joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180056d78
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x6a405655
mov r8d, ebx
mov dword [rbp - 0xc], 0x5757545f
mov dword [rbp - 8], 0x544e4b69
lea r9, [rbp - 0x10]
mov word [rbp - 4], 0x5a4a
mov r10d, 0x1f7047dd
mov byte [rbp - 2], 0x40
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x180056db3
mov dword [rbp + 0x18], 0x5851477b
lea r9, [rbp + 0x18]
mov byte [rbp + 0x1c], 0x36
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x180056df3
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180056e49
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180056e5f
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180056e72
or r8d, 0xffffffff
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x50]
mov qword [0x1800c8dd0], rax
add rsp, 0x30
pop rbp
ret

Function at 0x180056e8c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x5851475b
mov r8d, ebx
mov dword [rbp - 0x1c], 0x4d4b5e7a
mov byte [rbp - 0x18], 0x3a
lea r9, [rbp - 0x20]
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x180056eba
mov dword [rbp - 0x17], 0x5851477b
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x4d565875
mov r8d, ebx
mov dword [rbp - 0xf], 0x5852525b
mov word [rbp - 0xb], 0x3f4c
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x180056f0a
lea rdx, [rbp - 0x17]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180056f60
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180056f76
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180056f88
mov r8b, 1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8970], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x18005746c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x180006c10]
lea r9, [rbp - 0x17]
xor ebx, ebx
mov byte [rbp - 7], 0x42
movdqu xmmword [rbp - 0x17], xmm0
mov r8d, ebx
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x11
jl 0x180057499
mov dword [rbp - 0x20], 0x5851477b
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5757547f
mov r8d, ebx
mov byte [rbp - 0x18], 0x3a
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x1800574e0
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180057536
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18005754c
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18005755e
mov r8b, 1
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c85b0], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x180057570
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x17], 0x615a4660
mov r8d, ebx
mov dword [rbp - 0x13], 0x5d5d5a5f
mov dword [rbp - 0xf], 0x5448587b
lea r9, [rbp - 0x17]
mov word [rbp - 0xb], 0x5151
mov r10d, 0x1f7047dd
mov byte [rbp - 9], 0x40
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x1800575ab
mov dword [rbp - 0x20], 0x5851477b
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5757547f
mov r8d, ebx
mov byte [rbp - 0x18], 0x3a
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x1800575f2
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180057648
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18005765e
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180057671
or r8d, 0xffffffff
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x58]
mov qword [0x1800c8e08], rax
add rsp, 0x40
pop rbp
ret
Function at 0x180057a50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x6a405655
mov r8d, ebx
mov dword [rbp - 0x1c], 0x504c5973
mov word [rbp - 0x18], 0x424e
lea r9, [rbp - 0x20]
mov byte [rbp - 0x16], 0x3c
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180057a84
mov dword [rbp - 0x15], 0x54575c7e
lea r9, [rbp - 0x15]
mov dword [rbp - 0x11], 0x5854675a
mov r8d, ebx
mov dword [rbp - 0xd], 0x3d4e5e43
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180057ace
lea rdx, [rbp - 0x15]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180057b24
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180057b3a
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180057b4d
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x58]
mov qword [0x1800c9040], rax
add rsp, 0x40
pop rbp
ret

Function at 0x180057b68
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x5458436d
mov r8d, ebx
mov dword [rbp - 0x1c], 0x774a524f
mov dword [rbp - 0x18], 0x3d59565b
lea r9, [rbp - 0x20]
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180057b99
mov dword [rbp - 0x14], 0x415b5c7e
lea r9, [rbp - 0x14]
mov dword [rbp - 0x10], 0x5c545557
mov r8d, ebx
mov dword [rbp - 0xc], 0x4d4e5479
mov word [rbp - 8], 0x5a4d
mov byte [rbp - 6], 0x40
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x180057bed
lea rdx, [rbp - 0x14]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180057c43
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180057c59
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180057c6b
mov r8b, 1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8978], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x180057c80
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x15], 0x5b5d525f
mov r8d, ebx
mov dword [rbp - 0x11], 0x5c555675
mov word [rbp - 0xd], 0x5a48
lea r9, [rbp - 0x15]
mov byte [rbp - 0xb], 0x3c
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180057cb4
mov dword [rbp - 0x20], 0x5b5d527f
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5c555675
mov r8d, ebx
mov word [rbp - 0x18], 0x5a48
mov byte [rbp - 0x16], 0x3c
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180057d01
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180057d57
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180057d6d
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180057d7f
xor r8d, r8d
lea rdx, [rbp - 0x15]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8848], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x18005824c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x457b407b
mov r8d, ebx
mov word [rbp + 0x1c], 0x5953
mov byte [rbp + 0x1e], 0x38
lea r9, [rbp + 0x18]
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180058279
mov dword [rbp - 0x10], 0x7c44527f
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x4b5d4358
mov r8d, ebx
mov dword [rbp - 8], 0x585f5a5c
mov byte [rbp - 4], 0x3e
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x1800582c7
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18005831d
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180058333
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180058345
xor r8d, r8d
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8958], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x180058bf8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x6a405655
mov r8d, ebx
mov dword [rbp - 0x2c], 0x40595b46
mov dword [rbp - 0x28], 0x5c72495f
lea r9, [rbp - 0x30]
mov word [rbp - 0x24], 0x5a53
mov r10d, 0x1f7047dd
mov byte [rbp - 0x22], 0x40
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18004e687
movdqa xmm0, xmmword [0x1800064e0]
lea r9, [rbp - 0x21]
movdqu xmmword [rbp - 0x21], xmm0
mov dword [rbp - 0x11], 0x37212d2b
mov r8d, ebx
mov byte [rbp - 0xd], 0x46
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x15
jl 0x18004e6d4
lea rdx, [rbp - 0x21]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004e72a
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004e740
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004e753
or r8d, 0xffffffff
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x68]
mov qword [0x1800c90d0], rax
add rsp, 0x50
pop rbp
ret
sub rsp, 0x28
call fcn.18006300c
call fcn.1800607bc
call fcn.180062d94
call fcn.180056d78
call fcn.180061c38
call fcn.180054044
call fcn.1800551d8
call fcn.180057570
call fcn.18004fbdc
call fcn.18005ea18
call fcn.180062df8
call fcn.180047668
call fcn.180049788
call fcn.180058ec0
call fcn.18005a3c8
call fcn.180052a1c
call fcn.18005b504
call fcn.18004f80c
call fcn.18004ee20
call fcn.180057a50
call fcn.180047e5c
call fcn.18004ef3c
call fcn.180060528
call fcn.18004b10c
call fcn.18004ad5c
call fcn.18006040c
call fcn.180048188
call fcn.180062144
call fcn.1800468bc
call fcn.180047288
call fcn.180060194
call fcn.18005d280
add rsp, 0x28
jmp 0x18004e64c
Function at 0x180058ca8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x505a5c50
mov r8d, ebx
mov dword [rbp - 0xc], 0x57594562
mov dword [rbp - 8], 0x4f535d49
lea r9, [rbp - 0x10]
mov word [rbp - 4], 0x4c53
mov r10d, 0x1f7047dd
mov byte [rbp - 2], 0x40
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x180058ce3
mov dword [rbp + 0x18], 0x50505c7f
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x375a
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x180058d25
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180058d7b
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180058d91
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180058da3
mov r8b, 1
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8490], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x180058db8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x52555f54
mov r8d, ebx
mov word [rbp + 0x1c], 0x3745
lea r9, [rbp + 0x18]
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x180058de1
mov dword [rbp - 0x10], 0x50505c7f
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x584c645a
mov r8d, ebx
mov word [rbp - 8], 0x5e4e
mov byte [rbp - 6], 0x3c
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180058e2e
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180058e84
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180058e9a
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180058eac
mov r8b, 1
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8828], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x18005a1b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov dword [rbp - 0x35], 0x42515a44
mov r8d, ebx
mov dword [rbp - 0x31], 0x4a5e5179
mov word [rbp - 0x2d], 0x4f5f
lea r9, [rbp - 0x35]
mov byte [rbp - 0x2b], 0x3c
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18005a1e3
mov dword [rbp - 0x40], 0x4c555f62
lea r9, [rbp - 0x40]
mov dword [rbp - 0x3c], 0x407d4553
mov r8d, ebx
mov word [rbp - 0x38], 0x485f
mov byte [rbp - 0x36], 0x3c
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18005a232
lea rdx, [rbp - 0x40]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
movabs rdi, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18005a294
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18005a2a5
lea rcx, [rax - 0x10000]
cmp rcx, rdi
jbe 0x18005a2a5
mov rax, rbx
jmp 0x18005a2b4
mov r8b, 1
lea rdx, [rbp - 0x35]
mov rcx, rax
call fcn.180073298
movdqa xmm0, xmmword [0x180006350]
lea r9, [rbp - 0x2a]
movdqu xmmword [rbp - 0x2a], xmm0
mov qword [0x1800c8830], rax
mov r8d, ebx
mov dword [rbp - 0x1a], 0x2625011d
mov dword [rbp - 0x16], 0x2e262e2d
mov dword [rbp - 0x12], 0x2129220c
mov word [rbp - 0xe], 0x4f2a
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x1e
jl 0x18005a2ea
mov dword [rbp - 0x35], 0x4c555f62
lea r9, [rbp - 0x35]
mov dword [rbp - 0x31], 0x407d4553
mov r8d, ebx
mov word [rbp - 0x2d], 0x485f
mov byte [rbp - 0x2b], 0x3c
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18005a339
lea rdx, [rbp - 0x35]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18005a391
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18005a39d
lea rcx, [rax - 0x10000]
cmp rcx, rdi
ja 0x18005a3af
mov r8b, 1
lea rdx, [rbp - 0x2a]
mov rcx, rax
call fcn.180073298
mov rbx, rax
lea r11, [rsp + 0x60]
mov qword [0x1800c8838], rbx
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18005af54
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x415a5c51
mov r8d, ebx
mov dword [rbp - 0x1c], 0x5c565e57
mov dword [rbp - 0x18], 0x51597948
lea r9, [rbp - 0x20]
mov word [rbp - 0x14], 0x3f4a
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18005af8b
movdqa xmm0, xmmword [0x180008040]
lea r9, [rbp - 0x12]
movdqu xmmword [rbp - 0x12], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18005afcd
lea rdx, [rbp - 0x12]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18005b023
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18005b039
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18005b04b
mov r8b, 1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c89b8], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x18005b504
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x6a405655
mov r8d, ebx
mov dword [rbp - 0x1c], 0x4976447f
mov word [rbp - 0x18], 0x3b59
lea r9, [rbp - 0x20]
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x18005b533
mov dword [rbp - 0x15], 0x4c555f62
lea r9, [rbp - 0x15]
mov dword [rbp - 0x11], 0x56754553
mov r8d, ebx
mov dword [rbp - 0xd], 0x3d505e5e
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18005b57f
lea rdx, [rbp - 0x15]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
movabs r14, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18005b5e1
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18005b5f2
lea rcx, [rax - 0x10000]
cmp rcx, r14
jbe 0x18005b5f2
mov rax, rbx
jmp 0x18005b602
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18007344c
mov rcx, rax
call fcn.18002c688
mov qword [0x1800c9008], rax
lea r9, [rbp - 0x20]
mov r8d, ebx
mov dword [rbp - 0x20], 0x40565660
mov dword [rbp - 0x1c], 0x785c5b5f
mov word [rbp - 0x18], 0x5756
mov byte [rbp - 0x16], 0x3c
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18005b630
mov dword [rbp - 0x15], 0x4c555f62
lea r9, [rbp - 0x15]
mov dword [rbp - 0x11], 0x56754553
mov r8d, ebx
mov dword [rbp - 0xd], 0x3d505e5e
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18005b67c
lea rdx, [rbp - 0x15]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18005b6d4
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18005b6e0
lea rcx, [rax - 0x10000]
cmp rcx, r14
ja 0x18005b6f3
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
mov qword [0x1800c9010], rax
add rsp, 0x40
pop rbp
ret
Function at 0x18005b714
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x17], 0x47514047
mov r8d, ebx
mov dword [rbp - 0x13], 0x5c555658
mov byte [rbp - 0xf], 0x3a
lea r9, [rbp - 0x17]
mov r10d, 0x1f7047dd
mov r11b, 0x32
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18005b745
mov dword [rbp - 0xe], 0x4c555f62
lea r9, [rbp - 0xe]
mov dword [rbp - 0xa], 0x58764553
mov r8d, ebx
mov dword [rbp - 6], 0x79755e57
mov byte [rbp - 2], 0x3e
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18005b794
mov dword [rbp - 0x20], 0x415b4162
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5f4d7559
mov r8d, ebx
mov byte [rbp - 0x18], 0x3a
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18005b7dc
lea rdx, [rbp - 0xe]
lea rcx, [rbp - 0x20]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18005b830
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18005b846
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18005b858
mov r8b, 1
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8440], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret