joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180070ea4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x30], 0x585e5352
mov r8d, ebx
mov dword [rbp + 0x34], 0x38474450
lea r9, [rbp + 0x30]
mov esi, 0x2f684bdb
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x180070ed0
mov dword [rbp + 0x20], 0x515a5e72
lea r9, [rbp + 0x20]
mov word [rbp + 0x24], 0x425b
mov r8d, ebx
mov byte [rbp + 0x26], 0x37
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180070f15
mov dword [rbp + 0x28], 0x625d5d72
lea r9, [rbp + 0x28]
mov word [rbp + 0x2c], 0x4454
mov r8d, ebx
mov byte [rbp + 0x2e], 0x37
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180070f5a
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x28]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
movabs r15, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x180070fb6
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180070fc7
lea rcx, [rax - 0x10000]
cmp rcx, r15
jbe 0x180070fc7
mov rax, rbx
jmp 0x180070fd6
xor r8d, r8d
lea rdx, [rbp + 0x30]
mov rcx, rax
call fcn.180096f64
mov qword [0x1800ed3c0], rax
lea r9, [rbp - 0x10]
mov dword [rbp - 0x10], 0x5952516e
mov r8d, ebx
mov dword [rbp - 0xc], 0x5d524646
mov word [rbp - 8], 0x3a5d
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x180070ff8
mov dword [rbp + 0x20], 0x515a5e72
lea r9, [rbp + 0x20]
mov word [rbp + 0x24], 0x425b
mov r8d, ebx
mov byte [rbp + 0x26], 0x37
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18007103d
mov dword [rbp + 0x28], 0x625d5d72
lea r9, [rbp + 0x28]
mov word [rbp + 0x2c], 0x4454
mov r8d, ebx
mov byte [rbp + 0x2e], 0x37
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180071082
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x28]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x1800710d4
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x1800710e0
lea rcx, [rax - 0x10000]
cmp rcx, r15
ja 0x1800710f2
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed3c8], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop rsi
pop rbp
ret
Function at 0x180071108
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x1800067d0]
lea r9, [rbp - 0x1b]
xor ebx, ebx
mov dword [rbp - 0xb], 0x44272735
movdqu xmmword [rbp - 0x1b], xmm0
mov r8d, ebx
mov r10d, 0x2f684bdb
mov r11b, 0x31
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x18007113b
mov dword [rbp - 0x30], 0x585f5d72
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x4a52525c
mov r8d, ebx
mov byte [rbp - 0x28], 0x39
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x180071183
mov dword [rbp - 0x27], 0x405a5c64
lea r9, [rbp - 0x27]
mov dword [rbp - 0x23], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x1f], 0x3c5e5450
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x1800711ce
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x27]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180071222
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180071238
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007124b
or r8d, 0xffffffff
lea rdx, [rbp - 0x1b]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x60]
mov qword [0x1800edc98], rax
add rsp, 0x50
pop rbp
ret
Function at 0x1800717ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x180007610]
lea r9, [rbp - 0x20]
xor ebx, ebx
mov word [rbp - 0x10], 0x4235
movdqu xmmword [rbp - 0x20], xmm0
mov r8d, ebx
mov r10d, 0x2f684bdb
mov r11b, 0x31
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x1800717de
mov dword [rbp + 0x18], 0x585f4772
lea r9, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x3850585c
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x180071822
mov dword [rbp + 0x10], 0x625d5d72
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x4454
mov r8d, ebx
mov byte [rbp + 0x16], 0x37
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180071869
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x1800718bd
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x1800718d3
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800718e5
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed3d0], rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1800718f8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x4d525e41
mov r8d, ebx
mov dword [rbp - 0x2c], 0x4c644450
mov dword [rbp - 0x28], 0x75565b5c
lea r9, [rbp - 0x30]
mov word [rbp - 0x24], 0x3e79
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18007192f
movdqa xmm0, xmmword [0x1800064d0]
lea r9, [rbp - 0x22]
movdqu xmmword [rbp - 0x22], xmm0
mov dword [rbp - 0x12], 0x36262c28
mov r8d, ebx
mov byte [rbp - 0xe], 0x45
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x15
jl 0x18007197c
lea rdx, [rbp - 0x22]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x1800719d2
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x1800719e8
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800719fa
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800edb00], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180071a0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0x2c], 0x41565a45
mov dword [rbp - 0x28], 0x5d75485c
lea r9, [rbp - 0x30]
mov word [rbp - 0x24], 0x5b50
mov r10d, 0x2f684bdb
mov byte [rbp - 0x22], 0x3f
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x180071a47
movdqa xmm0, xmmword [0x1800064d0]
lea r9, [rbp - 0x21]
movdqu xmmword [rbp - 0x21], xmm0
mov dword [rbp - 0x11], 0x36262c28
mov r8d, ebx
mov byte [rbp - 0xd], 0x45
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x15
jl 0x180071a94
lea rdx, [rbp - 0x21]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180071aea
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180071b00
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180071b13
or r8d, 0xffffffff
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x68]
mov qword [0x1800ee0c0], rax
add rsp, 0x50
pop rbp
ret
sub rsp, 0x28
call fcn.1800863c8
call fcn.180083b70
call fcn.180086150
call fcn.18007a138
call fcn.180084ff4
call fcn.180077404
call fcn.180078598
call fcn.18007a930
call fcn.180072f9c
call fcn.180081dcc
call fcn.1800861b4
call fcn.18006a9e4
call fcn.18006cb10
call fcn.18007c274
call fcn.18007d77c
call fcn.180075ddc
call fcn.18007e8b8
call fcn.180072bcc
call fcn.1800721e0
call fcn.18007ae10
call fcn.18006b1e4
call fcn.1800722fc
call fcn.1800838dc
call fcn.18006e494
call fcn.18006e0e4
call fcn.1800837c0
call fcn.18006b510
call fcn.180085500
call fcn.180069c38
call fcn.18006a604
call fcn.180083548
call fcn.180080634
add rsp, 0x28
jmp 0x180071a0c
Function at 0x180071b30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x17], 0x5d455c54
mov r8d, ebx
mov dword [rbp - 0x13], 0x55595947
mov dword [rbp - 0xf], 0x3c4f545c
lea r9, [rbp - 0x17]
mov r10d, 0x2f684bdb
mov r11b, 0x31
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180071b64
mov dword [rbp + 0x10], 0x5d475c74
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x4f41
mov r8d, ebx
mov byte [rbp + 0x16], 0x37
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180071bab
mov dword [rbp - 0x20], 0x405c4061
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5e42745a
mov r8d, ebx
mov byte [rbp - 0x18], 0x39
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x180071bf3
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x20]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180071c47
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180071c5d
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180071c6f
mov r8b, 1
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed3e0], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x180071e68
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x17], 0x51475355
mov r8d, ebx
mov dword [rbp - 0x13], 0x5d5a5f61
mov byte [rbp - 0xf], 0x39
lea r9, [rbp - 0x17]
mov r10d, 0x2f684bdb
mov r11b, 0x31
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x180071e99
mov dword [rbp - 0xe], 0x5d455c74
lea r9, [rbp - 0xe]
mov dword [rbp - 0xa], 0x55595947
mov r8d, ebx
mov dword [rbp - 6], 0x3c4f545c
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180071ee4
mov dword [rbp - 0x20], 0x405c4061
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5e42745a
mov r8d, ebx
mov byte [rbp - 0x18], 0x39
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x180071f2c
lea rdx, [rbp - 0xe]
lea rcx, [rbp - 0x20]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180071f80
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180071f96
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180071fa8
mov r8b, 1
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed410], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1800720d8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x515a5e52
mov r8d, ebx
mov word [rbp + 0x1c], 0x425b
mov byte [rbp + 0x1e], 0x37
lea r9, [rbp + 0x18]
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180072105
mov dword [rbp - 0x10], 0x515e5376
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x59595778
mov r8d, ebx
mov dword [rbp - 8], 0x3c495f5e
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18007214f
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x1800721a5
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x1800721bb
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800721cd
xor r8d, r8d
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed930], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x1800721e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x14], 0x55564072
mov r8d, ebx
mov dword [rbp - 0x10], 0x4a675341
mov dword [rbp - 0xc], 0x5e5a5c5c
lea r9, [rbp - 0x14]
mov byte [rbp - 8], 0x3d
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x180072215
mov dword [rbp - 0x20], 0x515e5376
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x59595778
mov r8d, ebx
mov dword [rbp - 0x18], 0x3c495f5e
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18007225f
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x1800722b5
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x1800722cb
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800722e0
mov r8d, 2
lea rdx, [rbp - 0x14]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x58]
mov qword [0x1800ee028], rax
add rsp, 0x40
pop rbp
ret

Function at 0x1800722fc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x13], 0x707a6776
mov r8d, ebx
mov dword [rbp - 0xf], 0x5a785961
mov dword [rbp - 0xb], 0x48585f53
lea r9, [rbp - 0x13]
mov byte [rbp - 7], 0x3d
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x180072331
mov dword [rbp - 0x20], 0x515e5376
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x51595778
mov r8d, ebx
mov dword [rbp - 0x18], 0x48485f5f
mov byte [rbp - 0x14], 0x3d
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18007237f
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x1800723d5
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x1800723eb
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180072400
mov r8d, 1
lea rdx, [rbp - 0x13]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x58]
mov qword [0x1800ee048], rax
add rsp, 0x40
pop rbp
ret
Function at 0x180072f9c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x57524065
mov r8d, ebx
mov dword [rbp - 0x1c], 0x545b7750
mov byte [rbp - 0x18], 0x39
lea r9, [rbp - 0x20]
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x180072fca
mov dword [rbp - 0x17], 0x515e5376
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x5b564461
mov r8d, ebx
mov word [rbp - 0xf], 0x3a5c
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x180073013
lea rdx, [rbp - 0x17]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180073069
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007307f
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180073094
mov r8d, 3
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x58]
mov qword [0x1800ede00], rax
add rsp, 0x40
pop rbp
ret

Function at 0x1800730b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x10], 0x425c546e
mov r8d, ebx
mov byte [rbp + 0x14], 0x35
lea r9, [rbp + 0x10]
mov r10d, 0x2f684bdb
mov r11b, 0x31
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x1800730da
mov dword [rbp - 0x10], 0x44524076
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x4b545f5d
mov r8d, ebx
mov byte [rbp - 8], 0x39
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x180073122
mov dword [rbp + 0x18], 0x625d5d72
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x4454
mov r8d, ebx
mov byte [rbp + 0x1e], 0x37
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180073169
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x18]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x1800731bd
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x1800731d3
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800731e5
xor r8d, r8d
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed3d8], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x180077404
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x5d405d61
mov r8d, ebx
mov dword [rbp - 0xc], 0x56585f41
mov dword [rbp - 8], 0x5d695476
lea r9, [rbp - 0x10]
mov word [rbp - 4], 0x3e44
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18007743a
mov dword [rbp + 0x18], 0x7d475b79
lea r9, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x3858505b
mov r8d, ebx
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x18007747f
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
movabs rsi, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x1800774e1
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x1800774f2
lea rcx, [rax - 0x10000]
cmp rcx, rsi
jbe 0x1800774f2
mov rax, rbx
jmp 0x180077504
mov r8d, 1
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.180097118
mov rcx, rax
call fcn.18002c680
mov qword [0x1800eddd0], rax
lea r9, [rbp - 0x10]
mov r8d, ebx
mov dword [rbp - 0x10], 0x50525d7d
mov dword [rbp - 0xc], 0x55584473
mov dword [rbp - 8], 0x5d4f4e78
mov word [rbp - 4], 0x555e
mov byte [rbp - 2], 0x3f
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x180077539
mov dword [rbp + 0x18], 0x7d475b79
lea r9, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x3858505b
mov r8d, ebx
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x18007757e
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x1800775d6
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x1800775e2
lea rcx, [rax - 0x10000]
cmp rcx, rsi
ja 0x1800775f7
mov r8d, 2
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov qword [0x1800eddd8], rax
add rsp, 0x30
pop rbp
ret