joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180047c50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x1c], 0x625a5251
mov r8d, ebx
mov dword [rbp - 0x18], 0x5d54525f
mov dword [rbp - 0x14], 0x50594f73
lea r9, [rbp - 0x1c]
mov word [rbp - 0x10], 0x3f4d
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x180047c86
mov dword [rbp - 0x30], 0x50475270
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x574d587b
mov r8d, ebx
mov dword [rbp - 0x28], 0x515e5a4e
mov word [rbp - 0x24], 0x3f5b
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x180047cd8
lea rdx, [rbp - 0x30]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
movabs rdi, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x180047d3a
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180047d4b
lea rcx, [rax - 0x10000]
cmp rcx, rdi
jbe 0x180047d4b
mov rax, rbx
jmp 0x180047d5a
mov r8b, 1
lea rdx, [rbp - 0x1c]
mov rcx, rax
call fcn.180073298
movdqa xmm0, xmmword [0x180007460]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov qword [0x1800c8960], rax
mov r8d, ebx
mov dword [rbp - 0x20], 0x45302d27
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x180047d7c
mov dword [rbp - 0x1c], 0x50475270
lea r9, [rbp - 0x1c]
mov dword [rbp - 0x18], 0x574d587b
mov r8d, ebx
mov dword [rbp - 0x14], 0x515e5a4e
mov word [rbp - 0x10], 0x3f5b
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x180047dce
lea rdx, [rbp - 0x1c]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180047e26
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180047e32
lea rcx, [rax - 0x10000]
cmp rcx, rdi
ja 0x180047e44
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov rdi, qword [rsp + 0x70]
mov qword [0x1800c8968], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180047e5c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r15
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x180006900]
lea r9, [rbp - 0x13]
xor ebx, ebx
mov word [rbp - 3], 0x372c
movdqu xmmword [rbp - 0x13], xmm0
mov r8d, ebx
mov byte [rbp - 1], 0x44
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x13
jl 0x180047e8e
mov dword [rbp - 0x20], 0x50475270
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5c4e587b
mov r8d, ebx
mov dword [rbp - 0x18], 0x49525e57
mov byte [rbp - 0x14], 0x3e
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x180047ede
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
movabs r15, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x180047f40
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180047f51
lea rcx, [rax - 0x10000]
cmp rcx, r15
jbe 0x180047f51
mov rax, rbx
jmp 0x180047f61
or r8d, 0xffffffff
lea rdx, [rbp - 0x13]
mov rcx, rax
call fcn.18007344c
mov rcx, rax
call fcn.18002c688
movdqa xmm0, xmmword [0x1800068f0]
lea r9, [rbp - 0x13]
movdqu xmmword [rbp - 0x13], xmm0
mov qword [0x1800c9048], rax
mov r8d, ebx
mov word [rbp - 3], 0x372c
mov byte [rbp - 1], 0x44
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x13
jl 0x180047f8e
mov dword [rbp - 0x20], 0x50475270
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5c4e587b
mov r8d, ebx
mov dword [rbp - 0x18], 0x49525e57
mov byte [rbp - 0x14], 0x3e
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x180047fde
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180048036
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180048042
lea rcx, [rax - 0x10000]
cmp rcx, r15
ja 0x180048057
mov r8d, 1
lea rdx, [rbp - 0x13]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
mov qword [0x1800c9050], rax
add rsp, 0x40
pop rbp
ret
Function at 0x180048078
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x505d5f51
mov r8d, ebx
mov dword [rbp - 0x1c], 0x577d4358
mov dword [rbp - 0x18], 0x5448524e
lea r9, [rbp - 0x20]
mov word [rbp - 0x14], 0x4c5b
mov r10d, 0x1f7047dd
mov byte [rbp - 0x12], 0x40
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x1800480b3
movdqa xmm0, xmmword [0x180007ef0]
lea r9, [rbp - 0x11]
movdqu xmmword [rbp - 0x11], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x1800480f5
lea rdx, [rbp - 0x11]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004814b
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180048161
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180048173
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c89b0], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x180048188
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x6547527a
mov r8d, ebx
mov dword [rbp - 0x2c], 0x575d4557
mov word [rbp - 0x28], 0x3b4e
lea r9, [rbp - 0x30]
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x1800481b7
movdqa xmm0, xmmword [0x180007ef0]
lea r9, [rbp - 0x1c]
movdqu xmmword [rbp - 0x1c], xmm0
mov r8d, ebx
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x1800481fb
lea rdx, [rbp - 0x1c]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
movabs rdi, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18004825d
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004826e
lea rcx, [rax - 0x10000]
cmp rcx, rdi
jbe 0x18004826e
mov rax, rbx
jmp 0x18004827e
or r8d, 0xffffffff
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18007344c
mov rcx, rax
call fcn.18002c688
movdqa xmm0, xmmword [0x1800062a0]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov qword [0x1800c9098], rax
mov r8d, ebx
mov dword [rbp - 0x20], 0x45212e23
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x1800482a8
movdqa xmm0, xmmword [0x180007ef0]
lea r9, [rbp - 0x1c]
movdqu xmmword [rbp - 0x1c], xmm0
mov r8d, ebx
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x1800482ec
lea rdx, [rbp - 0x1c]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180048344
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180048350
lea rcx, [rax - 0x10000]
cmp rcx, rdi
ja 0x180048363
or r8d, 0xffffffff
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov qword [0x1800c90a0], rax
add rsp, 0x50
pop rbp
ret
Function at 0x18004ac48
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x180006920]
lea r9, [rbp - 0x22]
xor ebx, ebx
mov word [rbp - 0x12], 0x2230
movdqu xmmword [rbp - 0x22], xmm0
mov r8d, ebx
mov byte [rbp - 0x10], 0x44
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x13
jl 0x18004ac7b
mov dword [rbp - 0x30], 0x50475270
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x4e5d5e60
mov r8d, ebx
mov dword [rbp - 0x28], 0x58585477
mov word [rbp - 0x24], 0x3f52
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18004accb
lea rdx, [rbp - 0x30]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004ad21
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004ad37
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004ad49
mov r8b, 1
lea rdx, [rbp - 0x22]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8980], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x18004ad5c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x180007f30]
lea r9, [rbp - 0x12]
xor ebx, ebx
mov r10d, 0x1f7047dd
movdqu xmmword [rbp - 0x12], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18004ad85
mov dword [rbp - 0x20], 0x50475270
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x4e5d5e60
mov r8d, ebx
mov dword [rbp - 0x18], 0x58585477
mov word [rbp - 0x14], 0x3f52
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18004add5
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004ae2b
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004ae41
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004ae54
or r8d, 0xffffffff
lea rdx, [rbp - 0x12]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x58]
mov qword [0x1800c9088], rax
add rsp, 0x40
pop rbp
ret
Function at 0x18004b41c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x180007490]
lea r9, [rbp - 0x1e]
xor ebx, ebx
mov word [rbp - 0xe], 0x4331
movdqu xmmword [rbp - 0x1e], xmm0
mov r8d, ebx
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x18004b44b
movdqa xmm0, xmmword [0x180006be0]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x20], 0x4327
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x18004b493
lea rdx, [rbp - 0x30]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004b4e9
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004b4ff
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004b511
mov r8b, 1
lea rdx, [rbp - 0x1e]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c89e8], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18004d6fc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r15
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x180008000]
lea r9, [rbp - 0x14]
xor ebx, ebx
mov esi, 0x1f7047dd
movdqu xmmword [rbp - 0x14], xmm0
mov r8d, ebx
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18004d72e
mov dword [rbp + 0x10], 0x50595271
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x5644
mov r8d, ebx
mov byte [rbp + 0x16], 0x38
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18004d773
mov dword [rbp - 0x20], 0x415d5d67
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5e56724f
mov r8d, ebx
mov dword [rbp - 0x18], 0x3d595553
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18004d7bc
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x20]
call fcn.180073158
mov rdx, qword [0x1800c8118]
movabs r15, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18004d818
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004d829
lea rcx, [rax - 0x10000]
cmp rcx, r15
jbe 0x18004d829
mov rax, rbx
jmp 0x18004d83b
mov r8d, 1
lea rdx, [rbp - 0x14]
mov rcx, rax
call fcn.18007344c
mov rcx, rax
call fcn.18002c688
movdqa xmm0, xmmword [0x180008010]
lea r9, [rbp - 0x14]
movdqu xmmword [rbp - 0x14], xmm0
mov qword [0x1800c8c18], rax
mov r8d, ebx
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18004d85e
mov dword [rbp + 0x10], 0x50595271
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x5644
mov r8d, ebx
mov byte [rbp + 0x16], 0x38
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18004d8a3
mov dword [rbp - 0x20], 0x415d5d67
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5e56724f
mov r8d, ebx
mov dword [rbp - 0x18], 0x3d595553
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18004d8ec
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x20]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004d93e
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004d94a
lea rcx, [rax - 0x10000]
cmp rcx, r15
ja 0x18004d95d
or r8d, 0xffffffff
lea rdx, [rbp - 0x14]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x68]
mov qword [0x1800c8c20], rax
add rsp, 0x40
pop rbp
ret
Function at 0x18004d984
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x6a405641
mov r8d, ebx
mov dword [rbp - 0x2c], 0x505c5644
mov word [rbp - 0x28], 0x484f
lea r9, [rbp - 0x30]
mov byte [rbp - 0x26], 0x3c
mov r10d, 0x1f7047dd
mov r11b, 0x32
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18004d9bb
movdqa xmm0, xmmword [0x180007f90]
lea r9, [rbp - 0x19]
movdqu xmmword [rbp - 0x19], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18004d9fe
mov dword [rbp - 0x25], 0x415d5d67
lea r9, [rbp - 0x25]
mov dword [rbp - 0x21], 0x5e56724f
mov r8d, ebx
mov dword [rbp - 0x1d], 0x3d595553
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18004da49
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x25]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004da9d
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004dab3
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004dac8
mov r8d, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x60]
mov qword [0x1800c8dc8], rax
add rsp, 0x50
pop rbp
ret
sub rsp, 0x28
call fcn.180060914
call fcn.180055f44
call fcn.1800602ac
call fcn.1800593ac
call fcn.18004d6fc
call fcn.18006003c
call fcn.180059c48
call fcn.180058358
call fcn.18005f9c0
call fcn.18004dd48
call fcn.18004dea8
call fcn.18004ae70
call fcn.18005fd98
call fcn.18006225c
call fcn.18005f140
call fcn.18004f05c
call fcn.180046534
add rsp, 0x28
jmp 0x18004d984
Function at 0x18004dae4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x30], 0x59595251
mov r8d, ebx
mov dword [rbp + 0x34], 0x39484553
lea r9, [rbp + 0x30]
mov esi, 0x1f7047dd
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x18004db10
mov dword [rbp + 0x20], 0x505d5f71
lea r9, [rbp + 0x20]
mov word [rbp + 0x24], 0x4358
mov r8d, ebx
mov byte [rbp + 0x26], 0x38
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18004db55
mov dword [rbp + 0x28], 0x635a5c71
lea r9, [rbp + 0x28]
mov word [rbp + 0x2c], 0x4557
mov r8d, ebx
mov byte [rbp + 0x2e], 0x38
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18004db9a
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x28]
call fcn.180073158
mov rdx, qword [0x1800c8118]
movabs r15, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18004dbf6
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004dc07
lea rcx, [rax - 0x10000]
cmp rcx, r15
jbe 0x18004dc07
mov rax, rbx
jmp 0x18004dc16
xor r8d, r8d
lea rdx, [rbp + 0x30]
mov rcx, rax
call fcn.180073298
mov qword [0x1800c83d0], rax
lea r9, [rbp - 0x10]
mov dword [rbp - 0x10], 0x5855506d
mov r8d, ebx
mov dword [rbp - 0xc], 0x5c5d4745
mov word [rbp - 8], 0x3b5e
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x18004dc38
mov dword [rbp + 0x20], 0x505d5f71
lea r9, [rbp + 0x20]
mov word [rbp + 0x24], 0x4358
mov r8d, ebx
mov byte [rbp + 0x26], 0x38
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18004dc7d
mov dword [rbp + 0x28], 0x635a5c71
lea r9, [rbp + 0x28]
mov word [rbp + 0x2c], 0x4557
mov r8d, ebx
mov byte [rbp + 0x2e], 0x38
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18004dcc2
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x28]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004dd14
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004dd20
lea rcx, [rax - 0x10000]
cmp rcx, r15
ja 0x18004dd32
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c83d8], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop rsi
pop rbp
ret
Function at 0x18004dd48
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x180006580]
lea r9, [rbp - 0x1b]
xor ebx, ebx
mov dword [rbp - 0xb], 0x45202636
movdqu xmmword [rbp - 0x1b], xmm0
mov r8d, ebx
mov r10d, 0x1f7047dd
mov r11b, 0x32
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x18004dd7b
mov dword [rbp - 0x30], 0x59585c71
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x4b5d535f
mov r8d, ebx
mov byte [rbp - 0x28], 0x3a
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18004ddc3
mov dword [rbp - 0x27], 0x415d5d67
lea r9, [rbp - 0x27]
mov dword [rbp - 0x23], 0x5e56724f
mov r8d, ebx
mov dword [rbp - 0x1f], 0x3d595553
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18004de0e
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x27]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004de62
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004de78
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004de8b
or r8d, 0xffffffff
lea rdx, [rbp - 0x1b]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x60]
mov qword [0x1800c8ca8], rax
add rsp, 0x50
pop rbp
ret