joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802ed660
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077d9b0]
imul eax, dword [0x18077d9b4]
mov r9d, 0x883cadaf
xor edx, edx
div r9d
mov r9d, 0x75ef846c
xor edx, edx
div r9d
sub eax, 0x35b53fe5
cmp eax, 0xc2b2fae9
jbe 0x1802ed6e5
jmp 0x1802ed694
mov eax, dword [0x18077d9b8]
and eax, dword [0x18077d9bc]
sub eax, 0x9535e406
sub eax, 0x57d835ee
mov r9d, 0x9143727c
xor edx, edx
div r9d
mov rdx, r8
add rdx, 0xffffffffafdc5b75
xor rdx, 0xffffffffe6fb804a
cmp eax, 0x50f8572
ja 0x1802ed694
jmp 0x1802ed6cf
mov rax, rdx
rol rax, 1
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
sub esi, edi
imul edi, dword [rsi], 0x38c9fa74
jmp 0x1802ed692

Function at 0x1802ed980
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077da00]
add eax, dword [0x18077da04]
add eax, 0x4a05cfd6
add eax, 0xa9b0ffeb
and eax, 0x6cb48958
cmp eax, 0x1c7fc446
je 0x1802eda52
mov eax, dword [0x18077da08]
and eax, dword [0x18077da0c]
mov r9d, 0xd254dac
xor edx, edx
div r9d
xor eax, 0x6b20d4bb
add eax, 0xd84c673
mov rdx, r8
xor rdx, 0xffffffffffffffff
imul r9, rdx, 0x22199342
xor r9, 0xffffffffebdc9937
mov rdx, r9
rol rdx, 6
xor rdx, r9
and rdx, 0xffff
cmp eax, 0x1bb90eee
jb 0x1802eda52
jmp 0x1802ed9f9
add rcx, rdx
mov eax, dword [0x18077da10]
or eax, dword [0x18077da14]
mov r8d, 0x8f58022b
xor edx, edx
div r8d
add eax, 0xdf0889f
xor eax, 0xf1e06ac2
cmp eax, 0xe925cd84
jbe 0x1802eda63
jmp 0x1802eda26
mov eax, dword [0x18077da18]
or eax, dword [0x18077da1c]
add eax, 0x25c01ac7
xor eax, 0xff935bd8
mov r8d, 0x8f2e88d0
xor edx, edx
div r8d
cmp eax, 0xaf412b4c
jae 0x1802eda26
mov rax, rcx
ret
fucompp
xchg ecx, eax
out dx, eax
mov ebx, 0xe9b33d19
invalid
test dword [rbp + riz*4 + 0x78], eax
cmp byte [rdi - 0x19124b64], 0x84
invalid

Function at 0x1802edf90
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077daa0]
xor eax, dword [0x18077daa4]
xor eax, 0xa4649120
and eax, 0x3f174e6a
add eax, 0x84643ebb
cmp eax, 0x537ea386
je 0x1802ee069
mov eax, dword [0x18077daa8]
xor edx, edx
div dword [0x18077daac]
or eax, 0xf2371144
add eax, 0xbc23d56
sub eax, 0x6b64e08a
imul r9, r8, 0xfffffffff0b44112
movabs rdx, 0x51e70b6cbd7aaa3
add r9, rdx
mov r10, r9
rol r10, 1
cmp eax, 0x482d5641
jb 0x1802ee069
jmp 0x1802edff9
mov eax, dword [0x18077dab0]
xor eax, dword [0x18077dab4]
mov r8d, 0xa9a4934c
xor edx, edx
div r8d
mov r8d, 0x5e8cc9f
xor edx, edx
div r8d
and eax, 0x9128c071
cmp eax, 0x944f3d80
jae 0x1802ee076
jmp 0x1802ee029
mov eax, dword [0x18077dab8]
xor edx, edx
div dword [0x18077dabc]
and eax, 0x70eadee6
xor eax, 0x15122a1
mov r8d, 0xf9c36607
xor edx, edx
div r8d
mov rdx, r10
xor rdx, r9
and rdx, 0xffff
cmp eax, 0x878100c1
ja 0x1802ee029
jmp 0x1802ee062
add rcx, rdx
mov rax, rcx
ret
sbb dword [rbp - 0x13548fd3], esi
in eax, dx
or cl, ch
invalid
out 0xd, eax
push rsi
mov fs, word [rdi + rcx*2 - 0x58145d57]
Function at 0x1802ee3e0
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffff9a3275ef
add rdx, 1
mov rax, rdx
rol rax, 3
xor rax, rdx
xor r8d, r8d
sub r8, rax
mov r9, r8
rol r9, 4
mov eax, dword [0x18077db10]
xor edx, edx
div dword [0x18077db14]
add eax, 0x34532d39
mov r10d, 0x9ac3b991
xor edx, edx
div r10d
sub eax, 0xbe11de9a
cmp eax, 0xc30d8c32
ja 0x1802ee46c
jmp 0x1802ee42e
mov eax, dword [0x18077db18]
xor eax, dword [0x18077db1c]
add eax, 0xdc9acab0
and eax, 0x5607af65
mov r10d, 0x3fad7992
xor edx, edx
div r10d
mov rdx, r9
xor rdx, r8
cmp eax, 0x8e4d75e5
je 0x1802ee42e
jmp 0x1802ee45e
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
je 0x1802ee4c5
stc
cmp al, r9b
pop rax
enter 0xffffffffffffb3da, 0xfffffffffffffff0
invalid
jmp 0x1802ee4bb
mov eax, dword [0x18077db28]
sub eax, dword [0x18077db2c]
add eax, 0x4654a515
add byte [0x1c68389e1], al
imul eax, eax, 0x72753002
add eax, 0x7f7c467b
mov r9, r10
xor r9, r8
cmp eax, 0x3758efa1
jbe 0x1802ee4bb
jmp 0x1802ee4e6
mov eax, dword [0x18077db30]
add eax, dword [0x18077db34]
mov r8d, 0x208b680e
xor edx, edx
div r8d
or eax, 0xed9dc1
sub eax, 0x7799504b
cmp eax, 0x4dd36579
jbe 0x1802ee55b
jmp 0x1802ee510
mov edx, dword [0x18077db38]
imul edx, dword [0x18077db3c]
or edx, 0x568af06b
or edx, 0x1ad0439
and edx, 0x65c8292e
mov r8, r9
rol r8, 1
xor r8, r9
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0xf7a075c3
jae 0x1802ee510
ret
push rdx
xor cl, byte [rbp + rsi - 0x134e706]
jmp 0x1802ee4b9
xchg ebx, eax
jrcxz 0x1802ee54e
add eax, dword [rdx - 0x79]
xchg ebp, eax
jrcxz 0x1802ee54f
test eax, 0xcccccccc
int3

Function at 0x1802ee480
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
add r8, 0xffffffffe3d3942f
mov r10, r8
rol r10, 3
mov eax, dword [0x18077db20]
xor edx, edx
div dword [0x18077db24]
sub eax, 0x66e29c7f
add eax, 0xbe4e89ef
add eax, 0x798a758f
cmp eax, 0xe32ef038
ja 0x1802ee54e

Function at 0x1802ee700
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x18077db70]
xor ecx, dword [0x18077db74]
sub ecx, 0xb473d21d
imul ecx, ecx, 0xc1d8b5aa
or ecx, 0x5c5e82ec
cmp ecx, 0xe3e68a46
je 0x1802ee7d1
mov ecx, dword [0x18077db78]
add ecx, dword [0x18077db7c]
add ecx, 0x5b5aee06
add ecx, 0x8b945d1b
imul r9d, ecx, 0xa843005b
imul rcx, rdx, 0xffffffff80c0207f
add rcx, 0xffffffff850b0104
mov r8, rcx
rol r8, 6
cmp r9d, 0x2a85c09f
jb 0x1802ee7d1
jmp 0x1802ee76c
mov edx, dword [0x18077db80]
xor edx, dword [0x18077db84]
add edx, 0x36c2435a
add edx, 0xc1bf7088
or edx, 0x6bee7c2c
cmp edx, 0xfb420235
je 0x1802ee7de
jmp 0x1802ee794
mov edx, dword [0x18077db88]
sub edx, dword [0x18077db8c]
imul r9d, edx, 0x21478427
sub r9d, 0x34aae321
sub r9d, 0xd7dae663
mov rdx, r8
xor rdx, rcx
cmp r9d, 0xd36dd2a3
ja 0x1802ee794
jmp 0x1802ee7c6
and rdx, 0xffff
add rax, rdx
ret
pushfq
pop rcx
xchg ebx, eax
insb byte [rdi], dx
insd dword [rdi], dx
rcl eax, 0x48
jmp 0x1802ee72d
bts esp, ecx
cdq
adc ebp, dword [rsi + rcx]
or bh, dl
int 0xc9
outsd dx, dword [rsi]
jmp 0x1802ee792
Function at 0x1802eee20
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077dc40]
xor edx, edx
div dword [0x18077dc44]
or eax, 0xf732ad55
mov r9d, 0xc4a76089
xor edx, edx
div r9d
and eax, 0xb257616
cmp eax, 0x17977c4f
jae 0x1802eef5a
mov eax, dword [0x18077dc48]
xor eax, dword [0x18077dc4c]
or eax, 0x68cb87a0
or eax, 0xf61cac9d
or eax, 0x3ddadfe5
mov r9, r8
xor r9, 0x1448ca16
mov r10, r9
shr r10, 0x14
cmp eax, 0x59fb4e5e
je 0x1802eef5a
jmp 0x1802eee8a
mov eax, dword [0x18077dc50]
imul eax, dword [0x18077dc54]
xor eax, 0xdee4143
mov r8d, 0x1ed12536
xor edx, edx
div r8d
and eax, 0x108ccc66
cmp eax, 0x1b43e5d0
ja 0x1802eef6b
jmp 0x1802eeeb9
mov eax, dword [0x18077dc58]
xor eax, dword [str.G_fB_]
sub eax, 0x30738dc6
imul eax, eax, 0xe3b39ab6
and eax, 0xd93c98a2
mov rdx, r10
xor rdx, r9
mov r11, 0xfffffffff48cc9bd
sub r11, rdx
mov r8, r11
rol r8, 4
xor r8, r11
cmp eax, 0xab6a2c25
ja 0x1802eeeb9
jmp 0x1802eeef8
mov eax, dword [0x18077dc60]
xor edx, edx
div dword [0x18077dc64]
imul eax, eax, 0x59b0870b
xor eax, 0x4f8eb7b1
imul eax, eax, 0xbe7b3025
cmp eax, 0x25b509d6
jb 0x1802eef7c
mov eax, dword [0x18077dc68]
xor eax, dword [0x18077dc6c]
sub eax, 0xcc292c88
sub eax, 0x9a436900
mov r9d, 0xe0c9b59d
xor edx, edx
div r9d
mov edx, eax
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x56dafdb
je 0x1802eef7c
ret
invalid
out 0xe1, eax
in eax, 0x6b
in al, 0x33
sub byte [rsi - 0x168ff3e3], ch
cmp edi, edi
invalid
sub al, ah
imul esp, ecx, 0xfffffff0
xor eax, 0x24ae349e
invalid

Function at 0x1802ef450
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0x1237d1d4
sub rax, rdx
imul r8, rax, 0xfffffffff98d0647
mov eax, dword [0x18077dcf0]
imul eax, dword [0x18077dcf4]
imul eax, eax, 0x21c703d7
sub eax, 0x922a8a03
add eax, 0x1d741bbb
cmp eax, 0x54df3fcc
je 0x1802ef4d0
jmp 0x1802ef485
mov eax, dword [0x18077dcf8]
sub eax, dword [0x18077dcfc]
add eax, 0x274909f4
or eax, 0x5ef8d45e
mov r9d, 0x47a33c31
xor edx, edx
div r9d
mov rdx, r8
xor rdx, 0xffffffffc2e6dc50
cmp eax, 0x30d99d40
ja 0x1802ef485
cmp byte [rbx], ch
invalid
Function at 0x1802ef5f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077dd20]
and eax, dword [0x18077dd24]
xor eax, 0x1d774035
xor eax, 0x2b849a5
sub eax, 0x7bb3639e
cmp eax, 0x467e9a9e
je 0x1802ef6d7
jmp 0x1802ef61b
mov eax, dword [0x18077dd28]
and eax, dword [0x18077dd2c]
mov r9d, 0x7a5c692a
xor edx, edx
div r9d
mov r9d, 0xe4fccf99
xor edx, edx
div r9d
mov r9d, 0x1755a3b6
xor edx, edx
div r9d
mov rdx, r8
xor rdx, 0xffffffffdfc22ff8
add rdx, 0x204bcd5f
mov r9, rdx
rol r9, 1
xor r9, rdx
cmp eax, 0x16c07532
ja 0x1802ef61b
jmp 0x1802ef66b
mov eax, dword [0x18077dd30]
or eax, dword [0x18077dd34]
xor eax, 0x1ac2d6f7
imul eax, eax, 0xcab62abb
imul eax, eax, 0xc3c73ec
cmp eax, 0xb7ffe648
ja 0x1802ef6e4
mov eax, dword [0x18077dd38]
xor eax, dword [0x18077dd3c]
sub eax, 0xd7cce866
mov r8d, 0x9c017c0
xor edx, edx
div r8d
sub eax, 0x3e79e4ea
imul r8, r9, 0xffffffffb9f73146
mov rdx, r8
rol rdx, 1
xor rdx, r8
cmp eax, 0xf8b9a1df
jae 0x1802ef6e4
jmp 0x1802ef6c9
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
push rdx
shr byte [rcx - 0x30], 0x95
imul byte [rax - 0x48]
jmp 0x1802ef619
mov esi, 0xee551312
in eax, 0x86
cmc
bnd jb 0x1802ef70f
add ebx, ebp
popfq
int3
or eax, dword [0x18077dd44]
mov r9d, 0xe46df923
xor edx, edx
div r9d
imul eax, eax, 0xe7893ead
xor eax, 0xdac6b798
cmp eax, 0x31975b78
je 0x1802ef7d7
jmp 0x1802ef738
mov eax, dword [0x18077dd48]
sub eax, dword [0x18077dd4c]
sub eax, 0x174f25e5
or eax, 0x98c234a6
add eax, 0x38b103dc
mov r9, r11
xor r9, r8
mov r10, r9
shr r10, 0x19
cmp eax, 0x48b037ce
jbe 0x1802ef738
jmp 0x1802ef769
mov eax, dword [0x18077dd50]
xor edx, edx
div dword [0x18077dd54]
or eax, 0x778d865a
sub eax, 0xa8787b98
sub eax, 0x6af1c2a5
cmp eax, 0xa0932ba0
je 0x1802ef7e8
lea esi, [rdi + 0x2d]
cwde
jnp 0x1802ef7f8
test al, 0x2d
movsd dword [rdi], dword [rsi]
ret 0x6af1
jmp 0x1802ef78f
mov edx, dword [0x18077dd58]
and edx, dword [0x18077dd5c]
xor edx, 0x68580302
sub edx, 0x172a5e51
and edx, 0xba596ecd
mov rax, r10
xor rax, r9
add rax, 0xffffffffffffffff
mov r8, rax
rol r8, 4
xor r8, rax
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0xf7d12cf6
je 0x1802ef78f
ret
neg dword [rbp + 0x61]
loope 0x1802ef777
jbe 0x1802ef77a
xchg ebp, eax
xlatb
insb byte [rdi], dx
mov ebp, ebp
jmp 0x1802ef736
mov ecx, 0xb4368f15
pop rdx
or edi, dword [rbx + rbp*8 - 0x33333365]
int3
int3

Function at 0x1802efc40
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffffffffffff
imul rax, rdx, 0x647fff08
mov rdx, rax
rol rdx, 1
xor rdx, rax
imul rax, rdx, 0x7ea00dbe
mov rdx, rax
rol rdx, 3
xor rdx, rax
mov eax, dword [0x18077ddd0]
or eax, dword [0x18077ddd4]
and eax, 0xbe8e5e5c
or eax, 0x9ea51140
or eax, 0x5d566c02
cmp eax, 0xa371b0fa
jb 0x1802efcc8
jmp 0x1802efc89
mov r8d, dword [0x18077ddd8]
add r8d, dword [0x18077dddc]
and r8d, 0x30b7dbf9
xor r8d, 0x841dec8a
add r8d, 0x70d815b1
mov r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0x44364294
je 0x1802efc89
jmp 0x1802efcc7
ret
invalid
Function at 0x1802efce0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x18077dde0]
add eax, dword [0x18077dde4]
or eax, 0x4fd16d86
sub eax, 0xd2974fea
xor eax, 0x74dabc6b
cmp eax, 0x3dd55c4a
jb 0x1802efe1a
jmp 0x1802efd08
mov eax, dword [0x18077dde8]
or eax, dword [0x18077ddec]
and eax, 0x5628e2ec
sub eax, 0xe4db4b62
and eax, 0x82802c36
mov r9, rdx
rol r9, 3
xor r9, rdx
mov r8d, 0x42bcf187
sub r8, r9
cmp eax, 0x5de48705
jae 0x1802efd08
jmp 0x1802efd3f
mov eax, dword [0x18077ddf0]
sub eax, dword [0x18077ddf4]
mov r9d, 0xcf172393
xor edx, edx
div r9d
mov r9d, 0x6fc43701
xor edx, edx
div r9d
imul eax, eax, 0xd1806ce5
cmp eax, 0x8da52c3
je 0x1802efe27
jmp 0x1802efd74
mov eax, dword [0x18077ddf8]
imul eax, dword [0x18077ddfc]
xor eax, 0xb149e9a5
imul eax, eax, 0x9fbef97d
xor eax, 0x92815a17
mov rdx, r8
rol rdx, 1
xor rdx, r8
imul rdx, rdx, 0x6a21bd92
mov r9, rdx
rol r9, 5
xor r9, rdx
cmp eax, 0x4d325b97
je 0x1802efd74
jmp 0x1802efdb4
mov eax, dword [0x18077de00]
xor eax, dword [0x18077de04]
mov r8d, 0xda161b1c
xor edx, edx
div r8d
sub eax, 0x68bf1c64
xor eax, 0xa46accd3
cmp eax, 0x4daeae63
je 0x1802efe38
jmp 0x1802efdde
mov eax, dword [0x18077de08]
sub eax, dword [0x18077de0c]
sub eax, 0x38844477
add eax, 0x58073ca5
mov r8d, 0xc9c9729
xor edx, edx
div r8d
mov edx, eax
mov r8, r9
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0xc1c92a6b
ja 0x1802efdde
ret
out dx, eax
invalid
fisttp word [rcx + 0x36696a37]
invalid
sar byte [rbx - 0x16e0514a], cl
in eax, 0
jmp 0x1802efddc

Function at 0x1802efe50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077de10]
add eax, dword [0x18077de14]
imul eax, eax, 0xd633abe4
and eax, 0x3a6ba213
mov r9d, 0xda5936a5
xor edx, edx
div r9d
cmp eax, 0xd4bc4d85
je 0x1802efedd
jmp 0x1802efe7e
mov edx, dword [0x18077de18]
sub edx, dword [0x18077de1c]
or edx, 0xf842bf77
and edx, 0x12cafa2
xor edx, 0xf22265aa
mov rax, r8
xor rax, 0xffffffffdd941394
add rax, 0xffffffffddc45c4b
mov r9, rax
rol r9, 2
xor r9, rax
imul rax, r9, 0xffffffffed27c7c1
cmp edx, 0x93139e46
jbe 0x1802efe7e
jmp 0x1802efec6
mov rdx, rax
rol rdx, 1
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
adc dword [rbx - 0x3b], edi
adc ebp, dword [rax - 0x1459d563]
xchg ebp, eax
int3
Function at 0x1802f01b0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077de60]
add eax, dword [0x18077de64]
sub eax, 0x71c59035
imul eax, eax, 0xdb8bc76d
imul eax, eax, 0x17d8b003
cmp eax, 0x769f3d4a
jbe 0x1802f028e
jmp 0x1802f01dd
mov eax, dword [0x18077de68]
xor edx, edx
div dword [0x18077de6c]
mov r9d, 0xc1570cea
xor edx, edx
div r9d
mov r9d, 0x579b4407
xor edx, edx
div r9d
add eax, 0x474f22f0
mov rdx, r8
shr rdx, 0x20
xor rdx, r8
xor rdx, 0xffffffffffffffff
cmp eax, 0x9d2b1399
ja 0x1802f01dd
jmp 0x1802f021d
mov eax, dword [0x18077de70]
and eax, dword [0x18077de74]
imul eax, eax, 0x3fe93eb0
or eax, 0xff52fdb1
and eax, 0x921cddd4
cmp eax, 0x4885cd8e
je 0x1802f029b
jmp 0x1802f0242
mov r8d, dword [0x18077de78]
imul r8d, dword [0x18077de7c]
xor r8d, 0xea4755a5
xor r8d, 0x2fa649ee
xor r8d, 0x2fe5eaa5
imul r9, rdx, 0xffffffff878c8828
mov rax, r9
rol rax, 1
xor rax, r9
and rax, 0xfff9
cmp r8d, 0x81a3dcbb
je 0x1802f0242
jmp 0x1802f0287
add rcx, rax
mov rax, rcx
ret
leave
out dx, al
imul ecx, dword [rsi], 0x7a1033d6
jmp 0x1802f01db
sal byte [rsi], 0x91
push qword [rbx - 0x3609052f]
ret

Function at 0x1802f12c0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077e000]
and eax, dword [0x18077e004]
mov r9d, 0x8861f1b1
xor edx, edx
div r9d
sub eax, 0xd4734a05
mov r9d, 0xe86c29d6
xor edx, edx
div r9d
cmp eax, 0xe3947528
je 0x1802f139f
jmp 0x1802f12f7
mov edx, dword [0x18077e008]
or edx, dword [0x18077e00c]
sub edx, 0xbe41f15c
sub edx, 0xefc3782d
and edx, 0xa619c0e7
mov r9, r8
rol r9, 7
xor r9, r8
xor eax, eax
sub rax, r9
xor rax, 0xffffffff90ffff34
cmp edx, 0x2f2e99d0
jae 0x1802f12f7
jmp 0x1802f1334
imul r8, rax, 0xffffffff86915f69
mov eax, dword [0x18077e010]
xor edx, edx
div dword [0x18077e014]
sub eax, 0xaca9c7e3
and eax, 0xc8a3f33e
sub eax, 0x23ee1fcc
cmp eax, 0x442291b9
ja 0x1802f13b0
int3
jmp 0x1802f1361
mov edx, dword [0x18077e018]
sub edx, dword [0x18077e01c]
sub edx, 0x8c47c701
sub edx, 0x67af1a21
and edx, 0xd3ba1802
mov r9, r8
rol r9, 7
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x2aab722d
je 0x1802f1361
enter 0xfffffffffffffa81, 0x2d
jb 0x1802f1346
sub dh, byte [rbx + rax*8 - 0x3d]
ret
mov eax, 0x5e57704c
sar byte [rbx + 0x128fb00d], 1
loope 0x1802f1395
invalid
retf 0x7c57
Function at 0x1802f1460
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077e020]
add eax, dword [0x18077e024]
add eax, 0x285aef9f
xor eax, 0xa9f372d4
sub eax, 0xc904a49c
cmp eax, 0x678898bb
jbe 0x1802f1536
jmp 0x1802f148b
mov eax, dword [0x18077e028]
or eax, dword [0x18077e02c]
sub eax, 0x48edced8
add eax, 0xe136205b
xor eax, 0x1fadd4ef
mov r9, r8
add r9, 0xffffffffb4a05b8c
cmp eax, 0x195a6d75
je 0x1802f148b
jmp 0x1802f14b9
mov eax, dword [0x18077e030]
imul eax, dword [0x18077e034]
add eax, 0x4db70818
or eax, 0x33a99f0e
add eax, 0x63160a69
cmp eax, 0xfe7742f
je 0x1802f1543
mov eax, dword [0x18077e038]
sub eax, dword [0x18077e03c]
imul eax, eax, 0x59e2444
mov r10d, 0xc2052cd8
xor edx, edx
div r10d
mov edx, eax
xor edx, 0xd9cb1e62
mov rax, r9
rol rax, 7
mov r10d, 0x4b5fa473
sub r10, r8
xor rax, r10
mov r10, rax
rol r10, 7
xor r10, rax
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x1fbb2d3f
jb 0x1802f1543
jmp 0x1802f1535
ret
test dword [rax - 0x6a], esi
xchg esi, eax
pop rsp
add al, 0xe9
invalid
cmp byte [rcx], ah
and byte [rsi + 0x41], 0xd3
pop rbx
push rdx
jmp 0x1802f14dc

Function at 0x1802f18d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077e0a0]
sub eax, dword [0x18077e0a4]
or eax, 0xadb1e1ad
xor eax, 0x69d67dc6
or eax, 0xeb37d82c
cmp eax, 0xb7f51d8b
je 0x1802f19b7
jmp 0x1802f18fb
mov eax, dword [0x18077e0a8]
xor eax, dword [0x18077e0ac]
mov r9d, 0xe9623bd4
xor edx, edx
div r9d
mov r9d, 0x13b7d9f6
xor edx, edx
div r9d
and eax, 0xda26c639
xor r9d, r9d
sub r9, r8
mov r10, r9
rol r10, 3
cmp eax, 0x87d9773d
je 0x1802f18fb
jmp 0x1802f1938
mov eax, dword [0x18077e0b0]
and eax, dword [0x18077e0b4]
mov r8d, 0xb7013429
xor edx, edx
div r8d
and eax, 0x3bece8cd
xor eax, 0xb3edf48e
cmp eax, 0xcdf83507
je 0x1802f19c8
mov edx, dword [0x18077e0b8]
imul edx, dword [0x18077e0bc]
or edx, 0x4a7b3011
and edx, 0x40aac93d
xor edx, 0x9144e8fb
mov rax, r10
xor rax, r9
mov r8d, 0x5ac721e4
sub r8, rax
imul rax, r8, 0xfffffffff8cc8978
cmp edx, 0x6ae9fbd2
jbe 0x1802f19c8
jmp 0x1802f199f
mov rdx, rax
rol rdx, 6
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
retf
invalid
Function at 0x1802f19e0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, 0x4e6b7bca
sub r8, rdx
mov rax, r8
shr rax, 0x14
xor rax, r8
mov rdx, rax
rol rdx, 4
mov r8d, dword [0x18077e0c0]
and r8d, dword [0x18077e0c4]
add r8d, 0xc0384658
add r8d, 0xa47a7b31
add r8d, 0xedbc334b
cmp r8d, 0x6bff8e19
jbe 0x1802f1ace
jmp 0x1802f1a2c
mov r9d, dword [0x18077e0c8]
or r9d, dword [str.__oc_v]
xor r9d, 0x6ba313ee
or r9d, 0xb8952d03
xor r9d, 0x7618f78f
mov r10, rdx
xor r10, rax
add r10, 0x8deacca
mov r8, r10
rol r8, 6
xor r8, r10
cmp r9d, 0xed2f1c9d
je 0x1802f1a2c
jmp 0x1802f1a71
mov eax, dword [0x18077e0d0]
imul eax, dword [0x18077e0d4]
imul eax, eax, 0x80885f75
imul eax, eax, 0xb4caa064
sub eax, 0xa448591f
cmp eax, 0xa30f8a8f
jae 0x1802f1adb
mov edx, dword [0x18077e0d8]
imul edx, dword [0x18077e0dc]
add edx, 0x34721cc0
add edx, 0xa7d5f1ca
xor edx, 0xc1e9ecca
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x75f61fe7
je 0x1802f1adb
ret
adc dh, byte [rbx + rbp]
pop rdx
jo 0x1802f1b1f
invalid
or bh, byte gs:[rax]
call 0x18639938a
xchg esp, eax
adc al, 0x1e
sub bl, ch
lodsd eax, dword [rsi]
int3
int3

Function at 0x1802f2240
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077e180]
or eax, dword [0x18077e184]
and eax, 0x37d2d6b6
mov r9d, 0xed13213e
xor edx, edx
div r9d
imul eax, eax, 0x7a90f66c
cmp eax, 0x929869f1
je 0x1802f231b
jmp 0x1802f2272
mov eax, dword [0x18077e188]
or eax, dword [0x18077e18c]
xor eax, 0x8a9b269a
imul eax, eax, 0xe37ac636
imul eax, eax, 0xe1c8c978
mov r9d, 0x318c2a4e
sub r9, r8
cmp eax, 0x3161701
jb 0x1802f2272
jmp 0x1802f22a1
mov eax, dword [0x18077e190]
xor eax, dword [0x18077e194]
add eax, 0xcd8145b6
sub eax, 0xc6c957f1
xor eax, 0xec2296eb
cmp eax, 0xc0408d33
je 0x1802f2328
mov eax, dword [0x18077e198]
or eax, dword [0x18077e19c]
and eax, 0x9a21db63
mov r8d, 0xa65b3d9f
xor edx, edx
div r8d
or eax, 0xd4e9724
mov rdx, r9
xor rdx, 0xa69eb81
add rdx, 0x3033921f
cmp eax, 0x1a4dda0e
ja 0x1802f2328
jmp 0x1802f22fe
xor rdx, 0x2bc47100
mov rax, rdx
rol rax, 1
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
invalid
and eax, 0x29b35819
insd dword [rdi], dx
cdq
sub spl, byte [r11 - 0x17]
jmp 0x1802f22c3
Function at 0x1802f2340
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077e1a0]
sub eax, dword [0x18077e1a4]
add eax, 0xcfe496be
sub eax, 0x47acda8e
or eax, 0xe556c427
cmp eax, 0xb65616f4
je 0x1802f2472
jmp 0x1802f236b
mov eax, dword [0x18077e1a8]
imul eax, dword [0x18077e1ac]
mov r9d, 0x1d27ee6f
xor edx, edx
div r9d
add eax, 0xc6d88b16
sub eax, 0xae32766a
mov r9, r8
shr r9, 0xc
xor r9, r8
xor r9, 0xffffffff98b50c4a
mov r10, r9
rol r10, 1
cmp eax, 0x931546ef
je 0x1802f236b
jmp 0x1802f23ad
mov eax, dword [0x18077e1b0]
add eax, dword [0x18077e1b4]
mov r8d, 0x9a7bca75
xor edx, edx
div r8d
imul eax, eax, 0x9173b0d4
add eax, 0xe4309d6b
cmp eax, 0x5a0889dd
jbe 0x1802f2483
jmp 0x1802f23dc
mov eax, dword [0x18077e1b8]
sub eax, dword [0x18077e1bc]
sub eax, 0x408bc4b1
sub eax, 0xa34fa4e3
and eax, 0xa4260213
mov rdx, r10
xor rdx, r9
mov r8, rdx
rol r8, 6
xor r8, rdx
and r8, 0xffff
cmp eax, 0x6ecf9878
je 0x1802f23dc
jmp 0x1802f2417
mov eax, dword [0x18077e1c0]
xor edx, edx
div dword [0x18077e1c4]
sub eax, 0x160200b0
imul eax, eax, 0xac533be2
add eax, 0x31b5feb5
cmp eax, 0x6bc98947
jb 0x1802f2490
mov eax, dword [0x18077e1c8]
xor edx, edx
div dword [0x18077e1cc]
mov r9d, 0xc9f6fcf7
xor edx, edx
div r9d
mov edx, eax
add edx, 0x65f523c8
sub edx, 0xb32b9648
mov rax, rcx
add rax, r8
cmp edx, 0x1bfc5d9e
jb 0x1802f2490
ret
mov ss, bx
invalid
mov bl, 0xcb
mov ah, bh
pushf
pushfq
jl 0x1802f24b9
jmp 0x1802f23da
neg dword [rbx + 0x32fef073]
loopne 0x1802f2488
cmp qword [r8 - 0x78], rdx
jmp 0x1802f243c
or ax, 0xb267
invalid
Function at 0x1802f2a40
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffffffffffff
mov rax, rdx
rol rax, 7
xor rax, rdx
mov r9d, 0x52209f33
sub r9, rax
mov r10, r9
rol r10, 3
mov eax, dword [0x18077e260]
sub eax, dword [0x18077e264]
mov r8d, 0x398475c7
xor edx, edx
div r8d
xor eax, 0x5816141a
imul eax, eax, 0xb45b568f
cmp eax, 0xf3e35cc4
ja 0x1802f2b17
jmp 0x1802f2a8d
mov eax, dword [0x18077e268]
imul eax, dword [0x18077e26c]
imul eax, eax, 0x7750c120
or eax, 0xe1399014
or eax, 0xd2d95ee3
mov rdx, r10
xor rdx, r9
and rdx, 0xffff
mov r8, rcx
add r8, rdx
cmp eax, 0x99d840d8
jb 0x1802f2a8d
jmp 0x1802f2ac6
mov eax, dword [0x18077e270]
xor edx, edx
div dword [0x18077e274]
and eax, 0xc1e4c1da
and eax, 0x8216b5df
imul eax, eax, 0x1870a8f1
cmp eax, 0x26b0cd46
jb 0x1802f2b24
jmp 0x1802f2aed
mov eax, dword [0x18077e278]
xor eax, dword [0x18077e27c]
mov ecx, 0xa1ddb895
xor edx, edx
div ecx
or eax, 0xe3aa5ffd
sub eax, 0xc3d887e6
cmp eax, 0x438e52a0
ja 0x1802f2aed
mov rax, r8
ret
adc eax, 0x36bd9f0c
or eax, 0x67e9d073
invalid
or esi, dword [rdx + 0x4d]
add eax, 0xeb43ae4c
mov ebp, 0xc748cccc
mov rax, 0xffffffffa986c9c2
sub rax, rdx
mov r8, rax
rol r8, 7
xor r8, rax
mov rax, r8
shr rax, 0x16
xor r8, rax
mov eax, dword [0x18077e280]
and eax, dword [0x18077e284]
and eax, 0x9671c5d3
and eax, 0x6b86716
mov r9d, 0xfec7f597
xor edx, edx
div r9d
cmp eax, 0x29d687de
ja 0x1802f2bc0
jmp 0x1802f2b78
mov eax, dword [0x18077e288]
xor eax, dword [0x18077e28c]
xor eax, 0x4925f96
imul edx, eax, 0x6b6994ac
xor edx, 0xfe098d32
mov r9, r8
xor r9, 0x5bbe5d3
mov rax, r9
rol rax, 6
xor rax, r9
cmp edx, 0x92d2805f
jae 0x1802f2b78
jmp 0x1802f2bb3
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
invalid

Function at 0x1802f2d20
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077e2b0]
xor edx, edx
div dword [0x18077e2b4]
mov r9d, 0x4917a600
xor edx, edx
div r9d
or eax, 0x64000aaa
mov r9d, 0xf9d635df
xor edx, edx
div r9d
cmp eax, 0xaca1a993
jae 0x1802f2e66
mov eax, dword [0x18077e2b8]
add eax, dword [0x18077e2bc]
sub eax, 0xc57728cf
imul eax, eax, 0x423d1c5b
imul eax, eax, 0x1a8410b4

Function at 0x1802f3500
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
imul rcx, rdx, 0x5c6a2333
add rcx, 0xab354ab
mov rdx, rcx
rol rdx, 5
mov r8d, dword [0x18077e370]
imul r8d, dword [0x18077e374]
xor r8d, 0x7d2d75ff
and r8d, 0x370df21f
xor r8d, 0xf6ee301f
cmp r8d, 0x21788780
je 0x1802f3590
jmp 0x1802f3547
mov r9d, dword [0x18077e378]
sub r9d, dword [0x18077e37c]
and r9d, 0x9c3a181b
xor r9d, 0x4ebbde
add r9d, 0x5e0d8f74
mov r10, rdx
xor r10, rcx
mov r8, r10
rol r8, 3
xor r8, r10
cmp r9d, 0x84bb339b
ja 0x1802f3547
jmp 0x1802f3585
and r8, 0xffff
add rax, r8
ret
loop 0x1802f35df
retf
cmp dword [rax - 0x721e7e4d], eax
int3