joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180319af0
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x179a0d56
mov rax, rdx
rol rax, 6
xor rax, rdx
mov rdx, rax
rol rdx, 2
xor rdx, rax
xor r8d, r8d
sub r8, rdx
mov r9, r8
rol r9, 6
mov eax, dword [0x180782270]
or eax, dword [0x180782274]
and eax, 0xf343124
and eax, 0xb2bd707f
imul eax, eax, 0xf66d81e2
cmp eax, 0xf82aefce
jae 0x180319b7f
jmp 0x180319b3d
mov eax, dword [0x180782278]
imul eax, dword [0x18078227c]
mov r10d, 0x7cba2f50
xor edx, edx
div r10d
mov edx, eax
xor edx, 0xcd124d36
xor edx, 0x7d20f965
mov r10, r9
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x30bf6661
jb 0x180319b3d
ret
jns 0x180319b93
shl byte [rcx], 1
mov word [rbx - 0x4d14d907], fs
int3

Function at 0x180319c20
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180782290]
sub eax, dword [0x180782294]
sub eax, 0xd3855f04
xor eax, 0xec6bd913
mov r9d, 0x3f91d519
xor edx, edx
div r9d
cmp eax, 0x7d1bdcc7
ja 0x180319d07
jmp 0x180319c51
mov eax, dword [0x180782298]
xor edx, edx
div dword [0x18078229c]
and eax, 0x51f047c4
mov r9d, 0x5d1579e9
xor edx, edx
div r9d
xor eax, 0xf65462c
imul r9, r8, 0xffffffff8eb6e47f
mov rdx, r9
shr rdx, 0xf
xor rdx, r9
cmp eax, 0x3038ea7
jbe 0x180319c51
jmp 0x180319c8e
imul r8, rdx, 0x524f9561
mov r9, r8
rol r9, 6
mov eax, dword [0x1807822a0]
xor edx, edx
div dword [0x1807822a4]
mov r10d, 0x1b54d16c
xor edx, edx
div r10d
add eax, 0x8f403b94
mov r10d, 0x1affd03
xor edx, edx
div r10d
cmp eax, 0x5767c7b4
je 0x180319d14
jmp 0x180319cce
mov eax, dword [0x1807822a8]
imul eax, dword [0x1807822ac]
xor eax, 0x1751d74c
and eax, 0x77fa7b00
imul edx, eax, 0x78516dc8
mov r10, r9
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x87b79f16
jbe 0x180319cce
ret
test byte [rbx + 0x6f2a8522], al
fsubr qword [rbp - 0xc417]
push qword [rcx + rdx*4 + 0x5569fa1a]
cmp al, 0x71
jmp 0x180319ccc
mov ah, 0x91
sbb bh, dl
imul edx, dword [rbp + 0x3c], 0xccaeeb71
int3

Function at 0x180319df0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1807822c0]
xor eax, dword [0x1807822c4]
sub eax, 0x7c5ab11e
xor eax, 0xbeb0eda1
add eax, 0x5f4fb94
cmp eax, 0x8e5f98b0
je 0x180319e65
jmp 0x180319e17
mov eax, dword [0x1807822c8]
xor eax, dword [0x1807822cc]
xor eax, 0x911c32dd
mov r9d, 0xe1e3161
xor edx, edx
div r9d
xor eax, 0xfa1716e6
imul rdx, r8, 0xffffffffb3317b99
cmp eax, 0x8ceb8f82
jb 0x180319e17
jmp 0x180319e48
add rdx, 0xf71215a
mov rax, rdx
rol rax, 1
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
xchg esp, eax
invalid
Function at 0x18031a090
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x180782300]
xor eax, dword [0x180782304]
or eax, 0x139f3bb6
imul eax, eax, 0x280235a4
add eax, 0x8b074a28
cmp eax, 0x3dee2062
jbe 0x18031a15f
mov eax, dword [str.cu]
xor eax, dword [0x18078230c]
imul eax, eax, 0x8d9d126c
or eax, 0x59d905f2
imul r8d, eax, 0xfc1a40ae
xor r9d, r9d
sub r9, rdx
mov rax, r9
rol rax, 6
xor rax, r9
cmp r8d, 0x2bab4b1b
je 0x18031a15f
jmp 0x18031a0f0
mov rdx, 0xffffffffe18da341
sub rdx, rax
mov rax, rdx
rol rax, 2
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov eax, dword [0x180782310]
sub eax, dword [0x180782314]
mov r8d, 0xcd7c1386
xor edx, edx
div r8d
and eax, 0xad77f63a
sub eax, 0x6d05955b
cmp eax, 0x3ebd57bc
jb 0x18031a170
jmp 0x18031a137
mov eax, dword [0x180782318]
imul eax, dword [0x18078231c]
imul eax, eax, 0x93b52921
and eax, 0x3dbe2c2f
xor eax, 0xf8a33a01
cmp eax, 0xd26dfdaa
jbe 0x18031a137
mov rax, rcx
ret
invalid
jmp 0x13102c01e

Function at 0x18031a630
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
add r8, 0xffffffffe38aecde
mov r9, r8
rol r9, 5
mov eax, dword [0x1807823a0]
xor eax, dword [0x1807823a4]
or eax, 0x5871075b
or eax, 0x320deda9
add eax, 0xb3ca2fdd
cmp eax, 0x6485479c
ja 0x18031a6a4
jmp 0x18031a665
mov eax, dword [0x1807823a8]
or eax, dword [0x1807823ac]
mov r10d, 0xd21948f6
xor edx, edx
div r10d
sub eax, 0x6e37c405
imul edx, eax, 0x8368719b
mov rax, r9
xor rax, r8
cmp edx, 0x475c0f25
je 0x18031a665
jmp 0x18031a697
and rax, 0xffff
and eax, 0xffff
add rcx, rax
mov rax, rcx
ret
pop rsi
rcr byte [rax], 1
push rbp
in al, 0x8b
lahf
jo 0x18031a698
mov ch, 0xcc
int3

Function at 0x18031a8b0
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0xffffffffe7afe4f8
mov r8, rdx
shr r8, 8
xor r8, rdx
mov eax, dword [0x1807823e0]
xor edx, edx
div dword [0x1807823e4]
xor eax, 0xf45630a
and eax, 0x4afcdbc
mov r9d, 0x91095ab7
xor edx, edx
div r9d
cmp eax, 0x363f8bfe
je 0x18031a92c
jmp 0x18031a8ed
mov eax, dword [0x1807823e8]
imul eax, dword [0x1807823ec]
xor eax, 0x3e880fc2
imul edx, eax, 0x6ebaa167
and edx, 0x1dfa468b
mov rax, r8
rol rax, 2
cmp edx, 0x26a4d492
jae 0x18031a8ed
jmp 0x18031a91c
xor rax, r8
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
sbb edi, edx
adc bh, byte [rdi + rbx*8 + 0x6c]
mov bpl, 0x1f
sub dword ss:[rsi - 0x33334e15], eax
int3

Function at 0x18031a940
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
sub r8, rdx
mov r9, r8
rol r9, 5
mov eax, dword [0x1807823f0]
imul eax, dword [0x1807823f4]
add eax, 0x645e931b
xor eax, 0x33178dcb
mov r10d, 0x2dd27bb8
xor edx, edx
div r10d
cmp eax, 0xe5c9d381
ja 0x18031a9ce
jmp 0x18031a978
mov eax, dword [0x1807823f8]
xor eax, dword [0x1807823fc]
add byte [0x13dec3272], cl
mov r10d, 0x1888b33e
xor edx, edx
div r10d
imul edx, eax, 0x609050c9
mov rax, r9
xor rax, r8
xor r10d, r10d
sub r10, rax
xor r10, 0xffffffffcb2b6016
mov rax, r10
rol rax, 2
xor rax, r10
cmp edx, 0x8ddfca62
jb 0x18031a978
jmp 0x18031a9c1
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
xor dword [rdi], ebp
add byte [rdi], dh
xor al, 0xcf
imul r11
sahf
int3
Function at 0x18031af70
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
rol r8, 5
xor r8, rdx
mov eax, dword [0x180782480]
add eax, dword [0x180782484]
sub eax, 0xbf1e31d9
and eax, 0xeb6085ba
and eax, 0x3fff9da6
cmp eax, 0x80045e12
ja 0x18031aff3
jmp 0x18031af9e
mov eax, dword [0x180782488]
xor edx, edx
div dword [0x18078248c]
and eax, 0x7e0f8549
and eax, 0x6bce1ad9
or eax, 0xdf080ff8
mov rdx, r8
rol rdx, 6
xor rdx, r8
cmp eax, 0x1ec8b2d5
je 0x18031af9e
jmp 0x18031afce
mov rax, rdx
shr rax, 0x17
xor rdx, rax
xor rdx, 0xffffffffffffffff
mov rax, rdx
rol rax, 5
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
invalid

Function at 0x18031b530
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
add rdx, 0xffffffff92cc2890
xor rdx, 0xffffffffcf234eea
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
mov ecx, dword [0x180782510]
imul ecx, dword [0x180782514]
and ecx, 0x92b5587c
xor ecx, 0x21a973e9
and ecx, 0xf315c0f8
cmp ecx, 0xcd391b7a
jae 0x18031b5a4
jmp 0x18031b57d
mov ecx, dword [0x180782518]
add ecx, dword [0x18078251c]
add ecx, 0x78150c61
xor ecx, 0x83feaec5
and ecx, 0xd86aa326
cmp ecx, 0x4530181
jbe 0x18031b57d
ret
xor al, 0xb0
jmp 0x18031b5ac
jmp 0x18031b57b

Function at 0x18031ba00
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0xffffffffffffffff
mov rcx, rdx
shr rcx, 9
xor rcx, rdx
imul rdx, rcx, 0xffffffffb1ff0e5c
xor rdx, 0xffffffffffffffff
mov rcx, rdx
rol rcx, 2
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
mov ecx, dword [0x180782590]
add ecx, dword [0x180782594]
sub ecx, 0x9ac824e5
sub ecx, 0x4df00c30
imul ecx, ecx, 0x5ecab1ca
cmp ecx, 0xc43585a8
je 0x18031ba80
jmp 0x18031ba58
mov ecx, dword [0x180782598]
imul ecx, dword [0x18078259c]
xor ecx, 0xbf22e3f5
and ecx, 0xf9e9da17
or ecx, 0xf1f18a32
cmp ecx, 0xde4e9848
je 0x18031ba58
ret
invalid

Function at 0x18031bb70
Capabilities:
Encode data using xor

Disassembly:
imul rax, rdx, 0xfffffffff20bfe41
mov r8, rax
rol r8, 7
xor r8, rax
add r8, 0xffffffff9907cb7c
mov eax, dword [0x1807825b0]
sub eax, dword [0x1807825b4]
or eax, 0x9a66ca60
xor eax, 0x95facc34
add eax, 0x194798f5
cmp eax, 0xa86b80a1
jae 0x18031bbf7
jmp 0x18031bbac
mov eax, dword [0x1807825b8]
sub eax, dword [0x1807825bc]
mov r9d, 0xd1bbfc6e
xor edx, edx
div r9d
or eax, 0x64014997
or eax, 0x957b8818
mov rdx, r8
xor rdx, 0xffffffff98461550
cmp eax, 0xc729c8b4
jbe 0x18031bbac
jmp 0x18031bbe0
mov rax, rdx
rol rax, 3
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
out dx, al
lodsb al, byte [rsi]
adc eax, 0x6aba266c
adc dword [rbx + rax*2 + 0x54], ebp
stosd dword [rdi], eax
jmp 0x18031bbaa
Function at 0x18031bf40
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180782620]
xor eax, dword [0x180782624]
mov r9d, 0x9f095b12
xor edx, edx
div r9d
add eax, 0x7bd8437d
and eax, 0x92c013c8
cmp eax, 0xf7d19bd6
jae 0x18031c01d
mov eax, dword [0x180782628]
or eax, dword [0x18078262c]
and eax, 0x8c00457b
sub eax, 0xe7262d7e
xor eax, 0x5eb476b9
mov r9, 0xffffffffcafeabe8
sub r9, r8
mov r10, r9
rol r10, 6
cmp eax, 0x5be81ce9
jb 0x18031c01d
jmp 0x18031bfa4
mov eax, dword [0x180782630]
xor edx, edx
div dword [0x180782634]
xor eax, 0x2b4488c5
or eax, 0x772ebf8d
or eax, 0xafd527ba
cmp eax, 0x728bf97
jb 0x18031c02e
jmp 0x18031bfca
mov eax, dword [0x180782638]
xor edx, edx
div dword [0x18078263c]
sub eax, 0x13237c17
imul edx, eax, 0xf60d09ce
add edx, 0x39dd4b51
mov rax, r9
xor rax, r10
xor rax, 0xfffffffff312b774
cmp edx, 0x2609034
je 0x18031bfca
jmp 0x18031bfff
imul rax, rax, 0x77c8a76f
mov rdx, rax
rol rdx, 1
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
invalid
xchg ecx, eax
cmc
pop rbp
mov ebx, dword ss:[rdi]
stc
or eax, 0xcccc90eb
int3

Function at 0x18031c890
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
add rdx, 0x7fe0b624
mov r8, rdx
rol r8, 3
xor r8, rdx
mov eax, dword [0x180782710]
add eax, dword [0x180782714]
imul eax, eax, 0x3242880e
mov r9d, 0x450a4ff6
xor edx, edx
div r9d
xor eax, 0x6710b093
cmp eax, 0x18d3092f
je 0x18031c913
jmp 0x18031c8cc
mov eax, dword [0x180782718]
xor edx, edx
div dword [0x18078271c]
sub eax, 0x7a390dce
or eax, 0x5086d546
mov r9d, 0xbc9a1d46
xor edx, edx
div r9d
mov edx, eax
mov r9, r8
rol r9, 4
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xa671ded6
ja 0x18031c8cc
jmp 0x18031c912
ret
invalid

Function at 0x18031cc40
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x829463a
add rdx, 0x50b9811c
mov eax, dword [0x180782750]
add eax, dword [0x180782754]
sub eax, 0x22f62ad9
add eax, 0x19ee8a2
sub eax, 0x226183e1
cmp eax, 0x770651f
jb 0x18031ccc8
jmp 0x18031cc72
mov r8d, dword [0x180782758]
and r8d, dword [0x18078275c]
add r8d, 0xa71cef60
sub r8d, 0x206a3273
and r8d, 0xfbdb6cfd
mov rax, rdx
shr rax, 0xe
xor rax, rdx
add rax, 0xffffffffb9b7cb9d
mov r9, rax
rol r9, 2
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0xd79b8255
je 0x18031cc72
jmp 0x18031ccc7
ret
test byte [rcx - 0x5e2d6716], bh
fstp st(7)
je 0x18031ccd3
or eax, 0xcc9aebe4
int3
in al, 0xeb
invalid

Function at 0x18031d010
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x1807827b0]
xor ecx, dword [0x1807827b4]
add ecx, 0x7caaa0e0
add ecx, 0x273cae18
xor ecx, 0x8f8fd859
cmp ecx, 0x1b38cd22
je 0x18031d0d3
jmp 0x18031d03f
add al, 0xd0
scasd eax, dword [rdi]
movabs dword [0xffff5de9aed46ee6], eax
call qword [0x128f66d76]
Function at 0x18031da10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1807828b0]
imul eax, dword [0x1807828b4]
and eax, 0xdbd66aca
imul eax, eax, 0x8ed1b661
and eax, 0x7a4ecfd4
cmp eax, 0xfe2c14a7
jae 0x18031db3d
jmp 0x18031da3a
mov eax, dword [0x1807828b8]
and eax, dword [0x1807828bc]
sub eax, 0x8507ba85
sub eax, 0x1a78a81e
imul eax, eax, 0x9cfad4c8
mov r8d, 0x441a4cdf
sub r8, rdx
xor r8, 0xffffffff9379ad92
cmp eax, 0xbe1c6d4c
jae 0x18031da3a
jmp 0x18031da6f
mov eax, dword [0x1807828c0]
xor edx, edx
div dword [0x1807828c4]
or eax, 0x6f2d6154
add eax, 0xcc42613e
sub eax, 0xf6d139c4
cmp eax, 0x791919ac
ja 0x18031db4e
jmp 0x18031da99
mov eax, dword [0x1807828c8]
xor edx, edx
div dword [0x1807828cc]
mov r9d, 0xba9f738
xor edx, edx
div r9d
add eax, 0x3a2be233
mov r9d, 0xc3451d07
xor edx, edx
div r9d
mov rdx, r8
add rdx, 0xffffffffac74aa4d
mov r9, rdx
rol r9, 7
xor r9, rdx
and r9, 0xffff
cmp eax, 0x75da5070
je 0x18031da99
jmp 0x18031dae6
mov eax, dword [0x1807828d0]
or eax, dword [0x1807828d4]
or eax, 0x7b4868be
imul eax, eax, 0xad5079ad
sub eax, 0x79831666
cmp eax, 0xe53de37a
ja 0x18031db5b
mov eax, dword [0x1807828d8]
imul eax, dword [0x1807828dc]
or eax, 0x47185daa
mov r8d, 0xbd62b7d2
xor edx, edx
div r8d
mov edx, eax
sub edx, 0xd3511101
mov rax, rcx
add rax, r9
cmp edx, 0xa3ac23b6
jae 0x18031db5b
ret
push rax
out 0x42, al
pop rsi
pushfq
movabs al, byte [0xeae92438cd0bb4fb]
invalid
invalid
wait
invalid

Function at 0x18031dd00
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
sub rax, rdx
mov rdx, rax
rol rdx, 4
xor rdx, rax
add rdx, 0x7c4dfd01
mov rax, rdx
rol rax, 6
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov eax, dword [0x180782900]
or eax, dword [0x180782904]
add eax, 0xbc7f0e95
sub eax, 0xb4f9a3fe
or eax, 0x481f596f
cmp eax, 0xfcf867e9
ja 0x18031dd79
jmp 0x18031dd4d
mov eax, dword [0x180782908]
add eax, dword [0x18078290c]
and eax, 0xf0e06b84
xor eax, 0x482f272d
mov r8d, 0x5cefca26
xor edx, edx
div r8d
cmp eax, 0x3568e86f
je 0x18031dd4d
mov rax, rcx
ret
invalid

Function at 0x18031e260
Capabilities:
Encode data using xor

Disassembly:
movabs rax, 0xff3571b7a670bdf0
imul rdx, rax
movabs rax, 0xfb65b8a5ee8f9131
add rdx, rax
mov r8, rdx
rol r8, 7
xor r8, rdx
and r8, 0xffff
mov eax, dword [0x180782990]

Function at 0x18031e960
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180782a40]
imul eax, dword [0x180782a44]
mov r9d, 0xf8ed0669
xor edx, edx
div r9d
mov r9d, 0x576cc9d6
xor edx, edx
div r9d
sub eax, 0x1e09eedc
cmp eax, 0x181a209e
jb 0x18031e9e9
jmp 0x18031e994
mov edx, dword [0x180782a48]
imul edx, dword [0x180782a4c]
or edx, 0xbee4f743
sub edx, 0x494ba39
xor edx, 0xfc113ad4
mov rax, r8
rol rax, 1
xor rax, r8
xor eax, eax
xor rax, 0x74054f60
add rax, 0xffffffffe4abfbf4
cmp edx, 0x8765756e
ja 0x18031e994
jmp 0x18031e9d2
mov rdx, rax
rol rdx, 1
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
jno 0x18031e9ba
nop
movabs byte [0xcccccc9febc0b407], al
int3
Function at 0x18031f0b0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov r9, r8
shr r9, 0x1a
mov eax, dword [0x180782af0]
sub eax, dword [0x180782af4]
mov r10d, 0x78d416c4
xor edx, edx
div r10d
imul eax, eax, 0x604a206f
mov r10d, 0x9a4df453
xor edx, edx
div r10d
cmp eax, 0xa11fd5ea
ja 0x18031f14a
jmp 0x18031f0eb
mov eax, dword [0x180782af8]
xor eax, dword [0x180782afc]
or eax, 0xd50d8ced
imul eax, eax, 0xd6ee599a
imul edx, eax, 0xbef76dfb
mov r10, r9
xor r10, r8
mov rax, r10
rol rax, 2
xor rax, r10
mov r10, rax
shr r10, 0x1b
xor rax, r10
xor rax, 0xffffffff8bc5eb17
cmp edx, 0x807bdb
je 0x18031f0eb
jmp 0x18031f132
mov rdx, rax
rol rdx, 2
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
pop rdi
leave
jl 0x18031f185
mul byte [rdi + 0x43]
jmp 0x18031f0e9
ror eax, 0xd8
int1

Function at 0x18031f300
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180782b30]
add eax, dword [0x180782b34]
imul eax, eax, 0x5db7000d
mov r9d, 0xeb3d836a
xor edx, edx
div r9d
sub eax, 0x207e5238
cmp eax, 0x29615988
jbe 0x18031f439
mov eax, dword [0x180782b38]
add eax, dword [0x180782b3c]
mov r9d, 0x84aa1b7b
xor edx, edx
div r9d
imul eax, eax, 0xa8f56e8a
and eax, 0x87a0cc38
mov r9, r8
rol r9, 1
cmp eax, 0xbdd0f5fd
jae 0x18031f439
jmp 0x18031f365
mov eax, dword [0x180782b40]
add eax, dword [0x180782b44]
xor eax, 0x3c1dd717
or eax, 0x729b425f
mov r10d, 0xb2e0bc5b
xor edx, edx
div r10d
cmp eax, 0xc2eb07cc
je 0x18031f446
jmp 0x18031f393
mov eax, dword [0x180782b48]
xor edx, edx
div dword [0x180782b4c]
mov r10d, 0xb7286e3d
xor edx, edx
div r10d
sub eax, 0xd3478c5e
imul eax, eax, 0x7b2132d0
mov r10, r9
xor r10, r8
mov rdx, r10
rol rdx, 7
xor rdx, r10
mov r10, rdx
rol r10, 7
cmp eax, 0x3d960d87
ja 0x18031f393
jmp 0x18031f3d7
mov eax, dword [0x180782b50]
sub eax, dword [0x180782b54]
add eax, 0x4f1544ad
and eax, 0x44466a7f
xor eax, 0xf7a98f38
cmp eax, 0xdb779a73
ja 0x18031f457
mov r8d, dword [0x180782b58]
add r8d, dword [0x180782b5c]
or r8d, 0xdc557596
and r8d, 0xe1aec568
add r8d, 0x9d61866e
mov r9, r10
xor r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0x15aebb1a
jbe 0x18031f457
ret
popfq
sub eax, 0x564d04e7
cli
cmp eax, 0xfffeeae9
jmp qword [rbx]
and ecx, ebp
fadd st(0)
mov ebx, ebp
stosd dword [rdi], eax
movabs al, byte [0xffff3ae94af572c3]
inc edx
mov al, 0x8d
invalid
ret 0x8db0

Function at 0x18031f4a0
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0x64714607
mov rax, rdx
rol rax, 4
xor rax, rdx
mov rdx, rax
rol rdx, 3
xor rdx, rax
and rdx, 0xffff
mov eax, dword [0x180782b60]
and eax, dword [0x180782b64]
and eax, 0x5719a619
sub eax, 0xa5f821a4
cmpsb byte [rsi], byte [rdi]
sbb dword [rdi + 0x2d], edx
movsb byte [rdi], byte [rsi]
and eax, edi
movsd dword [rdi], dword [rsi]
sub eax, 0x4ca5baaf
cmp eax, 0x98e8642c
ja 0x18031f51c
jmp 0x18031f4e6
mov r8d, dword [0x180782b68]
imul r8d, dword [0x180782b6c]
xor r8d, 0x6a4e3a4d
add r8d, 0x42caf983
and r8d, 0xefe4a493
mov rax, rcx
add rax, rdx
cmp r8d, 0x9cd5255a
ja 0x18031f4e6
jmp 0x18031f51b
ret
scasd eax, dword [rdi]
jae 0x18031f4d0
cmpsb byte [rsi], byte [rdi]
or al, 0xad
adc byte [0x141e59eaf], dh
jmp 0x18031f4e4
Function at 0x18031ff60
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0xffffffffbfc194eb
add r8, 0xffffffffa52082f6
mov r9, r8
rol r9, 1
mov eax, dword [0x180782c60]
sub eax, dword [0x180782c64]
xor eax, 0xc0bef724
sub eax, 0x88bd701e
imul eax, eax, 0x29ad14a8
cmp eax, 0x38d3b593
jbe 0x18031ffda
jmp 0x18031ff9c
mov eax, dword [0x180782c68]
and eax, dword [0x180782c6c]
mov r10d, 0xe91757a8
xor edx, edx
div r10d
and eax, 0x84375add
xor eax, 0xdb6d5136
mov rdx, r9
xor rdx, r8
and rdx, 0xffff
cmp eax, 0x2bb95599
jbe 0x18031ff9c
jmp 0x18031ffd3
add rcx, rdx
mov rax, rcx
ret
pop rsp
test byte [rdx - 0x78], bl
push rdi
jl 0x180320039
wait
jmp 0x18031ff9a
mov eax, dword [0x180782c78]
or eax, dword [0x180782c7c]
and eax, 0xec553245
xor dl, byte [rbp - 0x14]
add eax, 0xf4b98c71
and eax, 0x4e97736e
mov rdx, r10
xor rdx, r8
mov r9, rdx
rol r9, 1
xor r9, rdx
and r9, 0xffff
cmp eax, 0xd60103b
jbe 0x18032002b
jmp 0x180320065
mov eax, dword [0x180782c80]
or eax, dword [0x180782c84]
or eax, 0xe54ddc3f
xor eax, 0xcb040f3
or eax, 0x59f15dd2
cmp eax, 0x59a4e245
je 0x1803200c9
jmp 0x180320089
mov eax, dword [0x180782c88]
xor eax, dword [0x180782c8c]
xor eax, 0x77d4e39f
mov r8d, 0x580333de
xor edx, edx
div r8d
mov edx, eax
xor edx, 0x75ef620f
mov rax, rcx
add rax, r9
cmp edx, 0xd06d172e
je 0x180320089
ret
xchg byte [0x10998ed32], ah
mov dword [rbp + rcx*2 + 0x4c], esp
invalid

Function at 0x180320370
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x180782cd0]
sub ecx, dword [0x180782cd4]
or ecx, 0x7c3298e3
or ecx, 0xbea9d57b
and ecx, 0x92bd295d
cmp ecx, 0x5e8a48c0
jbe 0x1803203fd
jmp 0x18032039b
mov r8d, dword [0x180782cd8]
xor r8d, dword [0x180782cdc]
sub r8d, 0x5905aa7b
sub r8d, 0xb0b66da4
or r8d, 0x30f51e6e
mov rcx, rdx
shr rcx, 0xe
xor rcx, rdx
xor rcx, 0x658a70f2
cmp r8d, 0xffe0fe6f
ja 0x18032039b
jmp 0x1803203da
add rcx, 1
mov rdx, rcx
shr rdx, 2
xor rdx, rcx
mov rcx, rdx
rol rcx, 6
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
ret
cmpsd dword [rsi], dword [rdi]
sub al, 0x9d
sub eax, 0x8e766b7c
jp 0x180320406
invalid
out dx, eax
stc
jmp 0x180320399

Function at 0x180321730
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0xffffffffffffffff
mov r9, r8
rol r9, 3
mov eax, dword [0x180782eb0]
add eax, dword [0x180782eb4]
sub eax, 0x3f741f8d
sub eax, 0x7ffb44c0
add eax, 0x8548489c
cmp eax, 0x25f264d2
jbe 0x1803217ba
jmp 0x180321762
mov eax, dword [0x180782eb8]
or eax, dword [0x180782ebc]
add eax, 0x2d6558c0
mov r10d, 0x100691f0
xor edx, edx
div r10d
mov r10d, 0xe46ee91d
xor edx, edx
div r10d
mov edx, eax
mov rax, r9
xor rax, r8
imul rax, rax, 0xfffffffffbbcfaae
mov r10, rax
rol r10, 6
xor r10, rax
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xba789825
jae 0x180321762
jmp 0x1803217b9
ret
call 0x1499d72f4
out 0x6c, al
std
cmp edx, dword [rcx]
mov cs, word [rdx - 0x33336715]
int3
Function at 0x1803217d0
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0xffffffffd585ff2f
mov r8, rdx
shr r8, 0xf
xor r8, rdx
mov rax, 0xffffffff9e52b39f
sub rax, r8
mov rdx, rax
rol rdx, 2
xor rdx, rax
mov eax, dword [0x180782ec0]
sub eax, dword [0x180782ec4]
imul eax, eax, 0x6ef44851
xor eax, 0xa87723d8
xor eax, 0xe73e8725
cmp eax, 0xb79d7718
je 0x18032185e
jmp 0x18032181a
mov r8d, dword [0x180782ec8]
add r8d, dword [0x180782ecc]
and r8d, 0x1bff38ed
or r8d, 0x50139cb9
and r8d, 0x1c0a8d29
mov r9, rdx
rol r9, 3
xor r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0xa3a7e44d
je 0x18032181a
ret
mov ebp, 0xdf52a4e6
add esp, dword [rcx - 0x334f1425]
int3

Function at 0x180321a60
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x180782ef0]
sub ecx, dword [0x180782ef4]
imul ecx, ecx, 0xa92eb807
and ecx, 0x3bdc15cd
or ecx, 0xad861483
cmp ecx, 0x16b9c03c
jbe 0x180321ae2
jmp 0x180321a8b
mov r8d, dword [0x180782ef8]
add r8d, dword [0x180782efc]
sub r8d, 0x2ddb1be1
or r8d, 0xf696d07b
or r8d, 0x2f90dee5
mov r9, 0xfffffffff3bca7ab
sub r9, rdx
xor r9, 0x7a4bf89c
add r9, 1
mov rcx, r9
rol rcx, 1
xor rcx, r9
cmp r8d, 0x79df9aca
je 0x180321a8b
jmp 0x180321ad7
and rcx, 0xffff
add rax, rcx
ret
iretd

Function at 0x180321af0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x180782f00]
sub eax, dword [0x180782f04]
or eax, 0x51cfd597
imul eax, eax, 0x629a939a
xor eax, 0xf3450408
cmp eax, 0x1d0a2655
je 0x180321bc7
mov eax, dword [0x180782f08]
xor eax, dword [0x180782f0c]
add eax, 0x3075e7fc
imul eax, eax, 0xedad57b5
and eax, 0x5d4b0284
imul r9, rdx, 0x3b0b0a92
mov r8, r9
rol r8, 1
xor r8, r9
add r8, 0x32a43de
cmp eax, 0xd1dd0066
jae 0x180321bc7
jmp 0x180321b53
xor r8, 0x592d34f6
mov rdx, r8
rol rdx, 4
mov eax, dword [0x180782f10]
imul eax, dword [0x180782f14]
or eax, 0x53f98a1a
imul eax, eax, 0xeddd9d6e
xor eax, 0x8bc69489
cmp eax, 0x924de28b
jbe 0x180321bd8
jmp 0x180321b87
mov r9d, dword [0x180782f18]
xor r9d, dword [0x180782f1c]
sub r9d, 0x6b2cea99
xor r9d, 0x9e919f84
and r9d, 0x14e05cf1
mov r10, rdx
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r9d, 0xd8017cee
jae 0x180321b87
ret
xchg r12d, eax
mov esi, 0xc59f55e
pop rbp
push rcx
int 0x4c
jmp 0x180321b17
invalid

Function at 0x180321e40
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x180782f60]
sub ecx, dword [0x180782f64]
and ecx, 0xe4943110
or ecx, 0xfe22609c
imul ecx, ecx, 0xcab97d50
cmp ecx, 0xb790626
jb 0x180321ec7
jmp 0x180321e6b
mov r8d, dword [0x180782f68]
and r8d, dword [0x180782f6c]
sub r8d, 0x5cf342f0
and r8d, 0xc8973cae
sub r8d, 0x9294841a
mov r9, rdx
xor r9, 0x38832ffd
add r9, 0x22a04ef
mov rcx, r9
rol rcx, 1
xor rcx, r9
cmp r8d, 0x31eebfb0
je 0x180321e6b
jmp 0x180321eb3
mov rdx, rcx
rol rdx, 1
xor rdx, rcx
and rdx, 0xffff
add rax, rdx
ret
fadd qword [rbx + rdi*2 - 0x6a5f96f5]
mov bl, 0x9b
push rdx
outsb dx, byte [rsi]
xchg ebx, eax
jmp 0x180321e69