joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180068cd8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r15
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x1a], 0x6b475742
mov r8d, ebx
mov dword [rbp - 0x16], 0x5a565850
mov dword [rbp - 0x12], 0x3c5f5f55
lea r9, [rbp - 0x1a]
mov esi, 0x5397829d
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180068d12
mov dword [rbp - 0x30], 0x555b5773
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x4d585f43
mov r8d, ebx
mov word [rbp - 0x28], 0x3a4b
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x180068d51
mov dword [rbp - 0x26], 0x405a5c64
lea r9, [rbp - 0x26]
mov dword [rbp - 0x22], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x1e], 0x3c5e5450
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180068d91
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x26]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
movabs r15, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x180068de4
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180068df5
lea rcx, [rax - 0x10000]
cmp rcx, r15
jbe 0x180068df5
mov rax, rbx
jmp 0x180068e07
mov r8d, 1
lea rdx, [rbp - 0x1a]
mov rcx, rax
call fcn.18008fa44
mov rcx, rax
call fcn.18002b270
mov qword [0x1800e6cc0], rax
lea r9, [rbp - 0x26]
mov r8d, ebx
mov dword [rbp - 0x26], 0x6b475756
mov dword [rbp - 0x22], 0x5a565850
mov dword [rbp - 0x1e], 0x3c5f5f55
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180068e32
mov dword [rbp - 0x30], 0x555b5773
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x4d585f43
mov r8d, ebx
mov word [rbp - 0x28], 0x3a4b
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x180068e71
mov dword [rbp - 0x1a], 0x405a5c64
lea r9, [rbp - 0x1a]
mov dword [rbp - 0x16], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x12], 0x3c5e5450
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180068eb1
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x1a]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180068efa
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180068f06
lea rcx, [rax - 0x10000]
cmp rcx, r15
ja 0x180068f19
or r8d, 0xffffffff
lea rdx, [rbp - 0x26]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x70]
mov qword [0x1800e6cc8], rax
add rsp, 0x50
pop rbp
ret
Function at 0x180069218
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x180007460]
lea r9, [rbp - 0x1e]
xor ebx, ebx
mov word [rbp - 0xe], 0x4232
movdqu xmmword [rbp - 0x1e], xmm0
mov r8d, ebx
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x180069247
movdqa xmm0, xmmword [0x180006d00]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x20], 0x4224
mov r8d, ebx
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x180069286
lea rdx, [rbp - 0x30]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x1800692d3
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x1800692e9
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800692fb
mov r8b, 1
lea rdx, [rbp - 0x1e]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e69d8], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18006b310
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r15
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x180007ff0]
lea r9, [rbp - 0x14]
xor ebx, ebx
mov esi, 0x5397829d
movdqu xmmword [rbp - 0x14], xmm0
mov r8d, ebx
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18006b342
mov dword [rbp + 0x10], 0x515e5372
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x5747
mov r8d, ebx
mov byte [rbp + 0x16], 0x37
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18006b37e
mov dword [rbp - 0x20], 0x405a5c64
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x18], 0x3c5e5450
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18006b3be
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x20]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
movabs r15, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18006b411
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006b422
lea rcx, [rax - 0x10000]
cmp rcx, r15
jbe 0x18006b422
mov rax, rbx
jmp 0x18006b434
mov r8d, 1
lea rdx, [rbp - 0x14]
mov rcx, rax
call fcn.18008fa44
mov rcx, rax
call fcn.18002b270
movdqa xmm0, xmmword [0x180008000]
lea r9, [rbp - 0x14]
movdqu xmmword [rbp - 0x14], xmm0
mov qword [0x1800e6c08], rax
mov r8d, ebx
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18006b457
mov dword [rbp + 0x10], 0x515e5372
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x5747
mov r8d, ebx
mov byte [rbp + 0x16], 0x37
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18006b493
mov dword [rbp - 0x20], 0x405a5c64
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x18], 0x3c5e5450
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18006b4d3
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x20]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006b51c
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006b528
lea rcx, [rax - 0x10000]
cmp rcx, r15
ja 0x18006b53b
or r8d, 0xffffffff
lea rdx, [rbp - 0x14]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x68]
mov qword [0x1800e6c10], rax
add rsp, 0x40
pop rbp
ret
Function at 0x18006b560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x6b475742
mov r8d, ebx
mov dword [rbp - 0x2c], 0x51535747
mov word [rbp - 0x28], 0x494c
lea r9, [rbp - 0x30]
mov byte [rbp - 0x26], 0x3b
mov r10d, 0x5397829d
mov r11b, 0x31
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18006b597
movdqa xmm0, xmmword [0x180008090]
lea r9, [rbp - 0x19]
movdqu xmmword [rbp - 0x19], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18006b5d1
mov dword [rbp - 0x25], 0x405a5c64
lea r9, [rbp - 0x25]
mov dword [rbp - 0x21], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x1d], 0x3c5e5450
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18006b613
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x25]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006b65e
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006b674
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006b689
mov r8d, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x60]
mov qword [0x1800e6db8], rax
add rsp, 0x50
pop rbp
ret
sub rsp, 0x28
call fcn.18007ce08
call fcn.180073124
call fcn.18007c81c
call fcn.1800761bc
call fcn.18006b310
call fcn.18007c5dc
call fcn.18007699c
call fcn.1800752a8
call fcn.18007bfe8
call fcn.18006b8d4
call fcn.18006ba18
call fcn.180068cd8
call fcn.18007c36c
call fcn.18007e554
call fcn.18007b810
call fcn.18006cab0
call fcn.180064914
add rsp, 0x28
jmp 0x18006b560
Function at 0x18006b6a4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x30], 0x585e5352
mov r8d, ebx
mov dword [rbp + 0x34], 0x38474450
lea r9, [rbp + 0x30]
mov esi, 0x5397829d
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x18006b6d0
mov dword [rbp + 0x20], 0x515a5e72
lea r9, [rbp + 0x20]
mov word [rbp + 0x24], 0x425b
mov r8d, ebx
mov byte [rbp + 0x26], 0x37
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18006b70c
mov dword [rbp + 0x28], 0x625d5d72
lea r9, [rbp + 0x28]
mov word [rbp + 0x2c], 0x4454
mov r8d, ebx
mov byte [rbp + 0x2e], 0x37
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18006b748
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x28]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
movabs r15, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18006b79b
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006b7ac
lea rcx, [rax - 0x10000]
cmp rcx, r15
jbe 0x18006b7ac
mov rax, rbx
jmp 0x18006b7bb
xor r8d, r8d
lea rdx, [rbp + 0x30]
mov rcx, rax
call fcn.18008f890
mov qword [0x1800e63c0], rax
lea r9, [rbp - 0x10]
mov dword [rbp - 0x10], 0x5952516e
mov r8d, ebx
mov dword [rbp - 0xc], 0x5d524646
mov word [rbp - 8], 0x3a5d
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x18006b7dd
mov dword [rbp + 0x20], 0x515a5e72
lea r9, [rbp + 0x20]
mov word [rbp + 0x24], 0x425b
mov r8d, ebx
mov byte [rbp + 0x26], 0x37
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18006b819
mov dword [rbp + 0x28], 0x625d5d72
lea r9, [rbp + 0x28]
mov word [rbp + 0x2c], 0x4454
mov r8d, ebx
mov byte [rbp + 0x2e], 0x37
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18006b855
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x28]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006b89e
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006b8aa
lea rcx, [rax - 0x10000]
cmp rcx, r15
ja 0x18006b8bc
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e63c8], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop rsi
pop rbp
ret
Function at 0x18006b8d4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x1800067f0]
lea r9, [rbp - 0x1b]
xor ebx, ebx
mov dword [rbp - 0xb], 0x44272735
movdqu xmmword [rbp - 0x1b], xmm0
mov r8d, ebx
mov r10d, 0x5397829d
mov r11b, 0x31
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x18006b907
mov dword [rbp - 0x30], 0x585f5d72
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x4a52525c
mov r8d, ebx
mov byte [rbp - 0x28], 0x39
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18006b946
mov dword [rbp - 0x27], 0x405a5c64
lea r9, [rbp - 0x27]
mov dword [rbp - 0x23], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x1f], 0x3c5e5450
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18006b988
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x27]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006b9d3
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006b9e9
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006b9fc
or r8d, 0xffffffff
lea rdx, [rbp - 0x1b]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x60]
mov qword [0x1800e6c98], rax
add rsp, 0x50
pop rbp
ret
Function at 0x18006bef0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x180007630]
lea r9, [rbp - 0x20]
xor ebx, ebx
mov word [rbp - 0x10], 0x4235
movdqu xmmword [rbp - 0x20], xmm0
mov r8d, ebx
mov r10d, 0x5397829d
mov r11b, 0x31
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x18006bf22
mov dword [rbp + 0x18], 0x585f4772
lea r9, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x3850585c
mov r8d, ebx
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x18006bf5d
mov dword [rbp + 0x10], 0x625d5d72
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x4454
mov r8d, ebx
mov byte [rbp + 0x16], 0x37
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18006bf9b
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006bfe6
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006bffc
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006c00e
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e63d0], rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x18006c020
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x4d525e41
mov r8d, ebx
mov dword [rbp - 0x2c], 0x4c644450
mov dword [rbp - 0x28], 0x75565b5c
lea r9, [rbp - 0x30]
mov word [rbp - 0x24], 0x3e79
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18006c057
movdqa xmm0, xmmword [0x1800064f0]
lea r9, [rbp - 0x22]
movdqu xmmword [rbp - 0x22], xmm0
mov dword [rbp - 0x12], 0x36262c28
mov r8d, ebx
mov byte [rbp - 0xe], 0x45
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x15
jl 0x18006c09b
lea rdx, [rbp - 0x22]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006c0e8
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006c0fe
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006c110
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6b00], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18006c124
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0x2c], 0x41565a45
mov dword [rbp - 0x28], 0x5d75485c
lea r9, [rbp - 0x30]
mov word [rbp - 0x24], 0x5b50
mov r10d, 0x5397829d
mov byte [rbp - 0x22], 0x3f
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18006c15f
movdqa xmm0, xmmword [0x1800064f0]
lea r9, [rbp - 0x21]
movdqu xmmword [rbp - 0x21], xmm0
mov dword [rbp - 0x11], 0x36262c28
mov r8d, ebx
mov byte [rbp - 0xd], 0x45
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x15
jl 0x18006c1a3
lea rdx, [rbp - 0x21]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006c1f0
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006c206
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006c219
or r8d, 0xffffffff
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x68]
mov qword [0x1800e70c0], rax
add rsp, 0x50
pop rbp
ret
sub rsp, 0x28
call fcn.18007f208
call fcn.18007ccc8
call fcn.18007efb4
call fcn.180073e34
call fcn.18007dfa4
call fcn.1800714c4
call fcn.1800724f0
call fcn.18007459c
call fcn.18006d544
call fcn.18007b170
call fcn.18007f018
call fcn.1800658ec
call fcn.1800677a0
call fcn.180075d28
call fcn.180077084
call fcn.18007004c
call fcn.180078078
call fcn.18006d1bc
call fcn.18006c89c
call fcn.180074a1c
call fcn.18006605c
call fcn.18006c9a4
call fcn.18007ca6c
call fcn.180068f40
call fcn.180068bd8
call fcn.18007c960
call fcn.180066350
call fcn.18007e450
call fcn.180064c60
call fcn.180065554
call fcn.18007c718
call fcn.180079bac
add rsp, 0x28
jmp 0x18006c124
Function at 0x18006c234
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x17], 0x5d455c54
mov r8d, ebx
mov dword [rbp - 0x13], 0x55595947
mov dword [rbp - 0xf], 0x3c4f545c
lea r9, [rbp - 0x17]
mov r10d, 0x5397829d
mov r11b, 0x31
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18006c268
mov dword [rbp + 0x10], 0x5d475c74
lea r9, [rbp + 0x10]
mov word [rbp + 0x14], 0x4f41
mov r8d, ebx
mov byte [rbp + 0x16], 0x37
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18006c2a6
mov dword [rbp - 0x20], 0x405c4061
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5e42745a
mov r8d, ebx
mov byte [rbp - 0x18], 0x39
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18006c2e5
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x20]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006c330
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006c346
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006c358
mov r8b, 1
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e63e0], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x18006c550
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x17], 0x51475355
mov r8d, ebx
mov dword [rbp - 0x13], 0x5d5a5f61
mov byte [rbp - 0xf], 0x39
lea r9, [rbp - 0x17]
mov r10d, 0x5397829d
mov r11b, 0x31
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18006c581
mov dword [rbp - 0xe], 0x5d455c74
lea r9, [rbp - 0xe]
mov dword [rbp - 0xa], 0x55595947
mov r8d, ebx
mov dword [rbp - 6], 0x3c4f545c
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18006c5c3
mov dword [rbp - 0x20], 0x405c4061
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5e42745a
mov r8d, ebx
mov byte [rbp - 0x18], 0x39
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18006c602
lea rdx, [rbp - 0xe]
lea rcx, [rbp - 0x20]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006c64d
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006c663
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006c675
mov r8b, 1
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6410], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x18006c7a4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x515a5e52
mov r8d, ebx
mov word [rbp + 0x1c], 0x425b
mov byte [rbp + 0x1e], 0x37
lea r9, [rbp + 0x18]
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18006c7d1
mov dword [rbp - 0x10], 0x515e5376
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x59595778
mov r8d, ebx
mov dword [rbp - 8], 0x3c495f5e
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18006c812
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006c85f
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006c875
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006c887
xor r8d, r8d
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6930], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x18006c89c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x14], 0x55564072
mov r8d, ebx
mov dword [rbp - 0x10], 0x4a675341
mov dword [rbp - 0xc], 0x5e5a5c5c
lea r9, [rbp - 0x14]
mov byte [rbp - 8], 0x3d
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18006c8d1
mov dword [rbp - 0x20], 0x515e5376
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x59595778
mov r8d, ebx
mov dword [rbp - 0x18], 0x3c495f5e
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18006c912
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18006c95f
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18006c975
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18006c98a
mov r8d, 2
lea rdx, [rbp - 0x14]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x58]
mov qword [0x1800e7028], rax
add rsp, 0x40
pop rbp
ret