joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180069758
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x5d5e5650
mov r8d, ebx
mov dword [rbp - 0xc], 0x555e425b
mov word [rbp - 8], 0x3a5c
lea r9, [rbp - 0x10]
mov r10d, 0x2f684bdb
mov r11b, 0x31
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x18006978b
mov dword [rbp + 0x10], 0x5d5e5670
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x365b
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x1800697ce
mov dword [rbp + 0x18], 0x625d5d72
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x4454
mov r8d, ebx
mov byte [rbp + 0x1e], 0x37
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180069815
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x18]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180069869
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18006987f
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180069891
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed3b8], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x180069c38
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x7a475776
mov r8d, ebx
mov dword [rbp + 0x1c], 0x38525b54
lea r9, [rbp + 0x18]
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x180069c62
mov dword [rbp - 0x10], 0x51404170
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x55567841
mov r8d, ebx
mov dword [rbp - 8], 0x5f5a795c
mov word [rbp - 4], 0x5b55
mov byte [rbp - 2], 0x3f
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x180069cb6
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180069d0c
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180069d22
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180069d37
mov r8d, 1
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x50]
mov qword [0x1800ee0a0], rax
add rsp, 0x30
pop rbp
ret
Function at 0x18006a604
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp + 0x18], 0x51774178
mov r8d, ebx
mov word [rbp + 0x1c], 0x5254
mov byte [rbp + 0x1e], 0x37
lea r9, [rbp + 0x18]
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18006a631
movdqa xmm0, xmmword [0x180007aa0]
lea r9, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x10], 0x41
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x11
jl 0x18006a677
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18006a6cd
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18006a6e3
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006a6f6
or r8d, 0xffffffff
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x60]
mov qword [0x1800ee0a8], rax
add rsp, 0x40
pop rbp
ret
Function at 0x18006afd8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x1c], 0x635d5352
mov r8d, ebx
mov dword [rbp - 0x18], 0x5c5b535c
mov dword [rbp - 0x14], 0x515e4e70
lea r9, [rbp - 0x1c]
mov word [rbp - 0x10], 0x3e4e
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18006b00e
mov dword [rbp - 0x30], 0x51405373
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x56425978
mov r8d, ebx
mov dword [rbp - 0x28], 0x50595b4d
mov word [rbp - 0x24], 0x3e58
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18006b060
lea rdx, [rbp - 0x30]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
movabs rdi, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18006b0c2
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18006b0d3
lea rcx, [rax - 0x10000]
cmp rcx, rdi
jbe 0x18006b0d3
mov rax, rbx
jmp 0x18006b0e2
mov r8b, 1
lea rdx, [rbp - 0x1c]
mov rcx, rax
call fcn.180096f64
movdqa xmm0, xmmword [0x1800074d0]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov qword [0x1800ed950], rax
mov r8d, ebx
mov dword [rbp - 0x20], 0x44372c24
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x18006b104
mov dword [rbp - 0x1c], 0x51405373
lea r9, [rbp - 0x1c]
mov dword [rbp - 0x18], 0x56425978
mov r8d, ebx
mov dword [rbp - 0x14], 0x50595b4d
mov word [rbp - 0x10], 0x3e58
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18006b156
lea rdx, [rbp - 0x1c]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18006b1ae
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18006b1ba
lea rcx, [rax - 0x10000]
cmp rcx, rdi
ja 0x18006b1cc
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov rdi, qword [rsp + 0x70]
mov qword [0x1800ed958], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18006b1e4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r15
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x180006ac0]
lea r9, [rbp - 0x13]
xor ebx, ebx
mov word [rbp - 3], 0x362f
movdqu xmmword [rbp - 0x13], xmm0
mov r8d, ebx
mov byte [rbp - 1], 0x43
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x13
jl 0x18006b216
mov dword [rbp - 0x20], 0x51405373
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5d415978
mov r8d, ebx
mov dword [rbp - 0x18], 0x48555f54
mov byte [rbp - 0x14], 0x3d
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18006b266
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
movabs r15, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18006b2c8
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18006b2d9
lea rcx, [rax - 0x10000]
cmp rcx, r15
jbe 0x18006b2d9
mov rax, rbx
jmp 0x18006b2e9
or r8d, 0xffffffff
lea rdx, [rbp - 0x13]
mov rcx, rax
call fcn.180097118
mov rcx, rax
call fcn.18002c680
movdqa xmm0, xmmword [0x180006ab0]
lea r9, [rbp - 0x13]
movdqu xmmword [rbp - 0x13], xmm0
mov qword [0x1800ee038], rax
mov r8d, ebx
mov word [rbp - 3], 0x362f
mov byte [rbp - 1], 0x43
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x13
jl 0x18006b316
mov dword [rbp - 0x20], 0x51405373
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5d415978
mov r8d, ebx
mov dword [rbp - 0x18], 0x48555f54
mov byte [rbp - 0x14], 0x3d
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18006b366
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18006b3be
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18006b3ca
lea rcx, [rax - 0x10000]
cmp rcx, r15
ja 0x18006b3df
mov r8d, 1
lea rdx, [rbp - 0x13]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
mov qword [0x1800ee040], rax
add rsp, 0x40
pop rbp
ret
Function at 0x18006b400
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x515a5e52
mov r8d, ebx
mov dword [rbp - 0x1c], 0x5672425b
mov dword [rbp - 0x18], 0x554f534d
lea r9, [rbp - 0x20]
mov word [rbp - 0x14], 0x4d58
mov r10d, 0x2f684bdb
mov byte [rbp - 0x12], 0x3f
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18006b43b
movdqa xmm0, xmmword [0x180008110]
lea r9, [rbp - 0x11]
movdqu xmmword [rbp - 0x11], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18006b47d
lea rdx, [rbp - 0x11]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18006b4d3
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18006b4e9
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006b4fb
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed9a0], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x18006b510
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x64405379
mov r8d, ebx
mov dword [rbp - 0x2c], 0x56524454
mov word [rbp - 0x28], 0x3a4d
lea r9, [rbp - 0x30]
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x18006b53f
movdqa xmm0, xmmword [0x180008110]
lea r9, [rbp - 0x1c]
movdqu xmmword [rbp - 0x1c], xmm0
mov r8d, ebx
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18006b583
lea rdx, [rbp - 0x1c]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
movabs rdi, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18006b5e5
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18006b5f6
lea rcx, [rax - 0x10000]
cmp rcx, rdi
jbe 0x18006b5f6
mov rax, rbx
jmp 0x18006b606
or r8d, 0xffffffff
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180097118
mov rcx, rax
call fcn.18002c680
movdqa xmm0, xmmword [0x180006360]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov qword [0x1800ee088], rax
mov r8d, ebx
mov dword [rbp - 0x20], 0x44262f20
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x18006b630
movdqa xmm0, xmmword [0x180008110]
lea r9, [rbp - 0x1c]
movdqu xmmword [rbp - 0x1c], xmm0
mov r8d, ebx
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18006b674
lea rdx, [rbp - 0x1c]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18006b6cc
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18006b6d8
lea rcx, [rax - 0x10000]
cmp rcx, rdi
ja 0x18006b6eb
or r8d, 0xffffffff
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov qword [0x1800ee090], rax
add rsp, 0x50
pop rbp
ret
Function at 0x18006dfd0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x180006ae0]
lea r9, [rbp - 0x22]
xor ebx, ebx
mov word [rbp - 0x12], 0x2333
movdqu xmmword [rbp - 0x22], xmm0
mov r8d, ebx
mov byte [rbp - 0x10], 0x43
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x13
jl 0x18006e003
mov dword [rbp - 0x30], 0x51405373
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x4f525f63
mov r8d, ebx
mov dword [rbp - 0x28], 0x595f5574
mov word [rbp - 0x24], 0x3e51
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18006e053
lea rdx, [rbp - 0x30]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18006e0a9
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18006e0bf
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006e0d1
mov r8b, 1
lea rdx, [rbp - 0x22]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed970], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x18006e0e4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x1800080d0]
lea r9, [rbp - 0x12]
xor ebx, ebx
mov r10d, 0x2f684bdb
movdqu xmmword [rbp - 0x12], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18006e10d
mov dword [rbp - 0x20], 0x51405373
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x4f525f63
mov r8d, ebx
mov dword [rbp - 0x18], 0x595f5574
mov word [rbp - 0x14], 0x3e51
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18006e15d
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18006e1b3
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18006e1c9
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006e1dc
or r8d, 0xffffffff
lea rdx, [rbp - 0x12]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x58]
mov qword [0x1800ee078], rax
add rsp, 0x40
pop rbp
ret
Function at 0x18006e7a4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x180007440]
lea r9, [rbp - 0x1e]
xor ebx, ebx
mov word [rbp - 0xe], 0x4232
movdqu xmmword [rbp - 0x1e], xmm0
mov r8d, ebx
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x18006e7d3
movdqa xmm0, xmmword [0x180006ce0]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x20], 0x4224
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x18006e81b
lea rdx, [rbp - 0x30]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18006e871
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18006e887
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006e899
mov r8b, 1
lea rdx, [rbp - 0x1e]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed9d8], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180070abc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r15
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x180007fd0]
lea r9, [rbp - 0x14]
xor ebx, ebx
mov esi, 0x2f684bdb
movdqu xmmword [rbp - 0x14], xmm0
mov r8d, ebx
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x180070aee
mov dword [rbp + 0x10], 0x515e5372
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x5747
mov r8d, ebx
mov byte [rbp + 0x16], 0x37
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180070b33
mov dword [rbp - 0x20], 0x405a5c64
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x18], 0x3c5e5450
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180070b7c
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x20]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
movabs r15, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x180070bd8
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180070be9
lea rcx, [rax - 0x10000]
cmp rcx, r15
jbe 0x180070be9
mov rax, rbx
jmp 0x180070bfb
mov r8d, 1
lea rdx, [rbp - 0x14]
mov rcx, rax
call fcn.180097118
mov rcx, rax
call fcn.18002c680
movdqa xmm0, xmmword [0x180007fe0]
lea r9, [rbp - 0x14]
movdqu xmmword [rbp - 0x14], xmm0
mov qword [0x1800edc08], rax
mov r8d, ebx
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x180070c1e
mov dword [rbp + 0x10], 0x515e5372
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x5747
mov r8d, ebx
mov byte [rbp + 0x16], 0x37
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180070c63
mov dword [rbp - 0x20], 0x405a5c64
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x18], 0x3c5e5450
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180070cac
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x20]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180070cfe
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180070d0a
lea rcx, [rax - 0x10000]
cmp rcx, r15
ja 0x180070d1d
or r8d, 0xffffffff
lea rdx, [rbp - 0x14]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x68]
mov qword [0x1800edc10], rax
add rsp, 0x40
pop rbp
ret
Function at 0x180070d44
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x6b475742
mov r8d, ebx
mov dword [rbp - 0x2c], 0x51535747
mov word [rbp - 0x28], 0x494c
lea r9, [rbp - 0x30]
mov byte [rbp - 0x26], 0x3b
mov r10d, 0x2f684bdb
mov r11b, 0x31
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180070d7b
movdqa xmm0, xmmword [0x180008070]
lea r9, [rbp - 0x19]
movdqu xmmword [rbp - 0x19], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x180070dbe
mov dword [rbp - 0x25], 0x405a5c64
lea r9, [rbp - 0x25]
mov dword [rbp - 0x21], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x1d], 0x3c5e5450
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180070e09
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x25]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180070e5d
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180070e73
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180070e88
mov r8d, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x60]
mov qword [0x1800eddb8], rax
add rsp, 0x50
pop rbp
ret
sub rsp, 0x28
call fcn.180083cc8
call fcn.180079304
call fcn.180083660
call fcn.18007c760
call fcn.180070abc
call fcn.1800833f0
call fcn.18007cffc
call fcn.18007b70c
call fcn.180082d74
call fcn.180071108
call fcn.180071268
call fcn.18006e1f8
call fcn.18008314c
call fcn.180085618
call fcn.1800824f4
call fcn.18007241c
call fcn.1800698a4
add rsp, 0x28
jmp 0x180070d44