joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006c9a4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x13], 0x707a6776
mov r8d, ebx
mov dword [rbp - 0xf], 0x5a785961
mov dword [rbp - 0xb], 0x48585f53
lea r9, [rbp - 0x13]
mov byte [rbp - 7], 0x3d
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18006c9d9
mov dword [rbp - 0x20], 0x515e5376
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x51595778
mov r8d, ebx
mov dword [rbp - 0x18], 0x48485f5f
mov byte [rbp - 0x14], 0x3d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18006ca1e
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006ca6b
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006ca81
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006ca96
mov r8d, 1
lea rdx, [rbp - 0x13]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x58]
mov qword [0x1800e7048], rax
add rsp, 0x40
pop rbp
ret
Function at 0x18006d544
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x57524065
mov r8d, ebx
mov dword [rbp - 0x1c], 0x545b7750
mov byte [rbp - 0x18], 0x39
lea r9, [rbp - 0x20]
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18006d572
mov dword [rbp - 0x17], 0x515e5376
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x5b564461
mov r8d, ebx
mov word [rbp - 0xf], 0x3a5c
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x18006d5b2
lea rdx, [rbp - 0x17]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006d5ff
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006d615
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006d62a
mov r8d, 3
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x58]
mov qword [0x1800e6e00], rax
add rsp, 0x40
pop rbp
ret

Function at 0x18006d644
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x10], 0x425c546e
mov r8d, ebx
mov byte [rbp + 0x14], 0x35
lea r9, [rbp + 0x10]
mov r10d, 0x5397829d
mov r11b, 0x31
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x18006d66e
mov dword [rbp - 0x10], 0x44524076
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x4b545f5d
mov r8d, ebx
mov byte [rbp - 8], 0x39
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18006d6ad
mov dword [rbp + 0x18], 0x625d5d72
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x4454
mov r8d, ebx
mov byte [rbp + 0x1e], 0x37
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18006d6eb
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x18]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006d736
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006d74c
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006d75e
xor r8d, r8d
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e63d8], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x1800714c4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r15
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x5d405d61
mov r8d, ebx
mov dword [rbp - 0xc], 0x56585f41
mov dword [rbp - 8], 0x5d695476
lea r9, [rbp - 0x10]
mov word [rbp - 4], 0x3e44
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x1800714fa
mov dword [rbp + 0x18], 0x7d475b79
lea r9, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x3858505b
mov r8d, ebx
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x180071536
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
movabs r15, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18007158f
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x1800715a0
lea rcx, [rax - 0x10000]
cmp rcx, r15
jbe 0x1800715a0
mov rax, rbx
jmp 0x1800715b2
mov r8d, 1
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.18008fa44
mov rcx, rax
call fcn.18002b270
mov qword [0x1800e6dd0], rax
lea r9, [rbp - 0x10]
mov r8d, ebx
mov dword [rbp - 0x10], 0x50525d7d
mov dword [rbp - 0xc], 0x55584473
mov dword [rbp - 8], 0x5d4f4e78
mov word [rbp - 4], 0x555e
mov byte [rbp - 2], 0x3f
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x1800715e7
mov dword [rbp + 0x18], 0x7d475b79
lea r9, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x3858505b
mov r8d, ebx
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x180071623
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180071672
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007167e
lea rcx, [rax - 0x10000]
cmp rcx, r15
ja 0x180071693
mov r8d, 2
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
mov qword [0x1800e6dd8], rax
add rsp, 0x30
pop rbp
ret
Function at 0x180072fec
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x55445e50
mov r8d, ebx
mov dword [rbp - 0xc], 0x4844454c
mov dword [rbp - 8], 0x4855534b
lea r9, [rbp - 0x10]
mov byte [rbp - 4], 0x3d
mov r10d, 0x5397829d
mov r11b, 0x31
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x180073024
mov dword [rbp + 0x10], 0x41435c78
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x3641
mov r8d, ebx
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x18007305e
mov dword [rbp + 0x18], 0x625d5d72
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x4454
mov r8d, ebx
mov byte [rbp + 0x1e], 0x37
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18007309c
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x18]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x1800730e7
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x1800730fd
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007310f
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e63b0], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x180073850
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x755e5b50
mov r8d, ebx
mov dword [rbp - 0x1c], 0x5d5b515b
mov word [rbp - 0x18], 0x3a4a
lea r9, [rbp - 0x20]
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x180073880
mov dword [rbp - 0x16], 0x41435c78
lea r9, [rbp - 0x16]
mov dword [rbp - 0x12], 0x4b527b41
mov r8d, ebx
mov dword [rbp - 0xe], 0x595c5b4a
mov byte [rbp - 0xa], 0x3d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x1800738c5
lea rdx, [rbp - 0x16]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180073912
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180073928
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007393a
mov r8b, 1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6940], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x18007394c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x46414752
mov r8d, ebx
mov dword [rbp + 0x1c], 0x38435850
lea r9, [rbp + 0x18]
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x180073976
mov dword [rbp - 0x10], 0x41435c78
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x59436541
mov r8d, ebx
mov word [rbp - 8], 0x5f4d
mov byte [rbp - 6], 0x3b
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x1800739ba
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180073a07
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180073a1d
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180073a2f
mov r8b, 1
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6830], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x180073e34
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0xc], 0x5658555c
mov dword [rbp - 8], 0x55494a6a
lea r9, [rbp - 0x10]
mov word [rbp - 4], 0x5b49
mov r10d, 0x5397829d
mov byte [rbp - 2], 0x3f
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x180073e6f
mov dword [rbp + 0x18], 0x59564678
lea r9, [rbp + 0x18]
mov byte [rbp + 0x1c], 0x35
mov r8d, ebx
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x180073ea6
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180073ef3
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180073f09
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180073f1c
or r8d, 0xffffffff
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x50]
mov qword [0x1800e6dc0], rax
add rsp, 0x30
pop rbp
ret

Function at 0x180073f38
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x59564658
mov r8d, ebx
mov dword [rbp - 0x1c], 0x4c445f79
mov byte [rbp - 0x18], 0x39
lea r9, [rbp - 0x20]
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x180073f66
mov dword [rbp - 0x17], 0x59564678
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x4c595976
mov r8d, ebx
mov dword [rbp - 0xf], 0x59555358
mov word [rbp - 0xb], 0x3e4f
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x180073fad
lea rdx, [rbp - 0x17]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180073ffa
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180074010
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180074022
mov r8b, 1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6960], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x1800744a8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x180006ce0]
lea r9, [rbp - 0x17]
xor ebx, ebx
mov byte [rbp - 7], 0x41
movdqu xmmword [rbp - 0x17], xmm0
mov r8d, ebx
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x11
jl 0x1800744d5
mov dword [rbp - 0x20], 0x59564678
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5658557c
mov r8d, ebx
mov byte [rbp - 0x18], 0x39
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x180074513
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180074560
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180074576
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180074588
mov r8b, 1
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e65a0], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x18007459c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x17], 0x605d4763
mov r8d, ebx
mov dword [rbp - 0x13], 0x5c525b5c
mov dword [rbp - 0xf], 0x554f5978
lea r9, [rbp - 0x17]
mov word [rbp - 0xb], 0x5052
mov r10d, 0x5397829d
mov byte [rbp - 9], 0x3f
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x1800745d7
mov dword [rbp - 0x20], 0x59564678
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5658557c
mov r8d, ebx
mov byte [rbp - 0x18], 0x39
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x180074615
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180074662
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180074678
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007468b
or r8d, 0xffffffff
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x58]
mov qword [0x1800e6df8], rax
add rsp, 0x40
pop rbp
ret
Function at 0x180074a1c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0x1c], 0x51435870
mov word [rbp - 0x18], 0x434d
lea r9, [rbp - 0x20]
mov byte [rbp - 0x16], 0x3b
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180074a50
mov dword [rbp - 0x15], 0x55505d7d
lea r9, [rbp - 0x15]
mov dword [rbp - 0x11], 0x595b6659
mov r8d, ebx
mov dword [rbp - 0xd], 0x3c495f40
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180074a91
lea rdx, [rbp - 0x15]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180074ade
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180074af4
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180074b07
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x58]
mov qword [0x1800e7030], rax
add rsp, 0x40
pop rbp
ret

Function at 0x180074b24
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x555f426e
mov r8d, ebx
mov dword [rbp - 0x1c], 0x7645534c
mov dword [rbp - 0x18], 0x3c5e5758
lea r9, [rbp - 0x20]
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180074b55
mov dword [rbp - 0x14], 0x405c5d7d
lea r9, [rbp - 0x14]
mov dword [rbp - 0x10], 0x5d5b5454
mov r8d, ebx
mov dword [rbp - 0xc], 0x4c49557a
mov word [rbp - 8], 0x5b4e
mov byte [rbp - 6], 0x3f
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x180074ba0
lea rdx, [rbp - 0x14]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180074bed
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180074c03
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180074c15
mov r8b, 1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6968], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x180074c28
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x15], 0x5a5a535c
mov r8d, ebx
mov dword [rbp - 0x11], 0x5d5a5776
mov word [rbp - 0xd], 0x5b4b
lea r9, [rbp - 0x15]
mov byte [rbp - 0xb], 0x3b
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180074c5c
mov dword [rbp - 0x20], 0x5a5a537c
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5d5a5776
mov r8d, ebx
mov word [rbp - 0x18], 0x5b4b
mov byte [rbp - 0x16], 0x3b
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180074ca0
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180074ced
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180074d03
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180074d15
xor r8d, r8d
lea rdx, [rbp - 0x15]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6838], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x1800751ac
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x447c4178
mov r8d, ebx
mov word [rbp + 0x1c], 0x5850
mov byte [rbp + 0x1e], 0x37
lea r9, [rbp + 0x18]
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x1800751d9
mov dword [rbp - 0x10], 0x7d43537c
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x4a52425b
mov r8d, ebx
mov dword [rbp - 8], 0x59585b5f
mov byte [rbp - 4], 0x3d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18007521e
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007526b
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180075281
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180075293
xor r8d, r8d
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6948], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x180075a88
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0x2c], 0x41565a45
mov dword [rbp - 0x28], 0x5d75485c
lea r9, [rbp - 0x30]
mov word [rbp - 0x24], 0x5b50
mov r10d, 0x5397829d
mov byte [rbp - 0x22], 0x3f
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18006c15f
movdqa xmm0, xmmword [0x1800064f0]
lea r9, [rbp - 0x21]
movdqu xmmword [rbp - 0x21], xmm0
mov dword [rbp - 0x11], 0x36262c28
mov r8d, ebx
mov byte [rbp - 0xd], 0x45
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x15
jl 0x18006c1a3
lea rdx, [rbp - 0x21]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006c1f0
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006c206
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006c219
or r8d, 0xffffffff
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x68]
mov qword [0x1800e70c0], rax
add rsp, 0x50
pop rbp
ret
sub rsp, 0x28
call fcn.18007f208
call fcn.18007ccc8
call fcn.18007efb4
call fcn.180073e34
call fcn.18007dfa4
call fcn.1800714c4
call fcn.1800724f0
call fcn.18007459c
call fcn.18006d544
call fcn.18007b170
call fcn.18007f018
call fcn.1800658ec
call fcn.1800677a0
call fcn.180075d28
call fcn.180077084
call fcn.18007004c
call fcn.180078078
call fcn.18006d1bc
call fcn.18006c89c
call fcn.180074a1c
call fcn.18006605c
call fcn.18006c9a4
call fcn.18007ca6c
call fcn.180068f40
call fcn.180068bd8
call fcn.18007c960
call fcn.180066350
call fcn.18007e450
call fcn.180064c60
call fcn.180065554
call fcn.18007c718
call fcn.180079bac
add rsp, 0x28
jmp 0x18006c124