joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180075b38
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x515d5d53
mov r8d, ebx
mov dword [rbp - 0xc], 0x56564461
mov dword [rbp - 8], 0x4e545c4a
lea r9, [rbp - 0x10]
mov word [rbp - 4], 0x4d50
mov r10d, 0x5397829d
mov byte [rbp - 2], 0x3f
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xf
jl 0x180075b73
mov dword [rbp + 0x18], 0x51575d7c
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x3659
mov r8d, ebx
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x180075bac
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180075bf9
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180075c0f
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180075c21
mov r8b, 1
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6480], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x180075c34
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x18], 0x53525e57
mov r8d, ebx
mov word [rbp + 0x1c], 0x3646
lea r9, [rbp + 0x18]
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x180075c5d
mov dword [rbp - 0x10], 0x51575d7c
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x59436559
mov r8d, ebx
mov word [rbp - 8], 0x5f4d
mov byte [rbp - 6], 0x3b
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180075ca1
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180075cee
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180075d04
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180075d16
mov r8b, 1
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6818], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x180076e90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov dword [rbp - 0x35], 0x43565b47
mov r8d, ebx
mov dword [rbp - 0x31], 0x4b51507a
mov word [rbp - 0x2d], 0x4e5c
lea r9, [rbp - 0x35]
mov byte [rbp - 0x2b], 0x3b
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180076ec3
mov dword [rbp - 0x40], 0x4d525e61
lea r9, [rbp - 0x40]
mov dword [rbp - 0x3c], 0x41724450
mov r8d, ebx
mov word [rbp - 0x38], 0x495c
mov byte [rbp - 0x36], 0x3b
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180076f09
lea rdx, [rbp - 0x40]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
movabs r14, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x180076f62
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180076f73
lea rcx, [rax - 0x10000]
cmp rcx, r14
jbe 0x180076f73
mov rax, rbx
jmp 0x180076f82
mov r8b, 1
lea rdx, [rbp - 0x35]
mov rcx, rax
call fcn.18008f890
movdqa xmm0, xmmword [0x180006480]
lea r9, [rbp - 0x2a]
movdqu xmmword [rbp - 0x2a], xmm0
mov qword [0x1800e6820], rax
mov r8d, ebx
mov dword [rbp - 0x1a], 0x2722001e
mov dword [rbp - 0x16], 0x2f292f2e
mov dword [rbp - 0x12], 0x202e230f
mov word [rbp - 0xe], 0x4e29
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x1e
jl 0x180076fb8
mov dword [rbp - 0x35], 0x4d525e61
lea r9, [rbp - 0x35]
mov dword [rbp - 0x31], 0x41724450
mov r8d, ebx
mov word [rbp - 0x2d], 0x495c
mov byte [rbp - 0x2b], 0x3b
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180076ffe
lea rdx, [rbp - 0x35]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007704d
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180077059
lea rcx, [rax - 0x10000]
cmp rcx, r14
ja 0x18007706b
mov r8b, 1
lea rdx, [rbp - 0x2a]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
lea r11, [rsp + 0x60]
mov qword [0x1800e6828], rbx
mov rbx, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180077b38
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x405d5d52
mov r8d, ebx
mov dword [rbp - 0x1c], 0x5d595f54
mov dword [rbp - 0x18], 0x505e784b
lea r9, [rbp - 0x20]
mov word [rbp - 0x14], 0x3e49
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x180077b6f
movdqa xmm0, xmmword [0x180007fc0]
lea r9, [rbp - 0x12]
movdqu xmmword [rbp - 0x12], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x180077ba8
lea rdx, [rbp - 0x12]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180077bf5
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180077c0b
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180077c1d
mov r8b, 1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e69a8], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x180078078
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0x1c], 0x4879457c
mov word [rbp - 0x18], 0x3a5a
lea r9, [rbp - 0x20]
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x1800780a7
mov dword [rbp - 0x15], 0x4d525e61
lea r9, [rbp - 0x15]
mov dword [rbp - 0x11], 0x577a4450
mov r8d, ebx
mov dword [rbp - 0xd], 0x3c575f5d
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x1800780ea
lea rdx, [rbp - 0x15]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
movabs r14, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x180078143
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180078154
lea rcx, [rax - 0x10000]
cmp rcx, r14
jbe 0x180078154
mov rax, rbx
jmp 0x180078164
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18008fa44
mov rcx, rax
call fcn.18002b270
mov qword [0x1800e6ff8], rax
lea r9, [rbp - 0x20]
mov r8d, ebx
mov dword [rbp - 0x20], 0x41515763
mov dword [rbp - 0x1c], 0x79535a5c
mov word [rbp - 0x18], 0x5655
mov byte [rbp - 0x16], 0x3b
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180078192
mov dword [rbp - 0x15], 0x4d525e61
lea r9, [rbp - 0x15]
mov dword [rbp - 0x11], 0x577a4450
mov r8d, ebx
mov dword [rbp - 0xd], 0x3c575f5d
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x1800781d5
lea rdx, [rbp - 0x15]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180078224
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180078230
lea rcx, [rax - 0x10000]
cmp rcx, r14
ja 0x180078243
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
mov qword [0x1800e7000], rax
add rsp, 0x40
pop rbp
ret
Function at 0x180078264
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x17], 0x46564144
mov r8d, ebx
mov dword [rbp - 0x13], 0x5d5a575b
mov byte [rbp - 0xf], 0x39
lea r9, [rbp - 0x17]
mov r10d, 0x5397829d
mov r11b, 0x31
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x180078295
mov dword [rbp - 0xe], 0x4d525e61
lea r9, [rbp - 0xe]
mov dword [rbp - 0xa], 0x59794450
mov r8d, ebx
mov dword [rbp - 6], 0x78725f54
mov byte [rbp - 2], 0x3d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x1800782db
mov dword [rbp - 0x20], 0x405c4061
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5e42745a
mov r8d, ebx
mov byte [rbp - 0x18], 0x39
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18007831a
lea rdx, [rbp - 0xe]
lea rcx, [rbp - 0x20]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180078365
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007837b
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007838d
mov r8b, 1
lea rdx, [rbp - 0x17]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6430], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x180078718
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp + 0x10], 0x565e575c
mov r8d, ebx
mov dword [rbp + 0x14], 0x38444450
lea r9, [rbp + 0x10]
mov r10d, 0x5397829d
mov r11b, 0x31
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 8
jl 0x180078745
mov dword [rbp - 0x17], 0x4d525e61
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x5d634450
mov r8d, ebx
mov word [rbp - 0xf], 0x5758
mov byte [rbp - 0xd], 0x3b
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x18007878a
mov dword [rbp - 0x20], 0x405c4061
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x5e42745a
mov r8d, ebx
mov byte [rbp - 0x18], 0x39
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x1800787c9
lea rdx, [rbp - 0x17]
lea rcx, [rbp - 0x20]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180078814
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007882a
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007883c
mov r8b, 1
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6418], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x180078850
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x5d405d41
mov r8d, ebx
mov dword [rbp - 0x1c], 0x56585f41
mov byte [rbp - 0x18], 0x39
lea r9, [rbp - 0x20]
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18007887e
mov dword [rbp - 0x17], 0x4d525e61
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x51634450
mov r8d, ebx
mov word [rbp - 0xf], 0x515a
mov byte [rbp - 0xd], 0x3b
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x1800788c2
lea rdx, [rbp - 0x17]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007890f
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180078925
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180078937
mov r8b, 1
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e67f8], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x180079bac
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x515f5765
mov r8d, ebx
mov dword [rbp - 0x1c], 0x4c455945
mov word [rbp - 0x18], 0x556d
lea r9, [rbp - 0x20]
mov byte [rbp - 0x16], 0x3b
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x180079be0
movdqa xmm0, xmmword [0x180006af0]
lea r9, [rbp - 0x15]
movdqu xmmword [rbp - 0x15], xmm0
mov word [rbp - 5], 0x362f
mov r8d, ebx
mov byte [rbp - 3], 0x43
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x13
jl 0x180079c23
lea rdx, [rbp - 0x15]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x180079c70
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x180079c86
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x180079c9b
mov r8d, 2
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x58]
mov qword [0x1800e70b8], rax
add rsp, 0x40
pop rbp
ret
Function at 0x18007b6dc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x27], 0x5e5c4041
mov r8d, ebx
mov dword [rbp - 0x23], 0x51435550
mov dword [rbp - 0x1f], 0x3c485f55
lea r9, [rbp - 0x27]
mov r10d, 0x5397829d
mov r11b, 0x31
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18007b710
movdqa xmm0, xmmword [0x180008030]
lea r9, [rbp - 0x1b]
movdqu xmmword [rbp - 0x1b], xmm0
mov r8d, ebx
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x18007b74a
mov dword [rbp - 0x30], 0x405c4061
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x5e42745a
mov r8d, ebx
mov byte [rbp - 0x28], 0x39
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x18007b789
lea rdx, [rbp - 0x1b]
lea rcx, [rbp - 0x30]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007b7d4
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007b7ea
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007b7fc
mov r8b, 1
lea rdx, [rbp - 0x27]
mov rcx, rax
call fcn.18008f890
mov rbx, rax
mov qword [0x1800e6438], rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x18007c36c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r15
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x1a], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0x16], 0x575b5343
mov dword [rbp - 0x12], 0x454f535a
lea r9, [rbp - 0x1a]
mov byte [rbp - 0xe], 0x3d
mov esi, 0x5397829d
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18007c3aa
mov dword [rbp - 0x30], 0x5d545b63
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x5c585451
mov r8d, ebx
mov word [rbp - 0x28], 0x3a40
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x18007c3e9
mov dword [rbp - 0x26], 0x405a5c64
lea r9, [rbp - 0x26]
mov dword [rbp - 0x22], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x1e], 0x3c5e5450
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18007c429
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x26]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
movabs r15, 0x7ffffffdfffe
cmp rax, rdx
jbe 0x18007c47c
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007c48d
lea rcx, [rax - 0x10000]
cmp rcx, r15
jbe 0x18007c48d
mov rax, rbx
jmp 0x18007c49d
or r8d, 0xffffffff
lea rdx, [rbp - 0x1a]
mov rcx, rax
call fcn.18008fa44
mov rcx, rax
call fcn.18002b270
mov qword [0x1800e6cd0], rax
lea r9, [rbp - 0x1a]
mov r8d, ebx
mov dword [rbp - 0x1a], 0x6b475742
mov dword [rbp - 0x16], 0x575b5343
mov dword [rbp - 0x12], 0x454f535a
mov byte [rbp - 0xe], 0x3d
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18007c4cc
mov dword [rbp - 0x30], 0x5d545b63
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x5c585451
mov r8d, ebx
mov word [rbp - 0x28], 0x3a40
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x18007c50b
mov dword [rbp - 0x26], 0x405a5c64
lea r9, [rbp - 0x26]
mov dword [rbp - 0x22], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 0x1e], 0x3c5e5450
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18007c54b
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x26]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007c594
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007c5a0
lea rcx, [rax - 0x10000]
cmp rcx, r15
ja 0x18007c5b5
mov r8d, 1
lea rdx, [rbp - 0x1a]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x70]
mov qword [0x1800e6cd8], rax
add rsp, 0x50
pop rbp
ret
Function at 0x18007c5dc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp + 0x10], 0x505d5b77
mov r8d, ebx
mov byte [rbp + 0x14], 0x35
lea r9, [rbp + 0x10]
mov r10d, 0x5397829d
mov r11b, 0x31
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x18007c606
mov dword [rbp + 0x18], 0x50525a62
lea r9, [rbp + 0x18]
mov word [rbp + 0x1c], 0x4450
mov r8d, ebx
mov byte [rbp + 0x1e], 0x37
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 7
jl 0x18007c644
mov dword [rbp - 0x10], 0x405a5c64
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x5f59734c
mov r8d, ebx
mov dword [rbp - 8], 0x3c5e5450
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, r11b
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x18007c686
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007c6d1
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007c6e7
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007c6fc
mov r8d, 1
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x50]
mov qword [0x1800e6c18], rax
add rsp, 0x30
pop rbp
ret

Function at 0x18007c718
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x6b475756
mov r8d, ebx
mov dword [rbp - 0x1c], 0x5c595367
mov dword [rbp - 0x18], 0x4e5e485c
lea r9, [rbp - 0x20]
mov word [rbp - 0x14], 0x3e4e
mov r10d, 0x5397829d
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x18007c74f
movdqa xmm0, xmmword [0x180006d70]
lea r9, [rbp - 0x12]
movdqu xmmword [rbp - 0x12], xmm0
mov byte [rbp - 2], 0x41
mov r8d, ebx
mov eax, r10d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0x11
jl 0x18007c78c
lea rdx, [rbp - 0x12]
mov byte [rbp + 0x10], bl
lea rcx, [rbp + 0x10]
call fcn.18008f74c
mov rdx, qword [0x1800e6108]
cmp rax, rdx
jbe 0x18007c7d9
add rdx, qword [0x1800e6110]
cmp rax, rdx
jb 0x18007c7ef
lea rcx, [rax - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rcx, rdx
ja 0x18007c802
or r8d, 0xffffffff
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18008fa44
mov rbx, rax
mov rcx, rbx
call fcn.18002b270
mov rbx, qword [rsp + 0x58]
mov qword [0x1800e70b0], rax
add rsp, 0x40
pop rbp
ret