joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18007c81c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x14], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0x10], 0x4c4f5341
mov dword [rbp - 0xc], 0x3c5e484c
lea r9, [rbp - 0x14]
mov r10d, 0x5397829d
mov r11b, 0x31
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18007c850
mov dword [rbp + 0x10], 0x5d414262
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x5341
mov r8d, ebx
mov byte [rbp + 0x16], 0x37
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18007c88e
mov dword [rbp - 0x20], 0x405a5c64
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x18], 0x3c5e5450
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18007c8d0
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x20]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007c91b
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007c931
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007c944
or r8d, 0xffffffff
lea rdx, [rbp - 0x14]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x58]
mov qword [0x1800e6bc8], rax
add rsp, 0x40
pop rbp
ret

Function at 0x18007c960
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x5d7b4178
mov r8d, ebx
mov dword [rbp - 0x1c], 0x56525251
mov byte [rbp - 0x18], 0x39
lea r9, [rbp - 0x20]
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18007c98e
mov dword [rbp - 0x17], 0x47524662
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x5658755d
mov r8d, ebx
mov dword [rbp - 0xf], 0x52525b4d
mov word [rbp - 0xb], 0x4c58
mov byte [rbp - 9], 0x3f
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18007c9d9
lea rdx, [rbp - 0x17]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007ca26
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007ca3c
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007ca4f
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x58]
mov qword [0x1800e7080], rax
add rsp, 0x40
pop rbp
ret
Function at 0x18007ca6c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r15
push rbp
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov dword [rbp + 0x10], 0x34475776
mov r8d, ebx
lea r9, [rbp + 0x10]
mov esi, 0x5397829d
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 4
jl 0x18007ca98
movdqa xmm0, xmmword [0x180008050]
lea r9, [rbp - 0x33]
movdqu xmmword [rbp - 0x33], xmm0
mov r8d, ebx
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18007cad0
mov dword [rbp - 0x40], 0x51505377
lea r9, [rbp - 0x40]
mov dword [rbp - 0x3c], 0x5b594345
mov r8d, ebx
mov word [rbp - 0x38], 0x3a51
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x18007cb0f
lea rdx, [rbp - 0x33]
lea rcx, [rbp - 0x40]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
movabs r15, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18007cb62
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007cb73
lea rcx, [rax - 0x10000]
cmp rcx, r15
jbe 0x18007cb73
mov rax, rbx
jmp 0x18007cb85
mov r8d, 1
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.18008fa44
mov rcx, rax
call fcn.18002b270
mov qword [0x1800e7050], rax
lea r9, [rbp - 0x40]
mov r8d, ebx
mov dword [rbp - 0x40], 0x6b475742
mov dword [rbp - 0x3c], 0x4a524560
mov dword [rbp - 0x38], 0x59565b77
mov byte [rbp - 0x34], 0x3d
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18007cbb4
mov dword [rbp - 0x33], 0x55564662
lea r9, [rbp - 0x33]
mov dword [rbp - 0x2f], 0x595b6658
mov r8d, ebx
mov dword [rbp - 0x2b], 0x4e545c4d
mov word [rbp - 0x27], 0x3e50
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18007cbfa
movdqa xmm0, xmmword [0x180007870]
lea r9, [rbp - 0x23]
movdqu xmmword [rbp - 0x23], xmm0
mov dword [rbp - 0x13], 0x442e2324
mov r8d, ebx
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x18007cc39
lea rdx, [rbp - 0x33]
lea rcx, [rbp - 0x23]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007cc82
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007cc8e
lea rcx, [rax - 0x10000]
cmp rcx, r15
ja 0x18007cca3
mov r8d, 1
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
lea r11, [rsp + 0x60]
mov qword [0x1800e7058], rax
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov r15, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18007ccc8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x405d5d72
mov r8d, ebx
mov dword [rbp - 0xc], 0x4b595f54
mov byte [rbp - 8], 0x39
lea r9, [rbp - 0x10]
mov r10d, 0x5397829d
mov r11b, 0x31
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18007ccf9
mov dword [rbp + 0x10], 0x5d414662
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x515b
mov r8d, ebx
mov byte [rbp + 0x16], 0x37
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18007cd37
mov dword [rbp + 0x18], 0x40404b62
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x5b50
mov r8d, ebx
mov byte [rbp + 0x1e], 0x37
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18007cd75
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x18]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007cdc0
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007cdd6
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007cdeb
mov r8d, 1
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x50]
mov qword [0x1800e6b48], rax
add rsp, 0x30
pop rbp
ret
Function at 0x18007d6dc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub rsp, 0x28
call fcn.180072fec
call fcn.1800647e4
call fcn.18006b6a4
call fcn.18006bef0
call fcn.18006d644
call fcn.18006c234
call fcn.180064d68
call fcn.18006c550
call fcn.180078718
call fcn.18006458c
call fcn.180078264
call fcn.18007b6dc
call fcn.1800783a0
call fcn.180073a44
call fcn.180075b38
call fcn.18007dc80
call fcn.18007e354
call fcn.1800716b4
call fcn.180070b14
call fcn.1800744a8
call fcn.18007f990
call fcn.18007fa94
call fcn.180079cb8
call fcn.18006d770
call fcn.180078850
call fcn.180065650
call fcn.180075c34
call fcn.180076e90
call fcn.18007394c
call fcn.180074c28
call fcn.180066528
call fcn.18007789c
call fcn.180077c30
call fcn.18006c7a4
call fcn.18007eebc
call fcn.180073850
call fcn.1800751ac
call fcn.180065e74
call fcn.180073f38
call fcn.180074b24
call fcn.180068ad4
call fcn.180074034
call fcn.180066254
call fcn.180077b38
call fcn.18007bb98
call fcn.180069218
call fcn.1800652c8
call fcn.18007d8d0
call fcn.18007e0a4
call fcn.1800746a8
call fcn.18007daa4
call fcn.18007d7e0
call fcn.18007894c
call fcn.18006c020
add rsp, 0x28
jmp 0x18007d6dc
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x41475362
mov r8d, ebx
mov dword [rbp - 0x2c], 0x51435747
mov word [rbp - 0x28], 0x5456
lea r9, [rbp - 0x30]
mov byte [rbp - 0x26], 0x3b
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18007d710
movdqa xmm0, xmmword [0x180007010]
lea r9, [rbp - 0x25]
movdqu xmmword [rbp - 0x25], xmm0
mov dword [rbp - 0x15], 0x36263624
mov r8d, ebx
mov word [rbp - 0x11], 0x4636
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x16
jl 0x18007d756
lea rdx, [rbp - 0x25]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007d7a3
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007d7b9
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007d7cb
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6b08], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18007d7e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp + 0x18], 0x46465d79
mov r8d, ebx
mov byte [rbp + 0x1c], 0x35
lea r9, [rbp + 0x18]
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x18007d807
movdqa xmm0, xmmword [0x180007820]
lea r9, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x44303024
mov r8d, ebx
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x18007d847
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007d894
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007d8aa
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007d8bc
mov r8b, 1
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6a50], rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x18007d8d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x180006b60]
lea r9, [rbp - 0x1b]
xor ebx, ebx
mov word [rbp - 0xb], 0x4233
movdqu xmmword [rbp - 0x1b], xmm0
mov r8d, ebx
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x18007d8fe
movdqa xmm0, xmmword [0x180007490]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x20], 0x4232
mov r8d, ebx
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x18007d93f
lea rdx, [rbp - 0x30]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
movabs rdi, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18007d998
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007d9a9
lea rcx, [rax - 0x10000]
cmp rcx, rdi
jbe 0x18007d9a9
mov rax, rbx
jmp 0x18007d9b8
mov r8b, 1
lea rdx, [rbp - 0x1b]
mov rcx, rax
call fcn.18008f890
movdqa xmm0, xmmword [0x1800072e0]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov qword [0x1800e69f8], rax
mov r8d, ebx
mov dword [rbp - 0x20], 0x36262b2d
mov byte [rbp - 0x1c], 0x45
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x15
jl 0x18007d9de
movdqa xmm0, xmmword [0x180007490]
lea r9, [rbp - 0x1b]
movdqu xmmword [rbp - 0x1b], xmm0
mov word [rbp - 0xb], 0x4232
mov r8d, ebx
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x18007da1f
lea rdx, [rbp - 0x1b]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007da6e
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007da7a
lea rcx, [rax - 0x10000]
cmp rcx, rdi
ja 0x18007da8c
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov rdi, qword [rsp + 0x70]
mov qword [0x1800e6a00], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18007daa4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x5c545b7d
mov r8d, ebx
mov dword [rbp - 0x2c], 0x4c597f41
mov dword [rbp - 0x28], 0x5548545c
lea r9, [rbp - 0x30]
mov word [rbp - 0x24], 0x4749
mov byte [rbp - 0x22], 0x3f
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18007dade
movdqa xmm0, xmmword [0x180007810]
lea r9, [rbp - 0x1e]
movdqu xmmword [rbp - 0x1e], xmm0
mov dword [rbp - 0xe], 0x44303024
mov r8d, ebx
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x18007db20
lea rdx, [rbp - 0x1e]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
movabs r14, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18007db79
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007db8a
lea rcx, [rax - 0x10000]
cmp rcx, r14
jbe 0x18007db8a
mov rax, rbx
jmp 0x18007db99
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18008f890
movdqa xmm0, xmmword [0x180006b60]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov qword [0x1800e6a40], rax
mov r8d, ebx
mov word [rbp - 0x20], 0x4233
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x18007dbba
movdqa xmm0, xmmword [0x180007810]
lea r9, [rbp - 0x1e]
movdqu xmmword [rbp - 0x1e], xmm0
mov dword [rbp - 0xe], 0x44303024
mov r8d, ebx
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x18007dbfc
lea rdx, [rbp - 0x1e]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007dc4b
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007dc57
lea rcx, [rax - 0x10000]
cmp rcx, r14
ja 0x18007dc69
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov r14, qword [rsp + 0x70]
mov qword [0x1800e6a48], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18007dfa4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0xc], 0x4c44587c
mov dword [rbp - 8], 0x59585458
lea r9, [rbp - 0x10]
mov byte [rbp - 4], 0x3d
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18007dfd9
mov dword [rbp + 0x18], 0x6b777d65
lea r9, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x384e5d66
mov r8d, ebx
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x18007e013
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007e060
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007e076
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007e089
or r8d, 0xffffffff
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x50]
mov qword [0x1800e6dc8], rax
add rsp, 0x30
pop rbp
ret
Function at 0x18007e354
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x17], 0x515e5376
mov r8d, ebx
mov dword [rbp - 0x13], 0x5d435771
mov dword [rbp - 0xf], 0x5956536d
lea r9, [rbp - 0x17]
mov byte [rbp - 0xb], 0x3d
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18007e389
mov dword [rbp - 0x20], 0x6b777d65
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5d5a5f61
mov r8d, ebx
mov byte [rbp - 0x18], 0x39
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18007e3c7
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007e414
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007e42a
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007e43c
mov r8b, 1
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e64a8], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x18007e450
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0x1c], 0x56564441
mov dword [rbp - 0x18], 0x485a564a
lea r9, [rbp - 0x20]
mov word [rbp - 0x14], 0x5a58
mov r10d, 0x5397829d
mov byte [rbp - 0x12], 0x3f
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18007e48b
movdqa xmm0, xmmword [0x180008100]
lea r9, [rbp - 0x11]
movdqu xmmword [rbp - 0x11], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18007e4c4
lea rdx, [rbp - 0x11]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007e511
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007e527
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007e53a
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x58]
mov qword [0x1800e7098], rax
add rsp, 0x40
pop rbp
ret
Function at 0x18007eebc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x447c4158
mov r8d, ebx
mov word [rbp + 0x1c], 0x5850
mov byte [rbp + 0x1e], 0x37
lea r9, [rbp + 0x18]
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18007eee9
mov dword [rbp - 0x10], 0x5a7a7b64
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x4c595343
mov r8d, ebx
mov dword [rbp - 8], 0x3c424856
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18007ef2a
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007ef77
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007ef8d
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007ef9f
xor r8d, r8d
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6938], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x18007efb4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x6b475742
mov r8d, ebx
mov dword [rbp - 0x2c], 0x51535747
mov word [rbp - 0x28], 0x494c
lea r9, [rbp - 0x30]
mov byte [rbp - 0x26], 0x3b
mov r10d, 0x5397829d
mov r11b, 0x31
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18006b597
movdqa xmm0, xmmword [0x180008090]
lea r9, [rbp - 0x19]
movdqu xmmword [rbp - 0x19], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18006b5d1
mov dword [rbp - 0x25], 0x405a5c64
lea r9, [rbp - 0x25]
mov dword [rbp - 0x21], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x1d], 0x3c5e5450
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18006b613
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x25]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006b65e
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006b674
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006b689
mov r8d, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x60]
mov qword [0x1800e6db8], rax
add rsp, 0x50
pop rbp
ret
sub rsp, 0x28
call fcn.18007ce08
call fcn.180073124
call fcn.18007c81c
call fcn.1800761bc
call fcn.18006b310
call fcn.18007c5dc
call fcn.18007699c
call fcn.1800752a8
call fcn.18007bfe8
call fcn.18006b8d4
call fcn.18006ba18
call fcn.180068cd8
call fcn.18007c36c
call fcn.18007e554
call fcn.18007b810
call fcn.18006cab0
call fcn.180064914
add rsp, 0x28
jmp 0x18006b560