esp + 0x52], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x43
ja 0x41eb64
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
lea esi, [ecx + 0xae]
and esi, edx
mov edi, 0x87ffc51
sub edi, ecx
or edi, edx
not edi
add edi, edx
sub edi, esi
mov dword [esp + 0x5c], edi
mov ecx, dword [esp + 0x5c]
add cl, 0x3e
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x44
jb 0x41eb20
lea ebx, [esp + 0x5c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x44745c]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41ebad
mov eax, 0xffffffff
jmp 0x41ebb0
lea eax, [edi + edi]
push eax
call fcn.00409080
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x1e
push ebx
push 0
call dword [0x44745c]
mov dword [esp + 0x10], 0x13f811ca
mov dword [esp + 0x14], 0x1fea1ded
mov dword [esp + 0x18], 0x1bf719f2
mov dword [esp + 0x1c], 0x27c625e8
mov dword [esp + 0x20], 0x23d221cd
mov dword [esp + 0x24], 0x2f2c2dce
mov dword [esp + 0x28], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1b
ja 0x41ec69
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax - 0x3e0ef2ad]
add eax, 0x53
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
mov ecx, eax
xor ecx, 0xba
and eax, 0x3a
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1c
jb 0x41ec20
push 0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.00418f50
add esp, 0x14
mov ebx, eax
jmp dword [0x442d70]

Function at 0x4209e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x868
mov dword [esp + 0xc], 0
mov eax, 0x20219
mov ecx, 1
mov dword [esp + 0x10], 0
xor esi, esi
jmp dword [ecx*4 + 0x44349c]