joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006f614
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, rcx
mov sil, dl
mov rcx, qword [0x1800c8470]
add rcx, rdi
call fcn.18002c688
mov rcx, qword [0x1800c8998]
add rcx, rax
call fcn.18002c688
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180070110
xor r8d, r8d
mov dword [rbp + 0x10], 0x545f5c57
lea r9, [rbp + 0x10]
mov byte [rbp + 0x14], 0x36
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x18006f66d
lea rcx, [rbp + 0x10]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18006f6a5
mov rbx, qword [rbp - 8]
lea rcx, [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
lea r9, [rbp + 0x10]
cmp rbx, 0xf
mov qword [rsp + 0x20], rax
cmova rcx, qword [rbp - 0x20]
xor r8d, r8d
call fcn.18002aaf4
cmp rax, 0xffffffffffffffff
je 0x18006f73e
mov rcx, qword [0x1800c8488]
add rcx, rdi
call fcn.18002c688
mov r9, rax
mov rax, qword [0x1800c8118]
cmp r9, rax
jbe 0x18006f707
mov rdx, qword [0x1800c8120]
add rdx, rax
cmp r9, rdx
jb 0x18006f71d
lea rcx, [r9 - 0x10000]
movabs rax, 0x7ffffffdfffe
cmp rcx, rax
ja 0x18006f73a
mov rcx, qword [0x1800c87b0]
lea rdx, [rbp + 0x10]
add rcx, r9
mov byte [rbp + 0x10], sil
mov r8d, 1
call fcn.1800c228c
mov rbx, qword [rbp - 8]
cmp rbx, 0xf
jbe 0x18006f772
mov rcx, qword [rbp - 0x20]
lea rdx, [rbx + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006f76d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006f787
call fcn.1800bf340
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
call fcn.180089708
int3
Function at 0x18006f8a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rdi, rcx
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [0x1800c8470]
movaps xmm6, xmm1
add rcx, rdi
call fcn.18002c688
mov rcx, qword [0x1800c8998]
add rcx, rax
call fcn.18002c688
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180070110
xor r8d, r8d
mov dword [rbp - 0x40], 0x1b435c50
lea r9, [rbp - 0x40]
mov dword [rbp - 0x3c], 0x49555855
mov dword [rbp - 0x38], 0x59524e55
mov byte [rbp - 0x34], 0x3e
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18006f907
lea rcx, [rbp - 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18006f93f
mov rbx, qword [rbp - 0x18]
lea rcx, [rbp - 0x30]
mov rdx, qword [rbp - 0x20]
lea r9, [rbp - 0x40]
cmp rbx, 0xf
mov qword [rsp + 0x20], rax
cmova rcx, qword [rbp - 0x30]
xor r8d, r8d
call fcn.18002aaf4
cmp rax, 0xffffffffffffffff
je 0x18006f9d9
mov rcx, qword [0x1800c8488]
add rcx, rdi
call fcn.18002c688
mov r8, rax
mov rax, qword [0x1800c8118]
cmp r8, rax
jbe 0x18006f9a1
mov rdx, qword [0x1800c8120]
add rdx, rax
cmp r8, rdx
jb 0x18006f9b7
lea rcx, [r8 - 0x10000]
movabs rax, 0x7ffffffdfffe
cmp rcx, rax
ja 0x18006f9d5
mov rcx, qword [0x1800c8800]
lea rdx, [rbp + 0x10]
add rcx, r8
movss dword [rbp + 0x10], xmm6
mov r8d, 4
call fcn.1800c228c
mov rbx, qword [rbp - 0x18]
cmp rbx, 0xf
jbe 0x18006fa0d
mov rcx, qword [rbp - 0x30]
lea rdx, [rbx + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006fa08
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006fa24
call fcn.1800bf340
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.180089708
int3
Function at 0x18006fd78
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rdi, rcx
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [0x1800c8470]
movaps xmm6, xmm1
add rcx, rdi
call fcn.18002c688
mov rcx, qword [0x1800c8998]
add rcx, rax
call fcn.18002c688
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180070110
xor r8d, r8d
mov dword [rbp - 0x40], 0x1b435c50
lea r9, [rbp - 0x40]
mov dword [rbp - 0x3c], 0x49555855
mov dword [rbp - 0x38], 0x59524e55
mov byte [rbp - 0x34], 0x3e
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18006fddf
lea rcx, [rbp - 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18006fe17
mov rbx, qword [rbp - 0x18]
lea rcx, [rbp - 0x30]
mov rdx, qword [rbp - 0x20]
lea r9, [rbp - 0x40]
cmp rbx, 0xf
mov qword [rsp + 0x20], rax
cmova rcx, qword [rbp - 0x30]
xor r8d, r8d
call fcn.18002aaf4
cmp rax, 0xffffffffffffffff
je 0x18006feb1
mov rcx, qword [0x1800c8488]
add rcx, rdi
call fcn.18002c688
mov r8, rax
mov rax, qword [0x1800c8118]
cmp r8, rax
jbe 0x18006fe79
mov rdx, qword [0x1800c8120]
add rdx, rax
cmp r8, rdx
jb 0x18006fe8f
lea rcx, [r8 - 0x10000]
movabs rax, 0x7ffffffdfffe
cmp rcx, rax
ja 0x18006fead
mov rcx, qword [0x1800c8798]
lea rdx, [rbp + 0x10]
add rcx, r8
movss dword [rbp + 0x10], xmm6
mov r8d, 4
call fcn.1800c228c
mov rbx, qword [rbp - 0x18]
cmp rbx, 0xf
jbe 0x18006fee5
mov rcx, qword [rbp - 0x30]
lea rdx, [rbx + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006fee0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006fefc
call fcn.1800bf340
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.180089708
int3
Function at 0x18006ff04
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rsi, rcx
mov r14b, dl
mov rcx, qword [0x1800c8470]
add rcx, rsi
call fcn.18002c688
mov rcx, qword [0x1800c8998]
add rcx, rax
call fcn.18002c688
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180070110
xor r8d, r8d
mov dword [rbp - 0x30], 0x1b435c50
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x49555855
mov dword [rbp - 0x28], 0x59524e55
mov byte [rbp - 0x24], 0x3e
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18006ff69
lea rcx, [rbp - 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18006ffa1
mov rdi, qword [rbp - 8]
lea rcx, [rbp - 0x20]
mov rbx, qword [rbp - 0x20]
lea r9, [rbp - 0x30]
mov rdx, qword [rbp - 0x10]
cmp rdi, 0xf
mov qword [rsp + 0x20], rax
cmova rcx, rbx
xor r8d, r8d
call fcn.18002aaf4
cmp rax, 0xffffffffffffffff
jne 0x1800700c1
mov dword [rbp + 0x20], 0x465b4151
lea r9, [rbp + 0x20]
mov word [rbp + 0x24], 0x3745
xor r8d, r8d
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x18006fff1
lea rcx, [rbp + 0x20]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180070029
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 0x20]
cmp rdi, 0xf
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
cmova rcx, rbx
xor r8d, r8d
call fcn.18002aaf4
cmp rax, 0xffffffffffffffff
jne 0x1800700c1
mov rcx, qword [0x1800c8488]
add rcx, rsi
call fcn.18002c688
mov r9, rax
mov rax, qword [0x1800c8118]
cmp r9, rax
jbe 0x180070086
mov rdx, qword [0x1800c8120]
add rdx, rax
cmp r9, rdx
jb 0x18007009c
lea rcx, [r9 - 0x10000]
movabs rax, 0x7ffffffdfffe
cmp rcx, rax
ja 0x1800700b9
mov rcx, qword [0x1800c86c0]
lea rdx, [rbp + 0x20]
add rcx, r9
mov byte [rbp + 0x20], r14b
mov r8d, 1
call fcn.1800c228c
mov rbx, qword [rbp - 0x20]
mov rdi, qword [rbp - 8]
cmp rdi, 0xf
jbe 0x1800700f4
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800700ec
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180070109
mov rcx, rbx
call fcn.1800bf340
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.180089708
int3
Function at 0x18007b934
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rdi, qword [0x1800cdb78]
xor edx, edx
mov r12d, ecx
mov r14d, edx
mov r13d, edx
mov r15, qword [rdi + 0x3eb0]
test cl, 0x10
jne 0x18007bac0
mov esi, dword [rdi + 0x474c]
test esi, esi
je 0x18007b9be
cmp dword [rdi + 0x3f10], esi
jne 0x18007bab9
mov r14d, dword [rdi + 0x3f3c]
cmp r14d, 0xffffffff
cmove r14d, edx
movsxd rax, r14d
cmp byte [rax + rdi + 0xe04], dl
je 0x18007bab9
cmp byte [r15 + 0xb3], dl
jne 0x18007bab9
mov bl, dl
jmp 0x18007ba5a
cmp byte [rdi + 0xe04], dl
je 0x18007bab9
cmp byte [r15 + 0xb3], dl
jne 0x18007bab9
test byte [rdi + 0x4754], 1
jne 0x18007b9f9
cmp dword [rdi + 0x3f10], edx
je 0x18007bab9
cmp qword [rdi + 0x3f30], r15
jne 0x18007bab9
test r12b, 8
je 0x18007bab9
lea rbx, [rdi + 0x4758]
mov rcx, r15
mov rdx, rbx
call fcn.18007f92c
mov ecx, eax
mov dword [rdi + 0x474c], eax
mov esi, eax
call fcn.180081954
mov edx, esi
mov rcx, rbx
call fcn.180081620
xor edx, edx
mov bl, al
test al, al
je 0x18007ba52
cmp byte [rdi + 0x3738], dl
je 0x18007ba52
mov rdx, r15
mov ecx, esi
call fcn.180088f0c
mov rcx, r15
call fcn.18007f21c
xor edx, edx
cmp dword [rdi + 0x3f10], esi
jne 0x18007bab9
mov byte [rdi + 0x3f1d], bl
mov rax, qword [r15 + 0xf0]
movsxd rcx, dword [r15 + 0xe8]
mov r15, qword [0x1800cdb78]
mov r13d, dword [rax + rcx*4 - 4]
movsxd rax, r14d
cmp byte [rax + r15 + 0xe04], dl
jne 0x18007ba8b
mov bl, dl
jmp 0x18007ba9d
movss xmm1, dword [0x180006034]
mov ecx, r14d
call fcn.1800811ec
mov bl, al
mov dword [r15 + 0x4720], 0xf
mov byte [r15 + 0x4724], 1
call fcn.180082904
test bl, bl
jne 0x18007bb22
xor al, al
jmp 0x18007bbc3
mov dword [rbp - 0x10], 0x405b6011
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x7c5d5444
mov r8d, edx
mov dword [rbp - 8], 0x4f594f42
mov word [rbp - 4], 0x3f50
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18007bae2
xor r8d, r8d
lea rcx, [rbp - 0x10]
xor edx, edx
call fcn.180080708
mov esi, eax
cmp byte [rdi + 0x4a3c], 0
jne 0x18007bb61
call fcn.18007d260
mov dword [rdi + 0x4a5c], esi
mov dword [rdi + 0x4a60], r13d
mov byte [rdi + 0x4a3c], 1
mov dword [rdi + 0x4a40], r12d
mov dword [rdi + 0x4a48], r14d
cmp esi, dword [rdi + 0x3f10]
jne 0x18007bb61
mov byte [rdi + 0x3f1e], 1
mov eax, dword [rdi + 0x3e30]
mov dword [rdi + 0x4a44], eax
mov byte [rdi + 0x4a3d], 1
test r12b, 1
jne 0x18007bbb4
xor edx, edx
xor ecx, ecx
call fcn.18007bed0
cmp dword [rdi + 0x4ab0], 0
je 0x18007bbb4
test dword [rdi + 0x4aa4], 0x1000
je 0x18007bbb4
mov rcx, qword [rdi + 0x3eb0]
mov byte [rcx + 0xb3], 1
mov byte [rcx + 0xb5], 1
mov byte [rcx + 0xd0], 1
test r12b, 0x12
jne 0x18007bbc1
and dword [rdi + 0x4754], 0xfffffffe
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x18007bda0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [0x1800cdb78]
mov ebx, edx
mov eax, dword [r8 + 0x4868]
cmp dword [r8 + 0x4858], eax
jg 0x18007bd6b
and dword [r8 + 0x4788], 0
xor al, al
add rsp, 0x20
pop rbx
ret
mov r8, qword [r8 + 0x3eb0]
xor edx, edx
movsxd rax, dword [r8 + 0xe8]
mov r8, qword [r8 + 0xf0]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.180080708
or ebx, 0x141
mov ecx, eax
mov edx, ebx
add rsp, 0x20
pop rbx
jmp 0x18007bda0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, qword [0x1800cdb78]
mov ebx, edx
xor edx, edx
mov esi, ecx
call fcn.180081368
test al, al
jne 0x18007bdd9
and dword [rdi + 0x4788], 0
jmp 0x18007beb9
xor r8d, r8d
bt ebx, 0x1c
jae 0x18007be38
mov dword [rbp - 0x30], 0x50791011
lea r10, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x1c674258
mov dword [rbp - 0x28], 0x3d58090a
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r10], al
inc r10
cmp r8d, 0xc
jl 0x18007bdfb
mov r9d, dword [rdi + 0x4878]
lea r8, [rbp - 0x30]
jmp 0x18007be8c
mov dword [rbp - 0x30], 0x5a641011
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x66484246
mov dword [rbp - 0x28], 0x45040b1f
mov byte [rbp - 0x24], 0x3e
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18007be55
mov r9d, esi
lea r8, [rbp - 0x30]
mov edx, 0x14
lea rcx, [rbp - 0x20]
call fcn.18008054c
bts ebx, 0x1a
lea rcx, [rbp - 0x20]
mov r8d, ebx
xor edx, edx
call fcn.180079958
mov bl, al
test al, al
jne 0x18007beb7
call fcn.18007e550
mov al, bl
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x18007bed0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1800cdb78]
xor edi, edi
mov esi, edx
mov r14d, ecx
lea r15d, [rdi + 1]
cmp byte [rbx + 0x4a3d], dil
jne 0x18007bf0f
cmp byte [rbx + 0x4a3e], dil
je 0x18007bf88
movss xmm1, dword [rbx + 0x3898]
mov r14d, r15d
movaps xmm0, xmm1
mulss xmm1, dword [0x180005f80]
mulss xmm0, dword [0x180008a64]
addss xmm1, dword [rbx + 0xe00]
addss xmm0, dword [rbx + 0xdfc]
or dword [rbx + 0x4788], r15d
mov qword [rbx + 0x47a0], rdi
movss dword [rbx + 0x479c], xmm1
mov dword [rbx + 0x478c], r15d
movss dword [rbx + 0x4798], xmm0
movss xmm0, dword [rbx + 0x3904]
mov rax, qword [0x1800cdb78]
mulss xmm0, dword [0x180008a38]
or dword [rax + 0x4788], 0x40
movss dword [rax + 0x47e8], xmm0
movsx r9d, word [rbx + 0x5b3a]
lea r10, [rbp - 0x20]
mov dword [rbp - 0x20], 0x5a601011
mov r8d, edi
mov dword [rbp - 0x1c], 0x504c5b59
mov dword [rbp - 0x18], 0xd19644a
mov word [rbp - 0x14], 0x5b0c
mov byte [rbp - 0x12], 0x40
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
add r8d, r15d
sub al, cl
add al, 0x32
xor byte [r10], al
add r10, r15
cmp r8d, 0xf
jl 0x18007bfb6
lea r8, [rbp - 0x20]
mov edx, 0x10
lea rcx, [rbp - 0x10]
call fcn.18008054c
test r15b, r14b
je 0x18007c0ba
xor r8d, r8d
lea rcx, [rbp - 0x10]
xor edx, edx
call fcn.180080708
mov rcx, qword [0x1800cdb78]
mov edx, eax
add rcx, 0x3e90
call fcn.180080288
test rax, rax
je 0x18007c0ba
cmp byte [rax + 0xae], dil
je 0x18007c0ba
mov byte [rax + 0xb5], r15b
lea r8, [rbp - 0x20]
mov byte [rax + 0xd0], r15b
add word [rbx + 0x5b3a], r15w
movsx r9d, word [rbx + 0x5b3a]
mov dword [rbp - 0x20], 0x5a601011
mov dword [rbp - 0x1c], 0x504c5b59
mov dword [rbp - 0x18], 0xd19644a
mov word [rbp - 0x14], 0x5b0c
mov byte [rbp - 0x12], 0x40
mov eax, 0x1f7047dd
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, dil
add edi, r15d
sub al, cl
add al, 0x32
xor byte [r8], al
add r8, r15
cmp edi, 0xf
jl 0x18007c07b
lea r8, [rbp - 0x20]
mov edx, 0x10
lea rcx, [rbp - 0x10]
call fcn.18008054c
or esi, 0x20c0347
lea rcx, [rbp - 0x10]
mov r8d, esi
xor edx, edx
call fcn.180079958
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x18007f538
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov r10, rcx
mov dword [rbp - 0x10], 0x54761011
mov dword [rbp - 0xc], 0x4b5f5c55
lea r9, [rbp - 0x10]
mov dword [rbp - 8], 0x59524e55
xor r8d, r8d
mov byte [rbp - 4], 0x3e
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18007f564
lea r8, [rbp - 0x10]
xor edx, edx
mov rcx, r10
call fcn.180080150
add rsp, 0x30
pop rbp
ret
Function at 0x18007f5a8
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [0x1800cdb78]
mov rcx, qword [rax + 0x4888]
mov rcx, qword [rcx]
jmp fcn.18007f538

Function at 0x18007f778
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
test dword [rcx + 0xc], 0x4000000
mov r8, rcx
je 0x18007f7a0
mov rax, qword [0x1800cdb78]
mov rcx, qword [rax + 0x5c08]
jmp 0x18007f83e
test dword [rcx + 0xc], 0x400
je 0x18007f830
mov dword [rbp - 0x10], 0x54791011
lea r10, [rbp - 0x10]
mov dword [rbp - 0xc], 0x5c75595f
xor r9d, r9d
mov dword [rbp - 8], 0x5c7e4e54
mov word [rbp - 4], 0x3f4c
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x32
xor byte [r10], al
inc r10
cmp r9d, 0xe
jl 0x18007f7cf
mov rax, qword [r8]
lea r8, [rbp - 0x10]
sub r8, rax
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x18007f81c
inc rax
test edx, edx
jne 0x18007f809
test ecx, ecx
jne 0x18007f830
mov rax, qword [0x1800cdb78]
mov rcx, qword [rax + 0x5c00]
jmp 0x18007f83e
mov rax, qword [0x1800cdb78]
mov rcx, qword [rax + 0x5c10]
test rcx, rcx
lea rax, [0x180005e40]
cmovne rax, rcx
add rsp, 0x10
pop rbp
ret

Function at 0x18007f854
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov r10, rcx
mov dword [rbp - 0x10], 0x5a721011
mov dword [rbp - 0xc], 0x4b5f5244
lea r9, [rbp - 0x10]
mov dword [rbp - 8], 0x59524e55
xor r8d, r8d
mov byte [rbp - 4], 0x3e
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18007f880
lea r8, [rbp - 0x10]
mov edx, 1
mov rcx, r10
call fcn.180080150
add rsp, 0x30
pop rbp
ret

Function at 0x18007f8c8
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [0x1800cdb78]
mov rcx, qword [rax + 0x4888]
mov rcx, qword [rcx]
jmp fcn.18007f854

Function at 0x18007f8fc
Capabilities:
Hash data with crc32

Disassembly:
movsxd r9, dword [rcx + 0xe8]
mov r10, r8
mov r8, qword [rcx + 0xf0]
mov r11, rdx
mov rax, r10
mov rcx, r11
sub rax, rdx
neg r10
mov r8d, dword [r8 + r9*4 - 4]
sbb rdx, rdx
and rdx, rax
jmp fcn.180080708

Function at 0x1800806d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x1800806fe
movzx eax, byte [r9]
inc r9
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x1800083a0]
xor r8d, dword [rax + rcx*4]
sub rdx, 1
jne 0x1800806db
not r8d
mov eax, r8d
ret
Function at 0x180080708
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x180080762
mov r11b, 0x23
lea rbx, [0x1800083a0]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x18008074c
cmp rdx, 2
jb 0x18008074c
cmp byte [r10], r11b
jne 0x18008074c
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x18008072a
jmp 0x1800807a3
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x1800807a3
mov r11b, 0x23
lea rbx, [0x1800083a0]
cmp dl, r11b
jne 0x180080787
cmp byte [r10], r11b
jne 0x180080787
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x180080775
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x18008197c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x20
and qword [rax + 0x18], 0
lea r9, [rax + 0x10]
xor r8d, r8d
mov word [rax + 0x10], 0x5140
mov r10, rcx
mov byte [rax + 0x12], 0x34
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 3
jl 0x18008199d
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
mov rcx, r10
call fcn.180080464
mov rbx, rax
test rax, rax
je 0x180081a1e
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x1800819fc
mov rcx, rax
call fcn.180081a24
mov rcx, qword [0x1800cdb78]
test rcx, rcx
je 0x180081a0e
dec dword [rcx + 0xf4]
mov rdx, qword [0x1800cdba0]
mov rcx, rbx
call qword [0x1800c7ad8]
add rsp, 0x20
pop rbx
ret

Function at 0x180081c6c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x1800cdb78]
cmp byte [rbx + 0x5c18], 0
je 0x180081d6c
mov word [rsp + 0x30], 0x393f
lea r9, [rsp + 0x30]
mov byte [rsp + 0x32], 0x34
xor r8d, r8d
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 3
jl 0x180081c9a
lea rcx, [rsp + 0x30]
call fcn.180081ff0
mov eax, dword [rbx + 0x5c1c]
cmp eax, 2
je 0x180081d09
cmp eax, 4
jne 0x180081d15
cmp dword [rbx + 0x5c28], 1
jle 0x180081d15
mov rax, qword [rbx + 0x5c30]
lea rcx, [0x1800cdb98]
test rax, rax
cmovne rcx, rax
call fcn.180088fdc
jmp 0x180081d15
mov rcx, qword [rbx + 0x5c20]
call fcn.1800c1068
and dword [rbx + 0x5c1c], 0
and qword [rbx + 0x5c20], 0
mov byte [rbx + 0x5c18], 0
mov rcx, qword [rbx + 0x5c30]
test rcx, rcx
je 0x180081d6c
and dword [rbx + 0x5c2c], 0
and dword [rbx + 0x5c28], 0
mov rax, qword [0x1800cdb78]
test rax, rax
je 0x180081d57
dec dword [rax + 0xf4]
mov rdx, qword [0x1800cdba0]
call qword [0x1800c7ad8]
and qword [rbx + 0x5c30], 0
add rsp, 0x20
pop rbx
ret