joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004e3ec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x1800073b0]
lea r9, [rbp - 0x20]
xor ebx, ebx
mov word [rbp - 0x10], 0x4336
movdqu xmmword [rbp - 0x20], xmm0
mov r8d, ebx
mov r10d, 0x1f7047dd
mov r11b, 0x32
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x18004e41e
mov dword [rbp + 0x18], 0x59584671
lea r9, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x395f595f
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x18004e462
mov dword [rbp + 0x10], 0x635a5c71
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x4557
mov r8d, ebx
mov byte [rbp + 0x16], 0x38
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18004e4a9
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004e4fd
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004e513
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004e525
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c83e0], rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x18004e538
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x4c555f42
mov r8d, ebx
mov dword [rbp - 0x2c], 0x4d6b4553
mov dword [rbp - 0x28], 0x74515a5f
lea r9, [rbp - 0x30]
mov word [rbp - 0x24], 0x3f7a
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18004e56f
movdqa xmm0, xmmword [0x1800064e0]
lea r9, [rbp - 0x22]
movdqu xmmword [rbp - 0x22], xmm0
mov dword [rbp - 0x12], 0x37212d2b
mov r8d, ebx
mov byte [rbp - 0xe], 0x46
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x15
jl 0x18004e5bc
lea rdx, [rbp - 0x22]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004e612
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004e628
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004e63a
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8b10], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18004e64c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x6a405655
mov r8d, ebx
mov dword [rbp - 0x2c], 0x40595b46
mov dword [rbp - 0x28], 0x5c72495f
lea r9, [rbp - 0x30]
mov word [rbp - 0x24], 0x5a53
mov r10d, 0x1f7047dd
mov byte [rbp - 0x22], 0x40
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18004e687
movdqa xmm0, xmmword [0x1800064e0]
lea r9, [rbp - 0x21]
movdqu xmmword [rbp - 0x21], xmm0
mov dword [rbp - 0x11], 0x37212d2b
mov r8d, ebx
mov byte [rbp - 0xd], 0x46
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x15
jl 0x18004e6d4
lea rdx, [rbp - 0x21]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004e72a
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004e740
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004e753
or r8d, 0xffffffff
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x68]
mov qword [0x1800c90d0], rax
add rsp, 0x50
pop rbp
ret
sub rsp, 0x28
call fcn.18006300c
call fcn.1800607bc
call fcn.180062d94
call fcn.180056d78
call fcn.180061c38
call fcn.180054044
call fcn.1800551d8
call fcn.180057570
call fcn.18004fbdc
call fcn.18005ea18
call fcn.180062df8
call fcn.180047668
call fcn.180049788
call fcn.180058ec0
call fcn.18005a3c8
call fcn.180052a1c
call fcn.18005b504
call fcn.18004f80c
call fcn.18004ee20
call fcn.180057a50
call fcn.180047e5c
call fcn.18004ef3c
call fcn.180060528
call fcn.18004b10c
call fcn.18004ad5c
call fcn.18006040c
call fcn.180048188
call fcn.180062144
call fcn.1800468bc
call fcn.180047288
call fcn.180060194
call fcn.18005d280
add rsp, 0x28
jmp 0x18004e64c
Function at 0x18004e770
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x17], 0x5c425d57
mov r8d, ebx
mov dword [rbp - 0x13], 0x54565844
mov dword [rbp - 0xf], 0x3d48555f
lea r9, [rbp - 0x17]
mov r10d, 0x1f7047dd
mov r11b, 0x32
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18004e7a4
mov dword [rbp + 0x10], 0x5c405d77
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x4e42
mov r8d, ebx
mov byte [rbp + 0x16], 0x38
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18004e7eb
mov dword [rbp - 0x20], 0x415b4162
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5f4d7559
mov r8d, ebx
mov byte [rbp - 0x18], 0x3a
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18004e833
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x20]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004e887
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004e89d
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004e8af
mov r8b, 1
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c83f0], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x18004eaa8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x17], 0x50405256
mov r8d, ebx
mov dword [rbp - 0x13], 0x5c555e62
mov byte [rbp - 0xf], 0x3a
lea r9, [rbp - 0x17]
mov r10d, 0x1f7047dd
mov r11b, 0x32
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18004ead9
mov dword [rbp - 0xe], 0x5c425d77
lea r9, [rbp - 0xe]
mov dword [rbp - 0xa], 0x54565844
mov r8d, ebx
mov dword [rbp - 6], 0x3d48555f
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18004eb24
mov dword [rbp - 0x20], 0x415b4162
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5f4d7559
mov r8d, ebx
mov byte [rbp - 0x18], 0x3a
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18004eb6c
lea rdx, [rbp - 0xe]
lea rcx, [rbp - 0x20]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004ebc0
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004ebd6
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004ebe8
mov r8b, 1
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8420], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x18004ed18
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x505d5f51
mov r8d, ebx
mov word [rbp + 0x1c], 0x4358
mov byte [rbp + 0x1e], 0x38
lea r9, [rbp + 0x18]
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18004ed45
mov dword [rbp - 0x10], 0x50595275
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x5856567b
mov r8d, ebx
mov dword [rbp - 8], 0x3d4e5e5d
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18004ed8f
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004ede5
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004edfb
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004ee0d
xor r8d, r8d
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8940], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x18004ee20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x14], 0x54514171
mov r8d, ebx
mov dword [rbp - 0x10], 0x4b685242
mov dword [rbp - 0xc], 0x5f5d5d5f
lea r9, [rbp - 0x14]
mov byte [rbp - 8], 0x3e
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18004ee55
mov dword [rbp - 0x20], 0x50595275
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5856567b
mov r8d, ebx
mov dword [rbp - 0x18], 0x3d4e5e5d
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18004ee9f
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004eef5
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004ef0b
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004ef20
mov r8d, 2
lea rdx, [rbp - 0x14]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x58]
mov qword [0x1800c9038], rax
add rsp, 0x40
pop rbp
ret

Function at 0x18004ef3c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x13], 0x717d6675
mov r8d, ebx
mov dword [rbp - 0xf], 0x5b775862
mov dword [rbp - 0xb], 0x495f5e50
lea r9, [rbp - 0x13]
mov byte [rbp - 7], 0x3e
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18004ef71
mov dword [rbp - 0x20], 0x50595275
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5056567b
mov r8d, ebx
mov dword [rbp - 0x18], 0x494f5e5c
mov byte [rbp - 0x14], 0x3e
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18004efbf
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004f015
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004f02b
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004f040
mov r8d, 1
lea rdx, [rbp - 0x13]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x58]
mov qword [0x1800c9058], rax
add rsp, 0x40
pop rbp
ret
Function at 0x18004fbdc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x56554166
mov r8d, ebx
mov dword [rbp - 0x1c], 0x55547653
mov byte [rbp - 0x18], 0x3a
lea r9, [rbp - 0x20]
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18004fc0a
mov dword [rbp - 0x17], 0x50595275
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x5a594562
mov r8d, ebx
mov word [rbp - 0xf], 0x3b5f
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x18004fc53
lea rdx, [rbp - 0x17]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004fca9
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004fcbf
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004fcd4
mov r8d, 3
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x58]
mov qword [0x1800c8e10], rax
add rsp, 0x40
pop rbp
ret

Function at 0x18004fcf0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x10], 0x435b556d
mov r8d, ebx
mov byte [rbp + 0x14], 0x36
lea r9, [rbp + 0x10]
mov r10d, 0x1f7047dd
mov r11b, 0x32
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x18004fd1a
mov dword [rbp - 0x10], 0x45554175
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x4a5b5e5e
mov r8d, ebx
mov byte [rbp - 8], 0x3a
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18004fd62
mov dword [rbp + 0x18], 0x635a5c71
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x4557
mov r8d, ebx
mov byte [rbp + 0x1e], 0x38
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18004fda9
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x18]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004fdfd
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004fe13
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004fe25
xor r8d, r8d
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c83e8], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x180054044
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x5c475c62
mov r8d, ebx
mov dword [rbp - 0xc], 0x57575e42
mov dword [rbp - 8], 0x5c6e5575
lea r9, [rbp - 0x10]
mov word [rbp - 4], 0x3f47
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18005407a
mov dword [rbp + 0x18], 0x7c405a7a
lea r9, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x39575158
mov r8d, ebx
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x1800540bf
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
movabs rsi, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x180054121
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180054132
lea rcx, [rax - 0x10000]
cmp rcx, rsi
jbe 0x180054132
mov rax, rbx
jmp 0x180054144
mov r8d, 1
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.18007344c
mov rcx, rax
call fcn.18002c688
mov qword [0x1800c8de0], rax
lea r9, [rbp - 0x10]
mov r8d, ebx
mov dword [rbp - 0x10], 0x51555c7e
mov dword [rbp - 0xc], 0x54574570
mov dword [rbp - 8], 0x5c484f7b
mov word [rbp - 4], 0x545d
mov byte [rbp - 2], 0x40
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x180054179
mov dword [rbp + 0x18], 0x7c405a7a
lea r9, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x39575158
mov r8d, ebx
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x1800541be
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180054216
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180054222
lea rcx, [rax - 0x10000]
cmp rcx, rsi
ja 0x180054237
mov r8d, 2
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov qword [0x1800c8de8], rax
add rsp, 0x30
pop rbp
ret
Function at 0x180055df4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x54435f53
mov r8d, ebx
mov dword [rbp - 0xc], 0x494b444f
mov dword [rbp - 8], 0x49525248
lea r9, [rbp - 0x10]
mov byte [rbp - 4], 0x3e
mov r10d, 0x1f7047dd
mov r11b, 0x32
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x180055e2c
mov dword [rbp + 0x10], 0x40445d7b
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x3742
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x180055e6f
mov dword [rbp + 0x18], 0x635a5c71
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x4557
mov r8d, ebx
mov byte [rbp + 0x1e], 0x38
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180055eb6
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x18]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180055f0a
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180055f20
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180055f32
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c83c0], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x180056718
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x74595a53
mov r8d, ebx
mov dword [rbp - 0x1c], 0x5c545058
mov word [rbp - 0x18], 0x3b49
lea r9, [rbp - 0x20]
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x180056748
mov dword [rbp - 0x16], 0x40445d7b
lea r9, [rbp - 0x16]
mov dword [rbp - 0x12], 0x4a5d7a42
mov r8d, ebx
mov dword [rbp - 0xe], 0x585b5a49
mov byte [rbp - 0xa], 0x3e
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x180056796
lea rdx, [rbp - 0x16]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x1800567ec
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180056802
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180056814
mov r8b, 1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8950], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x180056828
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x47464651
mov r8d, ebx
mov dword [rbp + 0x1c], 0x394c5953
lea r9, [rbp + 0x18]
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x180056852
mov dword [rbp - 0x10], 0x40445d7b
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x584c6442
mov r8d, ebx
mov word [rbp - 8], 0x5e4e
mov byte [rbp - 6], 0x3c
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18005689f
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x1800568f5
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18005690b
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18005691d
mov r8b, 1
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8840], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret