joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18007e8b8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0x1c], 0x4879457c
mov word [rbp - 0x18], 0x3a5a
lea r9, [rbp - 0x20]
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x18007e8e7
mov dword [rbp - 0x15], 0x4d525e61
lea r9, [rbp - 0x15]
mov dword [rbp - 0x11], 0x577a4450
mov r8d, ebx
mov dword [rbp - 0xd], 0x3c575f5d
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18007e933
lea rdx, [rbp - 0x15]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
movabs r14, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18007e995
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007e9a6
lea rcx, [rax - 0x10000]
cmp rcx, r14
jbe 0x18007e9a6
mov rax, rbx
jmp 0x18007e9b6
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180097118
mov rcx, rax
call fcn.18002c680
mov qword [0x1800edff8], rax
lea r9, [rbp - 0x20]
mov r8d, ebx
mov dword [rbp - 0x20], 0x41515763
mov dword [rbp - 0x1c], 0x79535a5c
mov word [rbp - 0x18], 0x5655
mov byte [rbp - 0x16], 0x3b
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18007e9e4
mov dword [rbp - 0x15], 0x4d525e61
lea r9, [rbp - 0x15]
mov dword [rbp - 0x11], 0x577a4450
mov r8d, ebx
mov dword [rbp - 0xd], 0x3c575f5d
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18007ea30
lea rdx, [rbp - 0x15]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007ea88
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007ea94
lea rcx, [rax - 0x10000]
cmp rcx, r14
ja 0x18007eaa7
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
mov qword [0x1800ee000], rax
add rsp, 0x40
pop rbp
ret
Function at 0x18007eac8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x17], 0x46564144
mov r8d, ebx
mov dword [rbp - 0x13], 0x5d5a575b
mov byte [rbp - 0xf], 0x39
lea r9, [rbp - 0x17]
mov r10d, 0x2f684bdb
mov r11b, 0x31
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18007eaf9
mov dword [rbp - 0xe], 0x4d525e61
lea r9, [rbp - 0xe]
mov dword [rbp - 0xa], 0x59794450
mov r8d, ebx
mov dword [rbp - 6], 0x78725f54
mov byte [rbp - 2], 0x3d
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18007eb48
mov dword [rbp - 0x20], 0x405c4061
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5e42745a
mov r8d, ebx
mov byte [rbp - 0x18], 0x39
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18007eb90
lea rdx, [rbp - 0xe]
lea rcx, [rbp - 0x20]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007ebe4
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007ebfa
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007ec0c
mov r8b, 1
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed430], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x18007efe8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp + 0x10], 0x565e575c
mov r8d, ebx
mov dword [rbp + 0x14], 0x38444450
lea r9, [rbp + 0x10]
mov r10d, 0x2f684bdb
mov r11b, 0x31
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x18007f015
mov dword [rbp - 0x17], 0x4d525e61
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x5d634450
mov r8d, ebx
mov word [rbp - 0xf], 0x5758
mov byte [rbp - 0xd], 0x3b
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18007f063
mov dword [rbp - 0x20], 0x405c4061
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5e42745a
mov r8d, ebx
mov byte [rbp - 0x18], 0x39
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18007f0ab
lea rdx, [rbp - 0x17]
lea rcx, [rbp - 0x20]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007f0ff
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007f115
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007f127
mov r8b, 1
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed418], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x18007f13c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x5d405d41
mov r8d, ebx
mov dword [rbp - 0x1c], 0x56585f41
mov byte [rbp - 0x18], 0x39
lea r9, [rbp - 0x20]
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18007f16a
mov dword [rbp - 0x17], 0x4d525e61
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x51634450
mov r8d, ebx
mov word [rbp - 0xf], 0x515a
mov byte [rbp - 0xd], 0x3b
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18007f1b7
lea rdx, [rbp - 0x17]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007f20d
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007f223
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007f235
mov r8b, 1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed7f8], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x180080634
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x515f5765
mov r8d, ebx
mov dword [rbp - 0x1c], 0x4c455945
mov word [rbp - 0x18], 0x556d
lea r9, [rbp - 0x20]
mov byte [rbp - 0x16], 0x3b
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180080668
movdqa xmm0, xmmword [0x180006ad0]
lea r9, [rbp - 0x15]
movdqu xmmword [rbp - 0x15], xmm0
mov word [rbp - 5], 0x362f
mov r8d, ebx
mov byte [rbp - 3], 0x43
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x13
jl 0x1800806b4
lea rdx, [rbp - 0x15]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18008070a
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180080720
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180080735
mov r8d, 2
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x58]
mov qword [0x1800ee0b8], rax
add rsp, 0x40
pop rbp
ret
Function at 0x1800823a4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x27], 0x5e5c4041
mov r8d, ebx
mov dword [rbp - 0x23], 0x51435550
mov dword [rbp - 0x1f], 0x3c485f55
lea r9, [rbp - 0x27]
mov r10d, 0x2f684bdb
mov r11b, 0x31
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x1800823d8
movdqa xmm0, xmmword [0x180008010]
lea r9, [rbp - 0x1b]
movdqu xmmword [rbp - 0x1b], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18008241b
mov dword [rbp - 0x30], 0x405c4061
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x5e42745a
mov r8d, ebx
mov byte [rbp - 0x28], 0x39
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x180082463
lea rdx, [rbp - 0x1b]
lea rcx, [rbp - 0x30]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x1800824b7
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x1800824cd
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800824df
mov r8b, 1
lea rdx, [rbp - 0x27]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed438], rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x1800833f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x10], 0x505d5b77
mov r8d, ebx
mov byte [rbp + 0x14], 0x35
lea r9, [rbp + 0x10]
mov r10d, 0x2f684bdb
mov r11b, 0x31
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x18008341a
mov dword [rbp + 0x18], 0x50525a62
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x4450
mov r8d, ebx
mov byte [rbp + 0x1e], 0x37
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180083461
mov dword [rbp - 0x10], 0x405a5c64
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 8], 0x3c5e5450
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x1800834ac
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180083500
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180083516
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18008352b
mov r8d, 1
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x50]
mov qword [0x1800edc18], rax
add rsp, 0x30
pop rbp
ret

Function at 0x180083548
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0x1c], 0x5c595367
mov dword [rbp - 0x18], 0x4e5e485c
lea r9, [rbp - 0x20]
mov word [rbp - 0x14], 0x3e4e
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18008357f
movdqa xmm0, xmmword [0x180006d50]
lea r9, [rbp - 0x12]
movdqu xmmword [rbp - 0x12], xmm0
mov byte [rbp - 2], 0x41
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x11
jl 0x1800835c5
lea rdx, [rbp - 0x12]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18008361b
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180083631
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180083644
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x58]
mov qword [0x1800ee0b0], rax
add rsp, 0x40
pop rbp
ret
Function at 0x180083660
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x14], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0x10], 0x4c4f5341
mov dword [rbp - 0xc], 0x3c5e484c
lea r9, [rbp - 0x14]
mov r10d, 0x2f684bdb
mov r11b, 0x31
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180083694
mov dword [rbp + 0x10], 0x5d414262
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x5341
mov r8d, ebx
mov byte [rbp + 0x16], 0x37
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x1800836db
mov dword [rbp - 0x20], 0x405a5c64
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x18], 0x3c5e5450
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180083726
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x20]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18008377a
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180083790
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800837a3
or r8d, 0xffffffff
lea rdx, [rbp - 0x14]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x58]
mov qword [0x1800edbc8], rax
add rsp, 0x40
pop rbp
ret

Function at 0x1800837c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x5d7b4178
mov r8d, ebx
mov dword [rbp - 0x1c], 0x56525251
mov byte [rbp - 0x18], 0x39
lea r9, [rbp - 0x20]
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x1800837ee
mov dword [rbp - 0x17], 0x47524662
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x5658755d
mov r8d, ebx
mov dword [rbp - 0xf], 0x52525b4d
mov word [rbp - 0xb], 0x4c58
mov byte [rbp - 9], 0x3f
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x180083842
lea rdx, [rbp - 0x17]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180083898
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x1800838ae
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800838c1
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x58]
mov qword [0x1800ee080], rax
add rsp, 0x40
pop rbp
ret
Function at 0x180083b70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x405d5d72
mov r8d, ebx
mov dword [rbp - 0xc], 0x4b595f54
mov byte [rbp - 8], 0x39
lea r9, [rbp - 0x10]
mov r10d, 0x2f684bdb
mov r11b, 0x31
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x180083ba1
mov dword [rbp + 0x10], 0x5d414662
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x515b
mov r8d, ebx
mov byte [rbp + 0x16], 0x37
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180083be8
mov dword [rbp + 0x18], 0x40404b62
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x5b50
mov r8d, ebx
mov byte [rbp + 0x1e], 0x37
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180083c2f
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x18]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180083c83
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180083c99
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180083cae
mov r8d, 1
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x50]
mov qword [0x1800edb48], rax
add rsp, 0x30
pop rbp
ret
Function at 0x180084674
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub rsp, 0x28
call fcn.1800791b4
call fcn.180069758
call fcn.180070ea4
call fcn.1800717ac
call fcn.1800730b0
call fcn.180071b30
call fcn.180069d54
call fcn.180071e68
call fcn.18007efe8
call fcn.1800694cc
call fcn.18007eac8
call fcn.1800823a4
call fcn.18007ec20
call fcn.180079cf0
call fcn.18007c05c
call fcn.180084c80
call fcn.1800853f4
call fcn.180077618
call fcn.18007697c
call fcn.18007a82c
call fcn.180086c0c
call fcn.180086d20
call fcn.180080750
call fcn.1800731f8
call fcn.18007f13c
call fcn.18006a710
call fcn.18007c16c
call fcn.18007d564
call fcn.180079be8
call fcn.18007b040
call fcn.18006b70c
call fcn.18007e038
call fcn.18007e414
call fcn.1800720d8
call fcn.180086048
call fcn.180079ad8
call fcn.18007b600
call fcn.18006afd8
call fcn.18007a24c
call fcn.18007af28
call fcn.18006dfd0
call fcn.18007a35c
call fcn.18006b400
call fcn.18007e308
call fcn.1800828cc
call fcn.18006e7a4
call fcn.18006a33c
call fcn.180084888
call fcn.180085108
call fcn.18007aa4c
call fcn.180084a80
call fcn.180084788
call fcn.18007f248
call fcn.1800718f8
add rsp, 0x28
jmp 0x180084674
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x41475362
mov r8d, ebx
mov dword [rbp - 0x2c], 0x51435747
mov word [rbp - 0x28], 0x5456
lea r9, [rbp - 0x30]
mov byte [rbp - 0x26], 0x3b
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x1800846a8
movdqa xmm0, xmmword [0x180006ff0]
lea r9, [rbp - 0x25]
movdqu xmmword [rbp - 0x25], xmm0
mov dword [rbp - 0x15], 0x36263624
mov r8d, ebx
mov word [rbp - 0x11], 0x4636
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x16
jl 0x1800846f7
lea rdx, [rbp - 0x25]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18008474d
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180084763
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180084775
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800edb08], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180084788
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp + 0x18], 0x46465d79
mov r8d, ebx
mov byte [rbp + 0x1c], 0x35
lea r9, [rbp + 0x18]
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x1800847af
movdqa xmm0, xmmword [0x180007800]
lea r9, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x44303024
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x1800847f8
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18008484e
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180084864
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180084876
mov r8b, 1
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800eda50], rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret