joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802e68c0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077ce70]
sub eax, dword [0x18077ce74]
sub eax, 0xd16aec1d
sub eax, 0x4c62ee61
sub eax, 0x990136d0
cmp eax, 0x189fffce
jb 0x1802e699c
jmp 0x1802e68eb
mov eax, dword [0x18077ce78]
xor edx, edx
div dword [0x18077ce7c]
xor eax, 0xf365dfb0
imul eax, eax, 0xc17322d7
sub eax, 0x2ec55353
mov r9, r8
xor r9, 0x4957fa8b
add r9, 1
cmp eax, 0xdc884a01
je 0x1802e68eb
jmp 0x1802e6920
mov eax, dword [0x18077ce80]
imul eax, dword [0x18077ce84]
mov r8d, 0x624642f6
xor edx, edx
div r8d
sub eax, 0x527c5902
mov r8d, 0xa793677
xor edx, edx
div r8d
cmp eax, 0xc7041d89
ja 0x1802e69ad
mov eax, dword [0x18077ce88]
imul eax, dword [0x18077ce8c]
mov r8d, 0x5112798e
xor edx, edx
div r8d
xor eax, 0xe40c2f19
or eax, 0x1c406993
mov r8, r9
shr r8, 0x14
xor r8, r9
mov rdx, r8
rol rdx, 5
xor rdx, r8
cmp eax, 0xd1fbacac
je 0x1802e69ad
jmp 0x1802e698e
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
loop 0x1802e6991
invalid
inc dword [rax]
add byte [rax + 1], cl
ror dword [rax - 0x77], 1
enter 0x20c3, 0x72
sub bl, byte [rdx]
push rdi
in al, dx
and byte [rdx + 0x2a], dh
sbb dl, byte [rdi - 0x14]
mov ax, 0x1121
iretd
xchg r15, rax
jne 0x1802e6990
pop rcx
jae 0x1802e69c9
invalid
imul eax, dword [0x18077ce94]
xor eax, 0x8353e140
imul eax, eax, 0x90af46e3
and eax, 0xa61deb8f
cmp eax, 0xb077da24
je 0x1802e6a37
jmp 0x1802e69e9
mov eax, dword [0x18077ce98]
xor edx, edx
div dword [0x18077ce9c]
xor eax, 0x2ae4ceae
and eax, 0x18427b6b
sub eax, 0xd4be7144
mov rdx, r8
xor rdx, 0x7b8cd8d5
imul r9, rdx, 0xffffffff8c0128dc
mov rdx, r9
rol rdx, 1
xor rdx, r9
cmp eax, 0x4a5f9582
je 0x1802e69e9
jmp 0x1802e6a29
and rdx, 0xfffd
add rcx, rdx
mov rax, rcx
ret
fcomp dword [rbx + rdx]
xchg edx, eax
loope 0x1802e6a77
invalid
mov esi, 0x8b587227
add eax, 0x496427

Function at 0x1802e69c0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077ce90]

Function at 0x1802e70c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077cf40]
imul eax, dword [0x18077cf44]
or eax, 0x86b6fba1
mov r9d, 0x76ada280
xor edx, edx
div r9d
sub eax, 0x488d68b6
cmp eax, 0x6f7746ff
je 0x1802e7134
jmp 0x1802e70ee
mov eax, dword [0x18077cf48]
xor edx, edx
div dword [0x18077cf4c]
sub eax, 0xeee40df1
xor eax, 0x27309f72
and eax, 0x7ccacb26
mov rdx, r8
add rdx, 0x4b83dd08
cmp eax, 0x1ab96571
jbe 0x1802e70ee
jmp 0x1802e711e
mov rax, rdx
rol rax, 1
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
jmp 0x1b817500f

Function at 0x1802e71f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077cf60]
imul eax, dword [0x18077cf64]
sub eax, 0xd2c5a890
imul eax, eax, 0xe81f9b99
xor eax, 0x5229beab
cmp eax, 0xb2951ef
je 0x1802e7267
jmp 0x1802e7219
mov eax, dword [0x18077cf68]
xor edx, edx
div dword [0x18077cf6c]
imul eax, eax, 0x67fbb71d
xor eax, 0x75073ca5
imul edx, eax, 0x11c2dd2a
mov rax, r8
xor rax, 0xffffffff9ee30c9c
cmp edx, 0x1bbad0d4
jbe 0x1802e7219
jmp 0x1802e724b
add rax, 1
mov rdx, rax
rol rdx, 2
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
call 0x10418d5f4
sahf
invalid
Function at 0x1802e7a00
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077d050]
add eax, dword [0x18077d054]
mov r9d, 0xddfd7c26
xor edx, edx
div r9d
sub eax, 0x8d138506
and eax, 0x54656887
cmp eax, 0xd7a8a8cb
jae 0x1802e7a86
jmp 0x1802e7a2d
mov eax, dword [0x18077d058]
xor eax, dword [0x18077d05c]
mov r9d, 0x1405376e
xor edx, edx
div r9d
xor eax, 0xe7bf0fc
mov r9d, 0x6023f689
xor edx, edx
div r9d
mov r9, r8
xor r9, 0x7455afc9
add r9, 0xffffffffffcee5db
mov rdx, r9
rol rdx, 7
cmp eax, 0x81d897e0
ja 0x1802e7a2d
jmp 0x1802e7a75
xor rdx, r9
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
rcr dword [rdi], 0x4a
invalid

Function at 0x1802e7a90
Capabilities:
Encode data using xor

Disassembly:
movabs rax, 0x1aa4797847425219
imul rdx, rax
movabs rax, 0x4af838a668450cf
add rdx, rax
mov rax, rdx
rol rax, 1
mov r8d, dword [0x18077d060]
xor r8d, dword [0x18077d064]
sub r8d, 0xfc945b68
imul r8d, r8d, 0x4e7f3dec
and r8d, 0xec7325dc
cmp r8d, 0xbdb5be81
jbe 0x1802e7b7e
jmp 0x1802e7ae3
mov r8d, dword [0x18077d068]
and r8d, dword [0x18077d06c]
or r8d, 0x72018bc8
and r8d, 0xc67d37f0
imul r9d, r8d, 0x2427514e
mov r8, rax
xor r8, rdx
mov r10, r8
rol r10, 4
xor r10, r8
and r10, 0xffff
mov r8, rcx
add r8, r10
cmp r9d, 0x289eadd0
je 0x1802e7ae3
jmp 0x1802e7b2e
mov eax, dword [str.b_y_]
add eax, dword [0x18077d074]
and eax, 0xc163a60f
mov ecx, 0xfa523458
xor edx, edx
div ecx
mov ecx, 0x8f51068f
xor edx, edx
div ecx
cmp eax, 0x56c1151d
je 0x1802e7b8f
mov eax, dword [0x18077d078]
or eax, dword [0x18077d07c]
xor eax, 0x6e5fde82
sub eax, 0xda1e7463
and eax, 0x3a6fb9d4
cmp eax, 0x190ebb20
je 0x1802e7b8f
mov rax, r8
ret
cmp dword [rcx - 0xff01ac], edx
cmpsd dword [rsi], dword [rdi]
xor dword [rbx + 0x42], edi
mov dl, 0x79
jmp 0x1802e7ae1
add bh, byte [rbx + 9]
pop rsi
and eax, 0x39907b89
pop rbx
mov ebp, 0xccbbeb3c
int3

Function at 0x1802e7f70
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077d0e0]
sub eax, dword [0x18077d0e4]
imul eax, eax, 0x76c27cda
imul eax, eax, 0x7dc1f24f
imul eax, eax, 0x8150440a
cmp eax, 0x6449d29c
jbe 0x1802e7ff2
jmp 0x1802e7f9a
mov eax, dword [0x18077d0e8]
or eax, dword [0x18077d0ec]
mov r9d, 0x8c717ae3
xor edx, edx
div r9d
sub eax, 0x92bea663
mov r9d, 0x414c420a
xor edx, edx
div r9d
mov rdx, 0xffffffffbf67c4ce
sub rdx, r8
xor rdx, 0xffffffff80c86a9c
cmp eax, 0xa711391f
jae 0x1802e7f9a
jmp 0x1802e7fdb
mov rax, rdx
rol rax, 2
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
test eax, 0x36d0c47a
fst dword [rax - 0x33631452]
int3
Function at 0x1802e82f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x18077d140]
imul eax, dword [0x18077d144]
imul eax, eax, 0x6f0cd37e
imul eax, eax, 0x5bdaeedd
and eax, 0xfca6cce1
cmp eax, 0x9fdaef89
jae 0x1802e83bf
jmp 0x1802e831b
mov r8d, dword [0x18077d148]
xor r8d, dword [0x18077d14c]
and r8d, 0x6369a9cd
xor r8d, 0x43799e3c
and r8d, 0x57bf5497
mov rax, rdx
rol rax, 5
xor rax, rdx
mov r9d, 0xdd523f9
sub r9, rax
mov rax, r9
rol rax, 6
xor rax, r9
cmp r8d, 0x47c22272
jae 0x1802e831b
jmp 0x1802e8366
and rax, 0xffff
add rcx, rax
mov eax, dword [0x18077d150]
sub eax, dword [0x18077d154]
or eax, 0x8f9e148d
xor eax, 0x39a67d50
or eax, 0x5d448b04
cmp eax, 0x48d8790b
je 0x1802e83d0
jmp 0x1802e8393
mov eax, dword [0x18077d158]
or eax, dword [0x18077d15c]
add eax, 0x491f521f
or eax, 0x5f81ff9f
mov r8d, 0x66a6bf0a
xor edx, edx
div r8d
cmp eax, 0xae98e4d0
jae 0x1802e8393
mov rax, rcx
ret
fldcw word [rdi - 0x3f]
rcl byte [rbp - 0x1279e7cf], 0xd3
invalid
wait
out 0x5f, eax
mov ch, 0xae
jp 0x1802e83d9
xor bl, ch
mov bh, 0xcc
int3

Function at 0x1802e84e0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077d180]
or eax, dword [0x18077d184]
mov r9d, 0x2d90a33a
xor edx, edx
div r9d
and eax, 0x2e2da967
or eax, 0xa4ace473
cmp eax, 0x73dc8882
jbe 0x1802e8561
jmp 0x1802e850d
mov eax, dword [0x18077d188]
xor eax, dword [0x18077d18c]
xor eax, 0x9be1e196
imul eax, eax, 0xeae02da9
mov r9d, 0x85e0e41c
xor edx, edx
div r9d
movabs rdx, 0xa68c940752715ebc
mov r9, r8
imul r9, rdx
mov rdx, r9
rol rdx, 4
cmp eax, 0xcac90afe
je 0x1802e850d
jmp 0x1802e8550
xor rdx, r9
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
cmp esp, dword [rbx + 8]
stc
or ah, byte [rax]
invalid

Function at 0x1802e8900
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x18077d1e0]
imul ecx, dword [0x18077d1e4]
or ecx, 0xc3224bda
xor ecx, 0x1926624d
imul ecx, ecx, 0x448f995d
cmp ecx, 0x7e3947fc
jae 0x1802e8987
jmp 0x1802e892c
mov r8d, dword [0x18077d1e8]
sub r8d, dword [0x18077d1ec]
sub r8d, 0x4e0f1607
or r8d, 0x735708e
sub r8d, 0x5ff05d54
mov rcx, rdx
rol rcx, 7
xor rcx, rdx
xor rcx, 0x287c22a5
cmp r8d, 0xf4207133
ja 0x1802e892c
jmp 0x1802e896b
add rcx, 0xffffffffa65027fc
mov rdx, rcx
rol rdx, 2
xor rdx, rcx
and rdx, 0xffff
add rax, rdx
ret
xchg edx, eax
movabs byte [0xcc99eb7c7f2ab984], al
int3
Function at 0x1802e8a00
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077d1f0]
imul eax, dword [0x18077d1f4]
or eax, 0xfc50d522
imul eax, eax, 0x9f5872d9
and eax, 0xaa9329e9
cmp eax, 0x3835cb32
je 0x1802e8acd
jmp 0x1802e8a2d
mov eax, dword [0x18077d1f8]
or eax, dword [0x18077d1fc]
xor eax, 0xf08610b5
mov r9d, 0x310db349
xor edx, edx
div r9d
or eax, 0x9418dfd2
mov rdx, 0xfffffffff080b031
sub rdx, r8
cmp eax, 0x9153ee5d
je 0x1802e8a2d
jmp 0x1802e8a61
imul rax, rdx, 0xffffffffa73e9062
mov r8, rax
rol r8, 3
xor r8, rax
and r8, 0xffff
mov eax, dword [0x18077d200]
and eax, dword [0x18077d204]
mov r9d, 0x25ce2de3
xor edx, edx
div r9d
add eax, 0x751fb44f
xor eax, 0x8d7cb1c8
cmp eax, 0xb328072e
jbe 0x1802e8ade
mov eax, dword [0x18077d208]
xor eax, dword [0x18077d20c]
add eax, 0x4a5b1433
imul edx, eax, 0x248bbacd
add edx, 0xe3a88c8
mov rax, rcx
add rax, r8
cmp edx, 0x2c8feaf7
ja 0x1802e8ade
ret
invalid
pop rdx
and byte [rsi + rax + 0x52], bl
test eax, 0xd0ebec7
mov bl, 0xaf
jmp 0x1802e8aa1

Function at 0x1802e8b80
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
sub rax, rdx
mov r8, rax
xor r8, 0x14f8fa65
rol r8, 6
xor r8, rax
mov eax, dword [0x18077d220]
add eax, dword [0x18077d224]
mov r9d, 0x6dddefdc
xor edx, edx
div r9d
and eax, 0x7f3c4617
sub eax, 0xbd0441ec
cmp eax, 0x7f1819e0
jae 0x1802e8c05
jmp 0x1802e8bc0
mov eax, dword [0x18077d228]
sub eax, dword [0x18077d22c]
and eax, 0x6f547fd
imul edx, eax, 0xfb821690
and edx, 0xe9c00822
mov rax, r8
xor rax, 0x14028b14
mov r9, rax
rol r9, 1
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xa36d8efc
je 0x1802e8bc0
ret
push rcx
enter 0x43a9, 2
jbe 0x1802e8c38
mov gs, ebx
scasd eax, dword [rdi]
int3
retf 0x148

Function at 0x1802e9800
Capabilities:
Encode data using xor

Disassembly:
imul rdx, rdx, 0x8d28682
add rdx, 0xb8b8699
mov rax, rdx
rol rax, 7
xor rax, rdx
and rax, 0xffff
mov edx, dword [0x18077d340]
or edx, dword [0x18077d344]
sub edx, 0x7dca3e26
imul edx, edx, 0x87fe76d8
imul edx, edx, 0x68c8babd
cmp edx, 0x42208704
jbe 0x1802e98ca
jmp 0x1802e984a
mov edx, dword [0x18077d348]
imul edx, dword [0x18077d34c]
add edx, 0xf98c2c0c
xor edx, 0x162615ed
xor edx, 0xff938fa1
mov r8, rcx
add r8, rax
cmp edx, 0x2d815c10
je 0x1802e984a
jmp 0x1802e9879
mov eax, dword [0x18077d350]
xor edx, edx
div dword [0x18077d354]
mov ecx, 0x88736263
xor edx, edx
div ecx
or eax, 0xb6f31030
and eax, 0xe9fb9c2f
cmp eax, 0xe93203f4
ja 0x1802e98db
jmp 0x1802e98a3
mov eax, dword [0x18077d358]
or eax, dword [0x18077d35c]
add eax, 0x1e240cca
or eax, 0x14825b73
imul eax, eax, 0xb75e067b
cmp eax, 0x41663e00
je 0x1802e98a3
mov rax, r8
ret
cmp eax, 0xa78a42a6
sub byte [rdx], cl
xor byte [rbp - 0x16314eb8], ch
insd dword [rdi], dx
invalid
imul esi, dword [rbp + 0x1e6ac3b2], 0x7b
movabs dword [0xccccccccccccbceb], eax
int3
Function at 0x1802ea490
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077d4a0]
and eax, dword [0x18077d4a4]
or eax, 0xa6a63311
sub eax, 0xd7b078c6
and eax, 0x4367b3d7
cmp eax, 0x5dc965ba
je 0x1802ea509
jmp 0x1802ea4b7
mov eax, dword [0x18077d4a8]
and eax, dword [0x18077d4ac]
mov r9d, 0x1060dab
xor edx, edx
div r9d
and eax, 0x3bfe1c73
or eax, 0xaa87ba
mov r9, r8
add r9, 0xffffffffd5481c73
xor r9, 0xffffffff9bae6d71
mov rdx, r9
rol rdx, 1
cmp eax, 0x19075ff3
jae 0x1802ea4b7
jmp 0x1802ea4f8
xor rdx, r9
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
loop 0x1802ea4fe
invalid
inc dword [rax]
add byte [rax + 1], cl
ror dword [rax - 0x77], 1
enter 0xffffffffffff95c3, 0x51
xchg ebp, eax
push rcx
xchg ebx, eax
adc dword [rsi], esi
adc al, 0xf5
jbe 0x1802ea4fd
movabs byte [0xcccccccccccccccc], al
int3

Function at 0x1802ea560
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xffffffffb3deac16
sub rax, rdx
mov rdx, rax
rol rdx, 1
xor rdx, rax
add rdx, 0xffffffffb4223fad
mov r8, rdx
rol r8, 7
xor r8, rdx
mov eax, dword [0x18077d4b0]
imul eax, dword [0x18077d4b4]
or eax, 0xce378f7d
mov r9d, 0x9ce4d36b
xor edx, edx
div r9d
imul eax, eax, 0x61157d9d
cmp eax, 0xce6a0073
je 0x1802ea649
mov eax, dword [0x18077d4b8]
add eax, dword [0x18077d4bc]
sub eax, 0xd6658c1f
mov r9d, 0x8dd176f
xor edx, edx
div r9d
sub eax, 0x87d7bdd
mov rdx, r8
rol rdx, 7
xor rdx, r8
cmp eax, 0x63bfa2d3
jbe 0x1802ea649
jmp 0x1802ea5e6
mov eax, dword [0x18077d4c0]
xor eax, dword [str.QCh_tr_]
imul eax, eax, 0x4e86bc9d
or eax, 0x5434a3d8
xor eax, 0x7ee96f53
cmp eax, 0xb0ff6483
ja 0x1802ea656
jmp 0x1802ea60b
mov r8d, dword [0x18077d4c8]
imul r8d, dword [0x18077d4cc]
or r8d, 0x726d2f0f
xor r8d, 0xa20fea14
sub r8d, 0xb1d1cdc6
mov r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0x590f5794
je 0x1802ea60b
ret
add ecx, ebx
mov ebp, 0xd4ca8224
shr ecx, 0x5c
invalid
cmp al, 0x22
fimul word [rdx]
invalid

Function at 0x1802ea930
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
movabs rax, 0x2751e4a6d9185a8
imul r8, rax
mov eax, dword [0x18077d510]
add eax, dword [0x18077d514]
mov r9d, 0x4f1f7110
xor edx, edx
div r9d
xor eax, 0x629c9e55
imul eax, eax, 0x79ba2183
cmp eax, 0xee04c9cd
je 0x1802eaa05
jmp 0x1802ea970
mov eax, dword [0x18077d518]
or eax, dword [0x18077d51c]
xor eax, 0xbf810f1d
sub eax, 0x474cc03a
imul eax, eax, 0x5998a055
mov r9, r8
add r9, 0x7090746f
mov rdx, r9
rol rdx, 5
xor rdx, r9
and rdx, 0xffff
cmp eax, 0xf9a556e3
je 0x1802ea970
jmp 0x1802ea9b0
mov eax, dword [0x18077d520]
or eax, dword [0x18077d524]
or eax, 0x5bf8523c
and eax, 0x8edb28fc
sub eax, 0x896f7b1b
cmp eax, 0x9b2a732d
jae 0x1802eaa12
mov r8d, dword [0x18077d528]
add r8d, dword [0x18077d52c]
and r8d, 0xe983b737
add r8d, 0x9c6654fd
and r8d, 0xa477e03b
mov rax, rcx
add rax, rdx
enter 0x148, 0xffffffffffffffd0
cmp r8d, 0x183386d1
je 0x1802eaa12
ret
test eax, 0xe5142b0f
cmp dword [rsi], ebp
loope 0x1802ea9f7
pop rsp
invalid
invalid
Function at 0x1802eab80
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x13ac9c34
sub rax, rdx
xor rax, 0xffffffff82f7dacb
mov rdx, rax
shr rdx, 0x11
mov r8d, dword [0x18077d550]
and r8d, dword [0x18077d554]
add r8d, 0xa608e525
xor r8d, 0x44307883
imul r8d, r8d, 0x3d031b30
cmp r8d, 0x21899554
jbe 0x1802eac66
jmp 0x1802eabc7
mov r9d, dword [0x18077d558]
imul r9d, dword [0x18077d55c]
or r9d, 0x4fc6e3f8
add r9d, 0x85d51a28
add r9d, 0x6c1b0953
mov r10, rdx
xor r10, rax
mov r8, r10
rol r8, 1
xor r8, r10
and r8, 0xffff
cmp r9d, 0x292a3ef5
je 0x1802eabc7
jmp 0x1802eac0c
mov eax, dword [0x18077d560]
xor edx, edx
div dword [0x18077d564]
imul eax, eax, 0x68ff29b3
or eax, 0x5d207184
imul eax, eax, 0x467a0f87
cmp eax, 0x1cf57d00
jb 0x1802eac77
mov eax, dword [0x18077d568]
add eax, dword [0x18077d56c]
mov r9d, 0xcf4f6ddb
xor edx, edx
div r9d
mov edx, eax
or edx, 0xc63cb074
add edx, 0xdc88a341
mov rax, rcx
add rax, r8
cmp edx, 0x8cb24a20
jb 0x1802eac77
ret
cld
outsb dx, byte [rsi]
invalid
sbb eax, 0x5e952014
sbb ecx, dword [rdx + 0x59]
invalid

Function at 0x1802ead50
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
add rdx, 0xffffffff8e3fceea
xor rdx, 0x3bff7b1f
add rdx, 0xffffffffdd353a2d
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
mov ecx, dword [0x18077d580]
add ecx, dword [0x18077d584]
or ecx, 0xb63e7378
add ecx, 0xef317112
add ecx, 0x4a1c2366
cmp ecx, 0x2eaf1e7b
jbe 0x1802eadca
jmp 0x1802eada3
mov ecx, dword [0x18077d588]
and ecx, dword [0x18077d58c]
xor ecx, 0x7b26301b
imul ecx, ecx, 0x3a6846f8
and ecx, 0xa8fa961
cmp ecx, 0x2d8aa075
je 0x1802eada3
ret
in eax, dx
jle 0x1802eaddf
std
jge 0x1802eae1a
sbb bl, byte [rsp + rbp*8]
insb byte [rdi], dx
add esp, dword [rbp - 0x15]
leave
int3
int3
mov eax, dword [0x18077d598]
or eax, dword [0x18077d59c]
jp 0x1802eae43
add byte [r11], cl
add eax, 0x492778
mov r9d, 0x80a0a99
xor edx, edx
div r9d
imul edx, eax, 0xaefce6eb
or edx, 0xd601e881
mov rax, r8
rol rax, 4
mov r9, r8
mov ecx, eax
xor r9, rax
xor r9, 0xffffffffffffffff
mov rax, r9
rol rax, 6
xor rax, r9
and rax, 0xffff
cmp edx, 0x9258c049
jb 0x1802eae18
jmp 0x1802eae66
add rcx, rax
mov rax, rcx
ret

Function at 0x1802eb0f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077d5e0]
and eax, dword [0x18077d5e4]
sub eax, 0x4e8dfb27
imul eax, eax, 0x85a1c7d6
add eax, 0x768ca051
cmp eax, 0x84da0e87
je 0x1802eb181
jmp 0x1802eb118
mov eax, dword [0x18077d5e8]
add eax, dword [0x18077d5ec]
xor eax, 0x20554c26
xor eax, 0x91c19798
mov r9d, 0x2408a89b
xor edx, edx
div r9d
mov rdx, r8
xor rdx, 0x5cf755f6
imul r9, rdx, 0xffffffff957f4381
movabs rdx, 0x3081617f6b547bb9
add r9, rdx
mov rdx, r9
shr rdx, 0x1b
xor rdx, r9
cmp eax, 0xbacbd7d6
jae 0x1802eb118
jmp 0x1802eb16a
mov rax, rdx
rol rax, 5
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
invalid
Function at 0x1802eb190
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077d5f0]
and eax, dword [0x18077d5f4]
and eax, 0x44903cd0
sub eax, 0x10afe0a1
and eax, 0x60d39842
cmp eax, 0x24714b37
je 0x1802eb212
jmp 0x1802eb1b7
mov eax, dword [0x18077d5f8]
imul eax, dword [0x18077d5fc]
mov r9d, 0x91531827
xor edx, edx
div r9d
and eax, 0x7d810faa
mov r9d, 0xd987cb92
xor edx, edx
div r9d
mov rdx, r8
add rdx, 0xffffffffe5fab2bd
cmp eax, 0x4ffcd88f
je 0x1802eb1b7
jmp 0x1802eb1f2
mov r8, rdx
shr r8, 5
xor r8, rdx
mov rax, r8
rol rax, 1
xor rax, r8
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
outsb dx, byte [rsi]
push rbx
loopne 0x1802eb232
xor ecx, dword [rdx]
push rbx
movabs rcx, 0xd0894995eb9556ef
mov r8, rdx
mov eax, dword [0x18077d600]
xor eax, dword [str.IzF]
mov r9d, 0x83fd352f
xor edx, edx
xor eax, 0xd23183fd
div r9d
sub eax, 0x56ac7af7
and eax, 0x264ea81a
cmp eax, 0x4149f2e
jbe 0x1802eb2ba
jmp 0x1802eb24d
mov eax, dword [0x18077d608]
imul eax, dword [0x18077d60c]
mov r9d, 0xa3706897
xor edx, edx
div r9d
imul edx, eax, 0x778a6ad5
xor edx, 0x9ff48691
mov rax, r8
shr rax, 7
xor rax, r8
imul rax, rax, 0xffffffffd39cbc8a
cmp edx, 0x11469696
jb 0x1802eb24d
jmp 0x1802eb28c
movabs rdx, 0x8438ec39c82ecce
add rax, rdx
mov rdx, rax
rol rdx, 3
xor rdx, rax
mov rax, rdx
rol rax, 4
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
invalid

Function at 0x1802eb300
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077d610]
add eax, dword [0x18077d614]
mov r9d, 0xb469d2a5
xor edx, edx
div r9d
mov r9d, 0xa35c6234
xor edx, edx
div r9d
add eax, 0xef48b4c0
cmp eax, 0xb5dcbe06
jb 0x1802eb3e1
jmp 0x1802eb337
mov eax, dword [0x18077d618]
sub eax, dword [0x18077d61c]
or eax, 0x376f311c
add eax, 0x42a9822e
or eax, 0xb45f0af2
mov r9d, 0x24d294e7
sub r9, r8
mov rdx, r9
rol rdx, 6
xor r9, rdx
cmp eax, 0x63029906
je 0x1802eb337
jmp 0x1802eb36e
xor r9, 0xffffffffb766764f
mov r8, r9
rol r8, 2
mov eax, dword [0x18077d620]
xor edx, edx
div dword [0x18077d624]
add eax, 0xfa89da8b
mov r10d, 0x26d543a8
xor edx, edx
div r10d
imul eax, eax, 0xbf183d9a
cmp eax, 0x757697f4
je 0x1802eb3ee
mov edx, dword [0x18077d628]
add edx, dword [0x18077d62c]
or edx, 0x5afc34eb
xor edx, 0x57ccc185
add edx, 0x604cb10f
mov r10, r8
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x334a9995
jae 0x1802eb3ee
ret
scasb al, byte [rdi]
mov ebx, 0x96288b43
adc al, 0x28
jmp 0x1802eb335
cmpsb byte ds:[rsi], byte [rdi]
push rcx
invalid
Function at 0x1802eb5d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077d660]
imul eax, dword [0x18077d664]
mov r9d, 0x6e1364ea
xor edx, edx
div r9d
and eax, 0xae69f68a
mov r9d, 0x2e46daed
xor edx, edx
div r9d
cmp eax, 0x5ff258c2
jae 0x1802eb715
jmp 0x1802eb608
mov eax, dword [0x18077d668]
imul eax, dword [0x18077d66c]
mov r9d, 0xf87655e3
xor edx, edx
div r9d
mov r9d, 0xdc7da620
xor edx, edx
div r9d
add eax, 0xe3482a5b
mov edx, 0x2c8abdfd
sub rdx, r8
mov r10, rdx
rol r10, 7
xor r10, rdx
mov r9, r10
rol r9, 2
xor r9, r10
cmp eax, 0x16c13225
jb 0x1802eb608
jmp 0x1802eb655
mov eax, dword [0x18077d670]
add eax, dword [0x18077d674]
imul eax, eax, 0xd72e2328
and eax, 0x8879f01f
sub eax, 0x9f3fe9f7
cmp eax, 0xa2841190
jb 0x1802eb726
mov eax, dword [0x18077d678]
or eax, dword [0x18077d67c]
xor eax, 0xd6970921
mov r8d, 0x41a87cd3
xor edx, edx
div r8d
imul eax, eax, 0xf3eec675
mov rdx, r9
shr rdx, 6
xor rdx, r9
cmp eax, 0xa535974e
jae 0x1802eb726
jmp 0x1802eb6b1
mov eax, dword [0x18077d680]
add eax, dword [0x18077d684]
xor eax, 0x5c1790a2
sub eax, 0x171f1c4f
and eax, 0x196a8f55
cmp eax, 0x989b6422
je 0x1802eb733
jmp 0x1802eb6d5
mov eax, dword [0x18077d688]
or eax, dword [0x18077d68c]
and eax, 0x86cbfbaf
imul r8d, eax, 0x58b63cfa
and r8d, 0xe3229374
mov r9, rdx
rol r9, 4
xor r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0x686879b1
jb 0x1802eb6d5
ret
mov word [rdx + 0x72], cs
jbe 0x1802eb78c
jmp 0x1c094d714
lodsb al, byte [rsi]
adc al, 0x25
call 0x168ca54ef
jmp 0x1802eb67c
invalid
add byte [r11 + rbp + 0x15], al
invalid

Function at 0x1802ebdb0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0x2e8b0be9
add r8, 0xffffffffdccc6c19
mov r9, r8
rol r9, 4
mov eax, dword [0x18077d750]
xor edx, edx
div dword [0x18077d754]
imul eax, eax, 0x97b32b79
xor eax, 0x59b477d3
mov r10d, 0x966f176e
xor edx, edx
div r10d
cmp eax, 0x5ac6fa5e
je 0x1802ebe30
jmp 0x1802ebdf5
mov eax, dword [0x18077d758]
xor eax, dword [0x18077d75c]
imul edx, eax, 0x49a9078e
xor edx, 0x54be4b0c
or edx, 0xf31201ae
mov rax, r9
xor rax, r8
and rax, 0xffff
cmp edx, 0x6f9ccf07
jb 0x1802ebdf5
jmp 0x1802ebe29
add rcx, rax
mov rax, rcx
ret
or edi, dword [rcx + 0x52]
sbb r12d, dword [rdx - 0x46147c57]
int3

Function at 0x1802ebe60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
shr rcx, 0x1a
mov r8d, dword [0x18077d760]
sub r8d, dword [0x18077d764]
or r8d, 0xec5a6eec
or r8d, 0xa6f83621
or r8d, 0x1fb942c3
cmp r8d, 0x7cd3f9dd
jbe 0x1802ebef7
jmp 0x1802ebe98
mov r8d, dword [0x18077d768]
imul r8d, dword [0x18077d76c]
xor r8d, 0x27d40cb6
imul r9d, r8d, 0x17afdce9
or r9d, 0xa06a03e1
mov r8, rcx
xor r8, rdx
mov r10, 0xffffffff8a8516ac
sub r10, r8
xor r10, 0xffffffffe0688207
add r10, 1
mov r8, r10
rol r8, 7
xor r8, r10
and r8, 0xffff
cmp r9d, 0x6049a39d
jbe 0x1802ebe98
jmp 0x1802ebef3
add rax, r8
ret
or bl, byte [rdx + 0x4b26045c]
invalid