joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180084888
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x180006b40]
lea r9, [rbp - 0x1b]
xor ebx, ebx
mov word [rbp - 0xb], 0x4233
movdqu xmmword [rbp - 0x1b], xmm0
mov r8d, ebx
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x1800848b6
movdqa xmm0, xmmword [0x180007470]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x20], 0x4232
mov r8d, ebx
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x180084900
lea rdx, [rbp - 0x30]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
movabs rdi, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x180084962
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180084973
lea rcx, [rax - 0x10000]
cmp rcx, rdi
jbe 0x180084973
mov rax, rbx
jmp 0x180084982
mov r8b, 1
lea rdx, [rbp - 0x1b]
mov rcx, rax
call fcn.180096f64
movdqa xmm0, xmmword [0x1800072c0]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov qword [0x1800ed9f8], rax
mov r8d, ebx
mov dword [rbp - 0x20], 0x36262b2d
mov byte [rbp - 0x1c], 0x45
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x15
jl 0x1800849a8
movdqa xmm0, xmmword [0x180007470]
lea r9, [rbp - 0x1b]
movdqu xmmword [rbp - 0x1b], xmm0
mov word [rbp - 0xb], 0x4232
mov r8d, ebx
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x1800849f2
lea rdx, [rbp - 0x1b]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180084a4a
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180084a56
lea rcx, [rax - 0x10000]
cmp rcx, rdi
ja 0x180084a68
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov rdi, qword [rsp + 0x70]
mov qword [0x1800eda00], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180084a80
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x5c545b7d
mov r8d, ebx
mov dword [rbp - 0x2c], 0x4c597f41
mov dword [rbp - 0x28], 0x5548545c
lea r9, [rbp - 0x30]
mov word [rbp - 0x24], 0x4749
mov byte [rbp - 0x22], 0x3f
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x180084aba
movdqa xmm0, xmmword [0x1800077f0]
lea r9, [rbp - 0x1e]
movdqu xmmword [rbp - 0x1e], xmm0
mov dword [rbp - 0xe], 0x44303024
mov r8d, ebx
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x180084b05
lea rdx, [rbp - 0x1e]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
movabs rdi, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x180084b67
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180084b78
lea rcx, [rax - 0x10000]
cmp rcx, rdi
jbe 0x180084b78
mov rax, rbx
jmp 0x180084b87
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180096f64
movdqa xmm0, xmmword [0x180006b40]
lea r9, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov qword [0x1800eda40], rax
mov r8d, ebx
mov word [rbp - 0x20], 0x4233
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x180084ba8
movdqa xmm0, xmmword [0x1800077f0]
lea r9, [rbp - 0x1e]
movdqu xmmword [rbp - 0x1e], xmm0
mov dword [rbp - 0xe], 0x44303024
mov r8d, ebx
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x180084bf3
lea rdx, [rbp - 0x1e]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180084c4b
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180084c57
lea rcx, [rax - 0x10000]
cmp rcx, rdi
ja 0x180084c69
mov r8b, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov rdi, qword [rsp + 0x70]
mov qword [0x1800eda48], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180084ff4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0xc], 0x4c44587c
mov dword [rbp - 8], 0x59585458
lea r9, [rbp - 0x10]
mov byte [rbp - 4], 0x3d
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x180085029
mov dword [rbp + 0x18], 0x6b777d65
lea r9, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x384e5d66
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x18008506c
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x1800850c2
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x1800850d8
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800850eb
or r8d, 0xffffffff
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x50]
mov qword [0x1800eddc8], rax
add rsp, 0x30
pop rbp
ret
Function at 0x1800853f4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x17], 0x515e5376
mov r8d, ebx
mov dword [rbp - 0x13], 0x5d435771
mov dword [rbp - 0xf], 0x5956536d
lea r9, [rbp - 0x17]
mov byte [rbp - 0xb], 0x3d
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x180085429
mov dword [rbp - 0x20], 0x6b777d65
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5d5a5f61
mov r8d, ebx
mov byte [rbp - 0x18], 0x39
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x180085470
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x1800854c6
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x1800854dc
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800854ee
mov r8b, 1
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed4a8], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x180085500
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0x1c], 0x56564441
mov dword [rbp - 0x18], 0x485a564a
lea r9, [rbp - 0x20]
mov word [rbp - 0x14], 0x5a58
mov r10d, 0x2f684bdb
mov byte [rbp - 0x12], 0x3f
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18008553b
movdqa xmm0, xmmword [0x1800080e0]
lea r9, [rbp - 0x11]
movdqu xmmword [rbp - 0x11], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18008557d
lea rdx, [rbp - 0x11]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x1800855d3
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x1800855e9
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x1800855fc
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x58]
mov qword [0x1800ee098], rax
add rsp, 0x40
pop rbp
ret
Function at 0x180086048
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x447c4158
mov r8d, ebx
mov word [rbp + 0x1c], 0x5850
mov byte [rbp + 0x1e], 0x37
lea r9, [rbp + 0x18]
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x180086075
mov dword [rbp - 0x10], 0x5a7a7b64
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x4c595343
mov r8d, ebx
mov dword [rbp - 8], 0x3c424856
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x1800860bf
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180086115
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18008612b
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18008613d
xor r8d, r8d
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed938], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x180086150
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x30], 0x6b475742
mov r8d, ebx
mov dword [rbp - 0x2c], 0x51535747
mov word [rbp - 0x28], 0x494c
lea r9, [rbp - 0x30]
mov byte [rbp - 0x26], 0x3b
mov r10d, 0x2f684bdb
mov r11b, 0x31
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180070d7b
movdqa xmm0, xmmword [0x180008070]
lea r9, [rbp - 0x19]
movdqu xmmword [rbp - 0x19], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x180070dbe
mov dword [rbp - 0x25], 0x405a5c64
lea r9, [rbp - 0x25]
mov dword [rbp - 0x21], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x1d], 0x3c5e5450
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x180070e09
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x25]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180070e5d
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180070e73
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180070e88
mov r8d, 1
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x60]
mov qword [0x1800eddb8], rax
add rsp, 0x50
pop rbp
ret
sub rsp, 0x28
call fcn.180083cc8
call fcn.180079304
call fcn.180083660
call fcn.18007c760
call fcn.180070abc
call fcn.1800833f0
call fcn.18007cffc
call fcn.18007b70c
call fcn.180082d74
call fcn.180071108
call fcn.180071268
call fcn.18006e1f8
call fcn.18008314c
call fcn.180085618
call fcn.1800824f4
call fcn.18007241c
call fcn.1800698a4
add rsp, 0x28
jmp 0x180070d44
Function at 0x1800861b4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp + 0x18], 0x40405765
mov r8d, ebx
mov byte [rbp + 0x1c], 0x35
lea r9, [rbp + 0x18]
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x1800861da
mov dword [rbp - 0x20], 0x51475366
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x4e527a47
mov r8d, ebx
mov word [rbp - 0x18], 0x565c
mov byte [rbp - 0x16], 0x3b
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180086229
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
movabs r14, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18008628b
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x18008629c
lea rcx, [rax - 0x10000]
cmp rcx, r14
jbe 0x18008629c
mov rax, rbx
jmp 0x1800862ae
mov r8d, 4
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180097118
mov rcx, rax
call fcn.18002c680
mov qword [0x1800ede38], rax
lea r9, [rbp - 0x15]
mov r8d, ebx
mov dword [rbp - 0x15], 0x63475776
mov dword [rbp - 0x11], 0x4a524254
mov dword [rbp - 0xd], 0x484b5f7d
mov word [rbp - 9], 0x3e55
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x1800862df
mov dword [rbp - 0x20], 0x51475366
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x4e527a47
mov r8d, ebx
mov word [rbp - 0x18], 0x565c
mov byte [rbp - 0x16], 0x3b
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18008632e
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180086386
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180086392
lea rcx, [rax - 0x10000]
cmp rcx, r14
ja 0x1800863a7
mov r8d, 4
lea rdx, [rbp - 0x15]
mov rcx, rax
call fcn.180097118
mov rbx, rax
mov rcx, rbx
call fcn.18002c680
mov rbx, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov qword [0x1800ede40], rax
add rsp, 0x40
pop rbp
ret
Function at 0x180086c0c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x16], 0x5f415d66
mov r8d, ebx
mov dword [rbp - 0x12], 0x5b595357
mov dword [rbp - 0xe], 0x4a5e5651
lea r9, [rbp - 0x16]
mov word [rbp - 0xa], 0x5258
mov r10d, 0x2f684bdb
mov byte [rbp - 8], 0x3f
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x180086c47
mov dword [rbp - 0x20], 0x5f415d66
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5b595357
mov r8d, ebx
mov word [rbp - 0x18], 0x3a51
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x180086c90
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180086ce6
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180086cfc
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180086d0e
mov r8b, 1
lea rdx, [rbp - 0x16]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed5a8], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x180086d20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x59564658
mov r8d, ebx
mov byte [rbp + 0x1c], 0x35
lea r9, [rbp + 0x18]
mov r10d, 0x2f684bdb
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x180086d47
mov dword [rbp - 0x10], 0x58415d66
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x5d437f51
mov r8d, ebx
mov word [rbp - 8], 0x3a54
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x180086d90
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.180096e20
mov rdx, qword [0x1800ed108]
cmp rax, rdx
jbe 0x180086de6
add rdx, qword [0x1800ed110]
cmp rax, rdx
jb 0x180086dfc
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180086e0e
mov r8b, 1
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.180096f64
mov rbx, rax
mov qword [0x1800ed5b0], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x180087318
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
add rcx, qword [0x1800ed478]
call fcn.18002c680
mov r8, rax
mov rax, qword [0x1800ed108]
cmp r8, rax
jbe 0x18008734b
mov rdx, qword [0x1800ed110]
add rdx, rax
cmp r8, rdx
jb 0x180087365
lea rcx, [r8 - 0x10000]
movabs rax, 0x7ffffffdfffe
cmp rcx, rax
jbe 0x180087365
xor al, al
jmp 0x1800873bd
mov dword [rbp - 0x10], 0x5d57577c
lea r10, [rbp - 0x10]
mov dword [rbp - 0xc], 0x6c5b5756
xor r9d, r9d
mov dword [rbp - 8], 0x3c575556
mov eax, 0x2f684bdb
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r9b
inc r9d
sub al, cl
add al, 0x31
xor byte [r10], al
inc r10
cmp r9d, 0xc
jl 0x180087381
lea rdx, [rbp - 0x10]
mov rcx, r8
call fcn.180087288
add rsp, 0x30
pop rbp
ret

Function at 0x1800873c4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
add rcx, qword [0x1800ed478]
call fcn.18002c680
mov rcx, qword [0x1800ed108]
mov rbx, rax
cmp rax, rcx
jbe 0x1800873f8
add rcx, qword [0x1800ed110]
cmp rax, rcx
jb 0x180087414
add rax, 0xffffffffffff0000
movabs rcx, 0x7ffffffdfffe
cmp rax, rcx
jbe 0x180087414
xor al, al
jmp 0x18008758d
mov dword [rbp - 0x10], 0x5b415a65
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x5d605842
xor r8d, r8d
mov dword [rbp - 8], 0x52544a58
mov byte [rbp - 4], 0x3d
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x180087434
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.180087288
test al, al
jne 0x18008758b
mov dword [rbp - 0x10], 0x51405373
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x5d5b5378
xor r8d, r8d
mov word [rbp - 8], 0x3a5c
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x180087493
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.180087288
test al, al
jne 0x18008758b
mov dword [rbp - 0x10], 0x5f50537b
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x555a575d
xor r8d, r8d
mov word [rbp - 8], 0x485c
mov byte [rbp - 6], 0x3b
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x1800874f6
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.180087288
test al, al
jne 0x18008758b
mov dword [rbp + 0x10], 0x50575361
lea r8, [rbp + 0x10]
mov word [rbp + 0x14], 0x5359
xor ecx, ecx
mov byte [rbp + 0x16], 0x37
mov eax, 0x2f684bdb
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x36
mov al, cl
inc ecx
sub al, dl
add al, 0x31
xor byte [r8], al
inc r8
cmp ecx, 7
jl 0x18008754d
lea rdx, [rbp + 0x10]
mov rcx, rbx
call fcn.180087288
test al, al
setne al
jmp 0x18008758d
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret
Function at 0x18008ed48
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp byte [0x1800ef0f0], 0
mov rsi, r9
mov rdi, rdx
je 0x18008efa4
movss xmm0, dword [rbp + 0x30]
comiss xmm0, dword [0x1800ef2c0]
jae 0x18008efa4
lea rdx, [rbp - 0x40]
lea rcx, [0x1800f2420]
call fcn.18002c1b0
mov rbx, qword [0x1800f2428]
cmp qword [rbp - 0x40], rbx
jne 0x18008edbd
mov r8, rsi
lea rdx, [rbp - 0x30]
lea rcx, [0x1800f2420]
call fcn.18002c1b0
cmp qword [rax], rbx
je 0x18008efa4
mov dword [rbp - 0x30], 0x47524662
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x5658755d
xor r8d, r8d
mov dword [rbp - 0x28], 0x52525b4d
mov word [rbp - 0x24], 0x4c58
mov byte [rbp - 0x22], 0x3f
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x18008ede3
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.180087288
test al, al
je 0x18008ef23
and qword [rbp - 0x10], 0
lea rax, [rbp - 0x38]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x38]
lea rax, [rbp - 0x40]
mov dword [rbp - 0x40], 0x10
xorps xmm0, xmm0
mov qword [rbp - 0x30], rax
lea r8, [rbp - 0x30]
mov dword [rbp - 0x3c], 0x28
mov edx, 2
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
call fcn.180029d90
mov rbx, qword [rbp - 0x20]
mov rsi, qword [rbp - 0x18]
cmp rbx, rsi
je 0x18008ee98
mov ecx, dword [rbx]
add rcx, rdi
call fcn.18002c680
mov rdi, rax
test rax, rax
je 0x18008ef4c
add rbx, 4
cmp rbx, rsi
jne 0x18008ee75
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x18008eed5
mov rdx, qword [rbp - 0x10]
mov rax, rbx
sub rdx, rbx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x18008eecd
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008efbc
mov rcx, rbx
call fcn.1800e423c
mov rcx, qword [0x1800ed108]
cmp rdi, rcx
jbe 0x18008eef0
mov rdx, qword [0x1800ed110]
add rdx, rcx
cmp rdi, rdx
jb 0x18008ef0a
lea rax, [rdi - 0x10000]
movabs rcx, 0x7ffffffdfffe
cmp rax, rcx
ja 0x18008efa4
mov rcx, qword [0x1800ee080]
call fcn.1800e73b4
mov rcx, rdi
call rax
test al, al
je 0x18008efa4
mov rax, qword [0x1800ecfd0]
cmp rax, qword [0x1800ecfd8]
je 0x18008ef8d
mov rdx, qword [rbp + 0x38]
mov rcx, rax
call fcn.18002d8f8
add qword [0x1800ecfd0], 0xa0
jmp 0x18008efa0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x18008ef86
mov rdx, qword [rbp - 0x10]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x18008ef81
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008efbc
call fcn.1800e423c
xor edi, edi
jmp 0x18008eed5
mov r8, qword [rbp + 0x38]
lea rcx, [0x1800ecfc8]
mov rdx, rax
call fcn.18002a3b4
mov al, 1
jmp 0x18008efa6
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1800ad4f0
int3