joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800791b4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x55445e50
mov r8d, ebx
mov dword [rbp - 0xc], 0x4844454c
mov dword [rbp - 8], 0x4855534b
lea r9, [rbp - 0x10]
mov byte [rbp - 4], 0x3d
mov r10d, 0x2f684bdb
mov r11b, 0x31
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x1800791ec
mov dword [rbp + 0x10], 0x41435c78
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x3641
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x18007922f
mov dword [rbp + 0x18], 0x625d5d72
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x4454
mov r8d, ebx
mov byte [rbp + 0x1e], 0x37
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180079276
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x18]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x1800792ca
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x1800792e0
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800792f2
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed3b0], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x180079ad8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x755e5b50
mov r8d, ebx
mov dword [rbp - 0x1c], 0x5d5b515b
mov word [rbp - 0x18], 0x3a4a
lea r9, [rbp - 0x20]
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x180079b08
mov dword [rbp - 0x16], 0x41435c78
lea r9, [rbp - 0x16]
mov dword [rbp - 0x12], 0x4b527b41
mov r8d, ebx
mov dword [rbp - 0xe], 0x595c5b4a
mov byte [rbp - 0xa], 0x3d
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x180079b56
lea rdx, [rbp - 0x16]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180079bac
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180079bc2
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180079bd4
mov r8b, 1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed940], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x180079be8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x46414752
mov r8d, ebx
mov dword [rbp + 0x1c], 0x38435850
lea r9, [rbp + 0x18]
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x180079c12
mov dword [rbp - 0x10], 0x41435c78
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x59436541
mov r8d, ebx
mov word [rbp - 8], 0x5f4d
mov byte [rbp - 6], 0x3b
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180079c5f
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180079cb5
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180079ccb
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180079cdd
mov r8b, 1
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed830], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x18007a138
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0xc], 0x5658555c
mov dword [rbp - 8], 0x55494a6a
lea r9, [rbp - 0x10]
mov word [rbp - 4], 0x5b49
mov r10d, 0x2f684bdb
mov byte [rbp - 2], 0x3f
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18007a173
mov dword [rbp + 0x18], 0x59564678
lea r9, [rbp + 0x18]
mov byte [rbp + 0x1c], 0x35
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x18007a1b3
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007a209
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007a21f
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007a232
or r8d, 0xffffffff
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x50]
mov qword [0x1800eddc0], rax
add rsp, 0x30
pop rbp
ret

Function at 0x18007a24c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x59564658
mov r8d, ebx
mov dword [rbp - 0x1c], 0x4c445f79
mov byte [rbp - 0x18], 0x39
lea r9, [rbp - 0x20]
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18007a27a
mov dword [rbp - 0x17], 0x59564678
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x4c595976
mov r8d, ebx
mov dword [rbp - 0xf], 0x59555358
mov word [rbp - 0xb], 0x3e4f
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18007a2ca
lea rdx, [rbp - 0x17]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007a320
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007a336
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007a348
mov r8b, 1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed960], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x18007a82c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x180006cc0]
lea r9, [rbp - 0x17]
xor ebx, ebx
mov byte [rbp - 7], 0x41
movdqu xmmword [rbp - 0x17], xmm0
mov r8d, ebx
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x11
jl 0x18007a859
mov dword [rbp - 0x20], 0x59564678
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5658557c
mov r8d, ebx
mov byte [rbp - 0x18], 0x39
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18007a8a0
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007a8f6
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007a90c
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007a91e
mov r8b, 1
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed5a0], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x18007a930
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x17], 0x605d4763
mov r8d, ebx
mov dword [rbp - 0x13], 0x5c525b5c
mov dword [rbp - 0xf], 0x554f5978
lea r9, [rbp - 0x17]
mov word [rbp - 0xb], 0x5052
mov r10d, 0x2f684bdb
mov byte [rbp - 9], 0x3f
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18007a96b
mov dword [rbp - 0x20], 0x59564678
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5658557c
mov r8d, ebx
mov byte [rbp - 0x18], 0x39
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18007a9b2
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007aa08
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007aa1e
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007aa31
or r8d, 0xffffffff
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x58]
mov qword [0x1800eddf8], rax
add rsp, 0x40
pop rbp
ret
Function at 0x18007ae10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0x1c], 0x51435870
mov word [rbp - 0x18], 0x434d
lea r9, [rbp - 0x20]
mov byte [rbp - 0x16], 0x3b
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18007ae44
mov dword [rbp - 0x15], 0x55505d7d
lea r9, [rbp - 0x15]
mov dword [rbp - 0x11], 0x595b6659
mov r8d, ebx
mov dword [rbp - 0xd], 0x3c495f40
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18007ae8e
lea rdx, [rbp - 0x15]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007aee4
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007aefa
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007af0d
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x58]
mov qword [0x1800ee030], rax
add rsp, 0x40
pop rbp
ret

Function at 0x18007af28
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x555f426e
mov r8d, ebx
mov dword [rbp - 0x1c], 0x7645534c
mov dword [rbp - 0x18], 0x3c5e5758
lea r9, [rbp - 0x20]
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18007af59
mov dword [rbp - 0x14], 0x405c5d7d
lea r9, [rbp - 0x14]
mov dword [rbp - 0x10], 0x5d5b5454
mov r8d, ebx
mov dword [rbp - 0xc], 0x4c49557a
mov word [rbp - 8], 0x5b4e
mov byte [rbp - 6], 0x3f
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18007afad
lea rdx, [rbp - 0x14]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007b003
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007b019
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007b02b
mov r8b, 1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed968], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x18007b040
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x15], 0x5a5a535c
mov r8d, ebx
mov dword [rbp - 0x11], 0x5d5a5776
mov word [rbp - 0xd], 0x5b4b
lea r9, [rbp - 0x15]
mov byte [rbp - 0xb], 0x3b
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18007b074
mov dword [rbp - 0x20], 0x5a5a537c
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5d5a5776
mov r8d, ebx
mov word [rbp - 0x18], 0x5b4b
mov byte [rbp - 0x16], 0x3b
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18007b0c1
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007b117
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007b12d
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007b13f
xor r8d, r8d
lea rdx, [rbp - 0x15]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed838], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x18007b600
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x447c4178
mov r8d, ebx
mov word [rbp + 0x1c], 0x5850
mov byte [rbp + 0x1e], 0x37
lea r9, [rbp + 0x18]
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18007b62d
mov dword [rbp - 0x10], 0x7d43537c
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x4a52425b
mov r8d, ebx
mov dword [rbp - 8], 0x59585b5f
mov byte [rbp - 4], 0x3d
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18007b67b
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007b6d1
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007b6e7
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007b6f9
xor r8d, r8d
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed948], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x18007bfac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0x2c], 0x41565a45
mov dword [rbp - 0x28], 0x5d75485c
lea r9, [rbp - 0x30]
mov word [rbp - 0x24], 0x5b50
mov r10d, 0x2f684bdb
mov byte [rbp - 0x22], 0x3f
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x180071a47
movdqa xmm0, xmmword [0x1800064d0]
lea r9, [rbp - 0x21]
movdqu xmmword [rbp - 0x21], xmm0
mov dword [rbp - 0x11], 0x36262c28
mov r8d, ebx
mov byte [rbp - 0xd], 0x45
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x15
jl 0x180071a94
lea rdx, [rbp - 0x21]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180071aea
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180071b00
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180071b13
or r8d, 0xffffffff
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x68]
mov qword [0x1800ee0c0], rax
add rsp, 0x50
pop rbp
ret
sub rsp, 0x28
call fcn.1800863c8
call fcn.180083b70
call fcn.180086150
call fcn.18007a138
call fcn.180084ff4
call fcn.180077404
call fcn.180078598
call fcn.18007a930
call fcn.180072f9c
call fcn.180081dcc
call fcn.1800861b4
call fcn.18006a9e4
call fcn.18006cb10
call fcn.18007c274
call fcn.18007d77c
call fcn.180075ddc
call fcn.18007e8b8
call fcn.180072bcc
call fcn.1800721e0
call fcn.18007ae10
call fcn.18006b1e4
call fcn.1800722fc
call fcn.1800838dc
call fcn.18006e494
call fcn.18006e0e4
call fcn.1800837c0
call fcn.18006b510
call fcn.180085500
call fcn.180069c38
call fcn.18006a604
call fcn.180083548
call fcn.180080634
add rsp, 0x28
jmp 0x180071a0c
Function at 0x18007c05c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x515d5d53
mov r8d, ebx
mov dword [rbp - 0xc], 0x56564461
mov dword [rbp - 8], 0x4e545c4a
lea r9, [rbp - 0x10]
mov word [rbp - 4], 0x4d50
mov r10d, 0x2f684bdb
mov byte [rbp - 2], 0x3f
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18007c097
mov dword [rbp + 0x18], 0x51575d7c
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x3659
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x18007c0d9
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007c12f
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007c145
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007c157
mov r8b, 1
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed480], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x18007c16c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x53525e57
mov r8d, ebx
mov word [rbp + 0x1c], 0x3646
lea r9, [rbp + 0x18]
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x18007c195
mov dword [rbp - 0x10], 0x51575d7c
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x59436559
mov r8d, ebx
mov word [rbp - 8], 0x5f4d
mov byte [rbp - 6], 0x3b
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18007c1e2
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007c238
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007c24e
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007c260
mov r8b, 1
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed818], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x18007d564
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov dword [rbp - 0x35], 0x43565b47
mov r8d, ebx
mov dword [rbp - 0x31], 0x4b51507a
mov word [rbp - 0x2d], 0x4e5c
lea r9, [rbp - 0x35]
mov byte [rbp - 0x2b], 0x3b
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18007d597
mov dword [rbp - 0x40], 0x4d525e61
lea r9, [rbp - 0x40]
mov dword [rbp - 0x3c], 0x41724450
mov r8d, ebx
mov word [rbp - 0x38], 0x495c
mov byte [rbp - 0x36], 0x3b
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18007d5e6
lea rdx, [rbp - 0x40]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
movabs rdi, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18007d648
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007d659
lea rcx, [rax - 0x10000]
cmp rcx, rdi
jbe 0x18007d659
mov rax, rbx
jmp 0x18007d668
mov r8b, 1
lea rdx, [rbp - 0x35]
mov rcx, rax
call fcn.180096f64
movdqa xmm0, xmmword [0x180006460]
lea r9, [rbp - 0x2a]
movdqu xmmword [rbp - 0x2a], xmm0
mov qword [0x1800ed820], rax
mov r8d, ebx
mov dword [rbp - 0x1a], 0x2722001e
mov dword [rbp - 0x16], 0x2f292f2e
mov dword [rbp - 0x12], 0x202e230f
mov word [rbp - 0xe], 0x4e29
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x1e
jl 0x18007d69e
mov dword [rbp - 0x35], 0x4d525e61
lea r9, [rbp - 0x35]
mov dword [rbp - 0x31], 0x41724450
mov r8d, ebx
mov word [rbp - 0x2d], 0x495c
mov byte [rbp - 0x2b], 0x3b
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18007d6ed
lea rdx, [rbp - 0x35]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007d745
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007d751
lea rcx, [rax - 0x10000]
cmp rcx, rdi
ja 0x18007d763
mov r8b, 1
lea rdx, [rbp - 0x2a]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
lea r11, [rsp + 0x60]
mov qword [0x1800ed828], rbx
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18007e308
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x405d5d52
mov r8d, ebx
mov dword [rbp - 0x1c], 0x5d595f54
mov dword [rbp - 0x18], 0x505e784b
lea r9, [rbp - 0x20]
mov word [rbp - 0x14], 0x3e49
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18007e33f
movdqa xmm0, xmmword [0x180007fa0]
lea r9, [rbp - 0x12]
movdqu xmmword [rbp - 0x12], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18007e381
lea rdx, [rbp - 0x12]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x18007e3d7
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18007e3ed
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007e3ff
mov r8b, 1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed9a8], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret