joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180062038
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x17], 0x50595275
mov r8d, ebx
mov dword [rbp - 0x13], 0x5c4c5672
mov dword [rbp - 0xf], 0x5851526e
lea r9, [rbp - 0x17]
mov byte [rbp - 0xb], 0x3e
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18006206d
mov dword [rbp - 0x20], 0x6a707c66
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5c555e62
mov r8d, ebx
mov byte [rbp - 0x18], 0x3a
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x1800620b4
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18006210a
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180062120
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180062132
mov r8b, 1
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c84b8], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x180062144
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x6a405655
mov r8d, ebx
mov dword [rbp - 0x1c], 0x57594542
mov dword [rbp - 0x18], 0x495d5749
lea r9, [rbp - 0x20]
mov word [rbp - 0x14], 0x5b5b
mov r10d, 0x1f7047dd
mov byte [rbp - 0x12], 0x40
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18006217f
movdqa xmm0, xmmword [0x180007ed0]
lea r9, [rbp - 0x11]
movdqu xmmword [rbp - 0x11], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x1800621c1
lea rdx, [rbp - 0x11]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180062217
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18006222d
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180062240
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x58]
mov qword [0x1800c90a8], rax
add rsp, 0x40
pop rbp
ret
Function at 0x180062c8c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x457b405b
mov r8d, ebx
mov word [rbp + 0x1c], 0x5953
mov byte [rbp + 0x1e], 0x38
lea r9, [rbp + 0x18]
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180062cb9
mov dword [rbp - 0x10], 0x5b7d7a67
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x4d565240
mov r8d, ebx
mov dword [rbp - 8], 0x3d454955
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180062d03
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180062d59
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180062d6f
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180062d81
xor r8d, r8d
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c8948], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x180062d94
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x6a405641
mov r8d, ebx
mov dword [rbp - 0x2c], 0x505c5644
mov word [rbp - 0x28], 0x484f
lea r9, [rbp - 0x30]
mov byte [rbp - 0x26], 0x3c
mov r10d, 0x1f7047dd
mov r11b, 0x32
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18004d9bb
movdqa xmm0, xmmword [0x180007f90]
lea r9, [rbp - 0x19]
movdqu xmmword [rbp - 0x19], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18004d9fe
mov dword [rbp - 0x25], 0x415d5d67
lea r9, [rbp - 0x25]
mov dword [rbp - 0x21], 0x5e56724f
mov r8d, ebx
mov dword [rbp - 0x1d], 0x3d595553
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18004da49
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x25]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18004da9d
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x18004dab3
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18004dac8
mov r8d, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x60]
mov qword [0x1800c8dc8], rax
add rsp, 0x50
pop rbp
ret
sub rsp, 0x28
call fcn.180060914
call fcn.180055f44
call fcn.1800602ac
call fcn.1800593ac
call fcn.18004d6fc
call fcn.18006003c
call fcn.180059c48
call fcn.180058358
call fcn.18005f9c0
call fcn.18004dd48
call fcn.18004dea8
call fcn.18004ae70
call fcn.18005fd98
call fcn.18006225c
call fcn.18005f140
call fcn.18004f05c
call fcn.180046534
add rsp, 0x28
jmp 0x18004d984
Function at 0x180062df8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp + 0x18], 0x41475666
mov r8d, ebx
mov byte [rbp + 0x1c], 0x36
lea r9, [rbp + 0x18]
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x180062e1e
mov dword [rbp - 0x20], 0x50405265
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x4f5d7b44
mov r8d, ebx
mov word [rbp - 0x18], 0x575f
mov byte [rbp - 0x16], 0x3c
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180062e6d
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
movabs r14, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x180062ecf
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180062ee0
lea rcx, [rax - 0x10000]
cmp rcx, r14
jbe 0x180062ee0
mov rax, rbx
jmp 0x180062ef2
mov r8d, 4
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.18007344c
mov rcx, rax
call fcn.18002c688
mov qword [0x1800c8e48], rax
lea r9, [rbp - 0x15]
mov r8d, ebx
mov dword [rbp - 0x15], 0x62405675
mov dword [rbp - 0x11], 0x4b5d4357
mov dword [rbp - 0xd], 0x494c5e7e
mov word [rbp - 9], 0x3f56
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x180062f23
mov dword [rbp - 0x20], 0x50405265
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x4f5d7b44
mov r8d, ebx
mov word [rbp - 0x18], 0x575f
mov byte [rbp - 0x16], 0x3c
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180062f72
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180062fca
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180062fd6
lea rcx, [rax - 0x10000]
cmp rcx, r14
ja 0x180062feb
mov r8d, 4
lea rdx, [rbp - 0x15]
mov rcx, rax
call fcn.18007344c
mov rbx, rax
mov rcx, rbx
call fcn.18002c688
mov rbx, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov qword [0x1800c8e50], rax
add rsp, 0x40
pop rbp
ret
Function at 0x180063850
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x16], 0x5e465c65
mov r8d, ebx
mov dword [rbp - 0x12], 0x5a565254
mov dword [rbp - 0xe], 0x4b595752
lea r9, [rbp - 0x16]
mov word [rbp - 0xa], 0x535b
mov r10d, 0x1f7047dd
mov byte [rbp - 8], 0x40
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18006388b
mov dword [rbp - 0x20], 0x5e465c65
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5a565254
mov r8d, ebx
mov word [rbp - 0x18], 0x3b52
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x1800638d4
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x18006392a
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180063940
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180063952
mov r8b, 1
lea rdx, [rbp - 0x16]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c85b8], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x180063964
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x5851475b
mov r8d, ebx
mov byte [rbp + 0x1c], 0x36
lea r9, [rbp + 0x18]
mov r10d, 0x1f7047dd
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x18006398b
mov dword [rbp - 0x10], 0x59465c65
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x5c4c7e52
mov r8d, ebx
mov word [rbp - 8], 0x3b57
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x1800639d4
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180073158
mov rdx, qword [0x1800c8118]
cmp rax, rdx
jbe 0x180063a2a
add rdx, qword [0x1800c8120]
cmp rax, rdx
jb 0x180063a40
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180063a52
mov r8b, 1
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180073298
mov rbx, rax
mov qword [0x1800c85c0], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x180063f60
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
add rcx, qword [0x1800c8488]
call fcn.18002c688
mov r8, rax
mov rax, qword [0x1800c8118]
cmp r8, rax
jbe 0x180063f93
mov rdx, qword [0x1800c8120]
add rdx, rax
cmp r8, rdx
jb 0x180063fad
lea rcx, [r8 - 0x10000]
movabs rax, 0x7ffffffdfffe
cmp rcx, rax
jbe 0x180063fad
xor al, al
jmp 0x180064005
mov dword [rbp - 0x10], 0x5c50567f
lea r10, [rbp - 0x10]
mov dword [rbp - 0xc], 0x6d545655
xor r9d, r9d
mov dword [rbp - 8], 0x3d505455
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x32
xor byte [r10], al
inc r10
cmp r9d, 0xc
jl 0x180063fc9
lea rdx, [rbp - 0x10]
mov rcx, r8
call fcn.180063ed0
add rsp, 0x30
pop rbp
ret

Function at 0x18006400c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
add rcx, qword [0x1800c8488]
call fcn.18002c688
mov rcx, qword [0x1800c8118]
mov rbx, rax
cmp rax, rcx
jbe 0x180064040
add rcx, qword [0x1800c8120]
cmp rax, rcx
jb 0x18006405c
add rax, 0xffffffffffff0000
movabs rcx, 0x7ffffffdfffe
cmp rax, rcx
jbe 0x18006405c
xor al, al
jmp 0x1800641d5
mov dword [rbp - 0x10], 0x5a465b66
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x5c6f5941
xor r8d, r8d
mov dword [rbp - 8], 0x53534b5b
mov byte [rbp - 4], 0x3e
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18006407c
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.180063ed0
test al, al
jne 0x1800641d3
mov dword [rbp - 0x10], 0x50475270
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x5c54527b
xor r8d, r8d
mov word [rbp - 8], 0x3b5f
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x1800640db
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.180063ed0
test al, al
jne 0x1800641d3
mov dword [rbp - 0x10], 0x5e575278
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x5455565e
xor r8d, r8d
mov word [rbp - 8], 0x495f
mov byte [rbp - 6], 0x3c
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18006413e
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.180063ed0
test al, al
jne 0x1800641d3
mov dword [rbp + 0x10], 0x51505262
lea r8, [rbp + 0x10]
mov word [rbp + 0x14], 0x525a
xor ecx, ecx
mov byte [rbp + 0x16], 0x38
mov eax, 0x1f7047dd
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x39
mov al, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8], al
inc r8
cmp ecx, 7
jl 0x180064195
lea rdx, [rbp + 0x10]
mov rcx, rbx
call fcn.180063ed0
test al, al
setne al
jmp 0x1800641d5
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret
Function at 0x18006b5ac
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp byte [0x1800ca100], 0
mov rsi, r9
mov rdi, rdx
je 0x18006b808
movss xmm0, dword [rbp + 0x30]
comiss xmm0, dword [0x1800ca2d0]
jae 0x18006b808
lea rdx, [rbp - 0x40]
lea rcx, [0x1800cd430]
call fcn.18002c1b8
mov rbx, qword [0x1800cd438]
cmp qword [rbp - 0x40], rbx
jne 0x18006b621
mov r8, rsi
lea rdx, [rbp - 0x30]
lea rcx, [0x1800cd430]
call fcn.18002c1b8
cmp qword [rax], rbx
je 0x18006b808
mov dword [rbp - 0x30], 0x46554761
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x5757745e
xor r8d, r8d
mov dword [rbp - 0x28], 0x53555a4e
mov word [rbp - 0x24], 0x4d5b
mov byte [rbp - 0x22], 0x40
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18006b647
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.180063ed0
test al, al
je 0x18006b787
and qword [rbp - 0x10], 0
lea rax, [rbp - 0x38]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x38]
lea rax, [rbp - 0x40]
mov dword [rbp - 0x40], 0x10
xorps xmm0, xmm0
mov qword [rbp - 0x30], rax
lea r8, [rbp - 0x30]
mov dword [rbp - 0x3c], 0x28
mov edx, 2
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
call fcn.180029cb4
mov rbx, qword [rbp - 0x20]
mov rsi, qword [rbp - 0x18]
cmp rbx, rsi
je 0x18006b6fc
mov ecx, dword [rbx]
add rcx, rdi
call fcn.18002c688
mov rdi, rax
test rax, rax
je 0x18006b7b0
add rbx, 4
cmp rbx, rsi
jne 0x18006b6d9
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x18006b739
mov rdx, qword [rbp - 0x10]
mov rax, rbx
sub rdx, rbx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x18006b731
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006b820
mov rcx, rbx
call fcn.1800bf340
mov rcx, qword [0x1800c8118]
cmp rdi, rcx
jbe 0x18006b754
mov rdx, qword [0x1800c8120]
add rdx, rcx
cmp rdi, rdx
jb 0x18006b76e
lea rax, [rdi - 0x10000]
movabs rcx, 0x7ffffffdfffe
cmp rax, rcx
ja 0x18006b808
mov rcx, qword [0x1800c9090]
call fcn.1800c2414
mov rcx, rdi
call rax
test al, al
je 0x18006b808
mov rax, qword [0x1800c7fe0]
cmp rax, qword [0x1800c7fe8]
je 0x18006b7f1
mov rdx, qword [rbp + 0x38]
mov rcx, rax
call fcn.18002d910
add qword [0x1800c7fe0], 0xa0
jmp 0x18006b804
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x18006b7ea
mov rdx, qword [rbp - 0x10]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x18006b7e5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006b820
call fcn.1800bf340
xor edi, edi
jmp 0x18006b739
mov r8, qword [rbp + 0x38]
lea rcx, [0x1800c7fd8]
mov rdx, rax
call fcn.18002a2f0
mov al, 1
jmp 0x18006b80a
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.180089708
int3
Function at 0x18006eed0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rdi, rcx
movaps xmmword [rsp + 0x50], xmm6
mov rcx, qword [0x1800c8470]
movaps xmm6, xmm1
add rcx, rdi
call fcn.18002c688
mov rcx, qword [0x1800c8998]
add rcx, rax
call fcn.18002c688
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180070110
xor r8d, r8d
mov dword [rbp + 0x10], 0x545f5c57
lea r9, [rbp + 0x10]
mov byte [rbp + 0x14], 0x36
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x18006ef29
lea rcx, [rbp + 0x10]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18006ef61
mov rbx, qword [rbp - 0x18]
lea rcx, [rbp - 0x30]
mov rdx, qword [rbp - 0x20]
lea r9, [rbp + 0x10]
cmp rbx, 0xf
mov qword [rsp + 0x20], rax
cmova rcx, qword [rbp - 0x30]
xor r8d, r8d
call fcn.18002aaf4
cmp rax, 0xffffffffffffffff
je 0x18006effb
mov rcx, qword [0x1800c8488]
add rcx, rdi
call fcn.18002c688
mov r8, rax
mov rax, qword [0x1800c8118]
cmp r8, rax
jbe 0x18006efc3
mov rdx, qword [0x1800c8120]
add rdx, rax
cmp r8, rdx
jb 0x18006efd9
lea rcx, [r8 - 0x10000]
movabs rax, 0x7ffffffdfffe
cmp rcx, rax
ja 0x18006eff7
mov rcx, qword [0x1800c8760]
lea rdx, [rbp + 0x10]
add rcx, r8
movss dword [rbp + 0x10], xmm6
mov r8d, 4
call fcn.1800c228c
mov rbx, qword [rbp - 0x18]
cmp rbx, 0xf
jbe 0x18006f02f
mov rcx, qword [rbp - 0x30]
lea rdx, [rbx + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006f02a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006f046
call fcn.1800bf340
movaps xmm6, xmmword [rsp + 0x50]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.180089708
int3
Function at 0x18006f0e8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rsi, rcx
mov r14b, dl
mov rcx, qword [0x1800c8470]
add rcx, rsi
call fcn.18002c688
mov rcx, qword [0x1800c8998]
add rcx, rax
call fcn.18002c688
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180070110
xor r8d, r8d
mov dword [rbp - 0x30], 0x1b435c50
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x49555855
mov dword [rbp - 0x28], 0x59524e55
mov byte [rbp - 0x24], 0x3e
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18006f14d
lea rcx, [rbp - 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18006f185
mov rdi, qword [rbp - 8]
lea rcx, [rbp - 0x20]
mov rbx, qword [rbp - 0x20]
lea r9, [rbp - 0x30]
mov rdx, qword [rbp - 0x10]
cmp rdi, 0xf
mov qword [rsp + 0x20], rax
cmova rcx, rbx
xor r8d, r8d
call fcn.18002aaf4
cmp rax, 0xffffffffffffffff
jne 0x18006f2a5
mov dword [rbp + 0x20], 0x465b4151
lea r9, [rbp + 0x20]
mov word [rbp + 0x24], 0x3745
xor r8d, r8d
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x18006f1d5
lea rcx, [rbp + 0x20]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18006f20d
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 0x20]
cmp rdi, 0xf
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
cmova rcx, rbx
xor r8d, r8d
call fcn.18002aaf4
cmp rax, 0xffffffffffffffff
jne 0x18006f2a5
mov rcx, qword [0x1800c8488]
add rcx, rsi
call fcn.18002c688
mov r9, rax
mov rax, qword [0x1800c8118]
cmp r9, rax
jbe 0x18006f26a
mov rdx, qword [0x1800c8120]
add rdx, rax
cmp r9, rdx
jb 0x18006f280
lea rcx, [r9 - 0x10000]
movabs rax, 0x7ffffffdfffe
cmp rcx, rax
ja 0x18006f29d
mov rcx, qword [0x1800c86e0]
lea rdx, [rbp + 0x20]
add rcx, r9
mov byte [rbp + 0x20], r14b
mov r8d, 1
call fcn.1800c228c
mov rbx, qword [rbp - 0x20]
mov rdi, qword [rbp - 8]
cmp rdi, 0xf
jbe 0x18006f2d8
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18006f2d0
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006f2ed
mov rcx, rbx
call fcn.1800bf340
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.180089708
int3
Function at 0x18006f488
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rdi, rcx
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [0x1800c8470]
movaps xmm6, xmm1
add rcx, rdi
call fcn.18002c688
mov rcx, qword [0x1800c8998]
add rcx, rax
call fcn.18002c688
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180070110
xor r8d, r8d
mov dword [rbp - 0x40], 0x1b435c50
lea r9, [rbp - 0x40]
mov dword [rbp - 0x3c], 0x49555855
mov dword [rbp - 0x38], 0x59524e55
mov byte [rbp - 0x34], 0x3e
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18006f4ef
lea rcx, [rbp - 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18006f527
mov rbx, qword [rbp - 0x18]
lea rcx, [rbp - 0x30]
mov rdx, qword [rbp - 0x20]
lea r9, [rbp - 0x40]
cmp rbx, 0xf
mov qword [rsp + 0x20], rax
cmova rcx, qword [rbp - 0x30]
xor r8d, r8d
call fcn.18002aaf4
cmp rax, 0xffffffffffffffff
je 0x18006f5c1
mov rcx, qword [0x1800c8488]
add rcx, rdi
call fcn.18002c688
mov r8, rax
mov rax, qword [0x1800c8118]
cmp r8, rax
jbe 0x18006f589
mov rdx, qword [0x1800c8120]
add rdx, rax
cmp r8, rdx
jb 0x18006f59f
lea rcx, [r8 - 0x10000]
movabs rax, 0x7ffffffdfffe
cmp rcx, rax
ja 0x18006f5bd
mov rcx, qword [0x1800c87d0]
lea rdx, [rbp + 0x10]
add rcx, r8
movss dword [rbp + 0x10], xmm6
mov r8d, 4
call fcn.1800c228c
mov rbx, qword [rbp - 0x18]
cmp rbx, 0xf
jbe 0x18006f5f5
mov rcx, qword [rbp - 0x30]
lea rdx, [rbx + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006f5f0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006f60c
call fcn.1800bf340
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.180089708
int3