joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005bc34
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp + 0x10], 0x5759565f
mov r8d, ebx
mov dword [rbp + 0x14], 0x394b4553
lea r9, [rbp + 0x10]
mov r10d, 0x1f7047dd
mov r11b, 0x32
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x18005bc61
mov dword [rbp - 0x17], 0x4c555f62
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x5c6c4553
mov r8d, ebx
mov word [rbp - 0xf], 0x565b
mov byte [rbp - 0xd], 0x3c
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18005bcaf
mov dword [rbp - 0x20], 0x415b4162
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5f4d7559
mov r8d, ebx
mov byte [rbp - 0x18], 0x3a
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18005bcf7
lea rdx, [rbp - 0x17]
lea rcx, [rbp - 0x20]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18005bd4b
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18005bd61
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18005bd73
mov r8b, 1
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8428], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x18005bd88
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x5c475c42
mov r8d, ebx
mov dword [rbp - 0x1c], 0x57575e42
mov byte [rbp - 0x18], 0x3a
lea r9, [rbp - 0x20]
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18005bdb6
mov dword [rbp - 0x17], 0x4c555f62
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x506c4553
mov r8d, ebx
mov word [rbp - 0xf], 0x5059
mov byte [rbp - 0xd], 0x3c
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18005be03
lea rdx, [rbp - 0x17]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18005be59
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18005be6f
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18005be81
mov r8b, 1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8808], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x18005d280
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x50585666
mov r8d, ebx
mov dword [rbp - 0x1c], 0x4d4a5846
mov word [rbp - 0x18], 0x546e
lea r9, [rbp - 0x20]
mov byte [rbp - 0x16], 0x3c
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18005d2b4
movdqa xmm0, xmmword [0x180006910]
lea r9, [rbp - 0x15]
movdqu xmmword [rbp - 0x15], xmm0
mov word [rbp - 5], 0x372c
mov r8d, ebx
mov byte [rbp - 3], 0x44
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x13
jl 0x18005d300
lea rdx, [rbp - 0x15]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18005d356
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18005d36c
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18005d381
mov r8d, 2
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x58]
mov qword [0x1800c90c8], rax
add rsp, 0x40
pop rbp
ret
Function at 0x18005eff0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x27], 0x5f5b4142
mov r8d, ebx
mov dword [rbp - 0x23], 0x504c5453
mov dword [rbp - 0x1f], 0x3d4f5e56
lea r9, [rbp - 0x27]
mov r10d, 0x1f7047dd
mov r11b, 0x32
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18005f024
movdqa xmm0, xmmword [0x180007fe0]
lea r9, [rbp - 0x1b]
movdqu xmmword [rbp - 0x1b], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18005f067
mov dword [rbp - 0x30], 0x415b4162
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x5f4d7559
mov r8d, ebx
mov byte [rbp - 0x28], 0x3a
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18005f0af
lea rdx, [rbp - 0x1b]
lea rcx, [rbp - 0x30]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18005f103
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18005f119
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18005f12b
mov r8b, 1
lea rdx, [rbp - 0x27]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8448], rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x18006003c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x10], 0x515a5a74
mov r8d, ebx
mov byte [rbp + 0x14], 0x36
lea r9, [rbp + 0x10]
mov r10d, 0x1f7047dd
mov r11b, 0x32
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x180060066
mov dword [rbp + 0x18], 0x51555b61
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x4553
mov r8d, ebx
mov byte [rbp + 0x1e], 0x38
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x1800600ad
mov dword [rbp - 0x10], 0x415d5d67
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x5e56724f
mov r8d, ebx
mov dword [rbp - 8], 0x3d595553
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x1800600f8
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18006014c
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180060162
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180060177
mov r8d, 1
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x50]
mov qword [0x1800c8c28], rax
add rsp, 0x30
pop rbp
ret

Function at 0x180060194
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x6a405655
mov r8d, ebx
mov dword [rbp - 0x1c], 0x5d565264
mov dword [rbp - 0x18], 0x4f59495f
lea r9, [rbp - 0x20]
mov word [rbp - 0x14], 0x3f4d
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x1800601cb
movdqa xmm0, xmmword [0x180006dd0]
lea r9, [rbp - 0x12]
movdqu xmmword [rbp - 0x12], xmm0
mov byte [rbp - 2], 0x42
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x11
jl 0x180060211
lea rdx, [rbp - 0x12]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180060267
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18006027d
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180060290
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x58]
mov qword [0x1800c90c0], rax
add rsp, 0x40
pop rbp
ret
Function at 0x1800602ac
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x14], 0x6a405655
mov r8d, ebx
mov dword [rbp - 0x10], 0x4d405242
mov dword [rbp - 0xc], 0x3d59494f
lea r9, [rbp - 0x14]
mov r10d, 0x1f7047dd
mov r11b, 0x32
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x1800602e0
mov dword [rbp + 0x10], 0x5c464361
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x5242
mov r8d, ebx
mov byte [rbp + 0x16], 0x38
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180060327
mov dword [rbp - 0x20], 0x415d5d67
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5e56724f
mov r8d, ebx
mov dword [rbp - 0x18], 0x3d595553
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180060372
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x20]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x1800603c6
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x1800603dc
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800603ef
or r8d, 0xffffffff
lea rdx, [rbp - 0x14]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x58]
mov qword [0x1800c8bd8], rax
add rsp, 0x40
pop rbp
ret

Function at 0x18006040c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x5c7c407b
mov r8d, ebx
mov dword [rbp - 0x1c], 0x575d5352
mov byte [rbp - 0x18], 0x3a
lea r9, [rbp - 0x20]
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18006043a
mov dword [rbp - 0x17], 0x46554761
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x5757745e
mov r8d, ebx
mov dword [rbp - 0xf], 0x53555a4e
mov word [rbp - 0xb], 0x4d5b
mov byte [rbp - 9], 0x40
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18006048e
lea rdx, [rbp - 0x17]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x1800604e4
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x1800604fa
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006050d
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x58]
mov qword [0x1800c9090], rax
add rsp, 0x40
pop rbp
ret
Function at 0x1800607bc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x415a5c71
mov r8d, ebx
mov dword [rbp - 0xc], 0x4a565e57
mov byte [rbp - 8], 0x3a
lea r9, [rbp - 0x10]
mov r10d, 0x1f7047dd
mov r11b, 0x32
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x1800607ed
mov dword [rbp + 0x10], 0x5c464761
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x5058
mov r8d, ebx
mov byte [rbp + 0x16], 0x38
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180060834
mov dword [rbp + 0x18], 0x41474a61
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x5a53
mov r8d, ebx
mov byte [rbp + 0x1e], 0x38
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18006087b
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x18]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x1800608cf
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x1800608e5
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800608fa
mov r8d, 1
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x50]
mov qword [0x1800c8b58], rax
add rsp, 0x30
pop rbp
ret
Function at 0x1800612c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub rsp, 0x28
call fcn.180055df4
call fcn.1800463e8
call fcn.18004dae4
call fcn.18004e3ec
call fcn.18004fcf0
call fcn.18004e770
call fcn.1800469d8
call fcn.18004eaa8
call fcn.18005bc34
call fcn.18004615c
call fcn.18005b714
call fcn.18005eff0
call fcn.18005b86c
call fcn.180056930
call fcn.180058ca8
call fcn.1800618cc
call fcn.180062038
call fcn.180054258
call fcn.1800535bc
call fcn.18005746c
call fcn.180063850
call fcn.180063964
call fcn.18005d39c
call fcn.18004fe38
call fcn.18005bd88
call fcn.180047394
call fcn.180058db8
call fcn.18005a1b0
call fcn.180056828
call fcn.180057c80
call fcn.180048384
call fcn.18005ac84
call fcn.18005b060
call fcn.18004ed18
call fcn.180062c8c
call fcn.180056718
call fcn.18005824c
call fcn.180047c50
call fcn.180056e8c
call fcn.180057b68
call fcn.18004ac48
call fcn.180056f9c
call fcn.180048078
call fcn.18005af54
call fcn.18005f518
call fcn.18004b41c
call fcn.180046fc0
call fcn.1800614d4
call fcn.180061d4c
call fcn.18005768c
call fcn.1800616cc
call fcn.1800613d4
call fcn.18005be94
call fcn.18004e538
add rsp, 0x28
jmp 0x1800612c0
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x40405261
mov r8d, ebx
mov dword [rbp - 0x2c], 0x504c5644
mov word [rbp - 0x28], 0x5555
lea r9, [rbp - 0x30]
mov byte [rbp - 0x26], 0x3c
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x1800612f4
movdqa xmm0, xmmword [0x180006e50]
lea r9, [rbp - 0x25]
movdqu xmmword [rbp - 0x25], xmm0
mov dword [rbp - 0x15], 0x37213727
mov r8d, ebx
mov word [rbp - 0x11], 0x4735
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x16
jl 0x180061343
lea rdx, [rbp - 0x25]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180061399
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x1800613af
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800613c1
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8b18], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x1800613d4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp + 0x18], 0x47415c7a
mov r8d, ebx
mov byte [rbp + 0x1c], 0x36
lea r9, [rbp + 0x18]
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x1800613fb
movdqa xmm0, xmmword [0x180007770]
lea r9, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x45373127
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x180061444
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18006149a
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x1800614b0
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800614c2
mov r8b, 1
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8a60], rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x1800614d4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x180006870]
lea r9, [rbp - 0x1b]
xor ebx, ebx
mov word [rbp - 0xb], 0x4330
movdqu xmmword [rbp - 0x1b], xmm0
mov r8d, ebx
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x180061502
movdqa xmm0, xmmword [0x1800074c0]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x20], 0x4331
mov r8d, ebx
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x18006154c
lea rdx, [rbp - 0x30]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
movabs rdi, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x1800615ae
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x1800615bf
lea rcx, [rax - 0x10000]
cmp rcx, rdi
jbe 0x1800615bf
mov rax, rbx
jmp 0x1800615ce
mov r8b, 1
lea rdx, [rbp - 0x1b]
mov rcx, rax
call fcn.180073298
movdqa xmm0, xmmword [0x180007260]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov qword [0x1800c8a08], rax
mov r8d, ebx
mov dword [rbp - 0x20], 0x37212a2e
mov byte [rbp - 0x1c], 0x46
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x15
jl 0x1800615f4
movdqa xmm0, xmmword [0x1800074c0]
lea r9, [rbp - 0x1b]
movdqu xmmword [rbp - 0x1b], xmm0
mov word [rbp - 0xb], 0x4331
mov r8d, ebx
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x18006163e
lea rdx, [rbp - 0x1b]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180061696
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x1800616a2
lea rcx, [rax - 0x10000]
cmp rcx, rdi
ja 0x1800616b4
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov rdi, qword [rsp + 0x70]
mov qword [0x1800c8a10], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x1800616cc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x5d535a7e
mov r8d, ebx
mov dword [rbp - 0x2c], 0x4d567e42
mov dword [rbp - 0x28], 0x544f555f
lea r9, [rbp - 0x30]
mov word [rbp - 0x24], 0x464a
mov byte [rbp - 0x22], 0x40
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x180061706
movdqa xmm0, xmmword [0x180007760]
lea r9, [rbp - 0x1e]
movdqu xmmword [rbp - 0x1e], xmm0
mov dword [rbp - 0xe], 0x45373127
mov r8d, ebx
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x180061751
lea rdx, [rbp - 0x1e]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
movabs rdi, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x1800617b3
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x1800617c4
lea rcx, [rax - 0x10000]
cmp rcx, rdi
jbe 0x1800617c4
mov rax, rbx
jmp 0x1800617d3
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180073298
movdqa xmm0, xmmword [0x180006870]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov qword [0x1800c8a50], rax
mov r8d, ebx
mov word [rbp - 0x20], 0x4330
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x1800617f4
movdqa xmm0, xmmword [0x180007760]
lea r9, [rbp - 0x1e]
movdqu xmmword [rbp - 0x1e], xmm0
mov dword [rbp - 0xe], 0x45373127
mov r8d, ebx
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x18006183f
lea rdx, [rbp - 0x1e]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180061897
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x1800618a3
lea rcx, [rax - 0x10000]
cmp rcx, rdi
ja 0x1800618b5
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov rdi, qword [rsp + 0x70]
mov qword [0x1800c8a58], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180061c38
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x6a405655
mov r8d, ebx
mov dword [rbp - 0xc], 0x4d4b597f
mov dword [rbp - 8], 0x585f555b
lea r9, [rbp - 0x10]
mov byte [rbp - 4], 0x3e
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x180061c6d
mov dword [rbp + 0x18], 0x6a707c66
lea r9, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x39415c65
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x180061cb0
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180061d06
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180061d1c
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180061d2f
or r8d, 0xffffffff
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x50]
mov qword [0x1800c8dd8], rax
add rsp, 0x30
pop rbp
ret