joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1804a0aa0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rax, rcx
add rax, 8
mov rsi, qword [rax]
mov rdi, qword [rcx + 0x10]
cmp rdi, 0
je 0x1804a0b69
xor ecx, ecx
jmp 0x1804a0ac3
mov eax, dword [0x1807aa118]
or eax, dword [0x1807aa11c]
or eax, 0xdb3a4969
mov r8d, 0xdb2caffd
xor edx, edx
div r8d
or eax, 0xa335f2e8
cmp eax, 0x752d4d9a
jbe 0x1804a0b71
jmp 0x1804a0af1
mov r9d, dword [0x1807aa120]
sub r9d, dword [0x1807aa124]
xor r9d, 0xc6c179b2
sub r9d, 0x6d2cf180
sub r9d, 0x28f6d726
imul rdx, rcx, 0x18
mov rax, rsi
add rax, rdx
mov rbx, rcx
add rbx, 1
mov rdx, qword [rax]
cmp rdx, 0
sete r8b
cmp r9d, 0x5a584f79
je 0x1804a0af1
test r8b, 1
jne 0x1804a0b55
jmp 0x1804a0b41
add rax, 8
mov rcx, qword [rax]
mov r8d, 1
call fcn.1804cafa0
jmp 0x1804a0b55
cmp rbx, rdi
sete al
test al, 1
mov rcx, rbx
jne 0x1804a0b67
jmp 0x1804a0ac3
jmp 0x1804a0b69
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
scasb al, byte [rdi]
invalid
Function at 0x1804a44b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r8, rdx
mov rsi, rcx
mov r12, qword [r8]
mov rdi, qword [r8 + 8]
mov rax, rdi
sub rax, r12
mov ecx, 0x18
xor edx, edx
div rcx
mov r13, rax
mov rbp, qword [r8 + 0x10]
xor eax, eax
mov r14, r13
sub r14, rbp
cmovb r14, rax
imul r15, r14, 0x18
xor ecx, ecx
movabs rax, 0x555555555555555
cmp r14, rax
ja 0x1804a453f
cmp r13, rbp
seta al
xor r8d, r8d
mov ebx, 8
test al, 1
jne 0x1804a4519
jmp 0x1804a4547
mov al, byte [0x1807afe04]
mov rcx, r15
mov edx, 8
call fcn.1804caf90
mov rbx, rax
mov ecx, 8
cmp rbx, 0
je 0x1804a453f
mov r8, r14
jmp 0x1804a4547
mov rdx, r15
call fcn.18063bc30
cmp rbp, 0
jne 0x1804a4552
jmp 0x1804a461d
mov eax, dword [0x1807aa6e0]
or eax, dword [0x1807aa6e4]
imul eax, eax, 0x678ce5f8
mov ecx, 0x911f1c9f
xor edx, edx
div ecx
xor eax, 0x3a2ddac2
cmp eax, 0xc6730edb
jae 0x1804a46f5
jmp 0x1804a457f
mov eax, dword [0x1807aa6e8]
imul eax, dword [0x1807aa6ec]
sub eax, 0x7d4f2abf
xor eax, 0xc960d9b8
mov ecx, 0xae83019b
xor edx, edx
div ecx
mov rcx, rbp
add rcx, 0xffffffffffffffff
cmp eax, 0xf991fa28
ja 0x1804a457f
jmp 0x1804a45af
mov eax, dword [0x1807aa6f0]
and eax, dword [0x1807aa6f4]
or eax, 0xd7c2383
imul eax, eax, 0x5b86c9ff
imul eax, eax, 0x925acead
cmp eax, 0xfeb4fd1d
jae 0x1804a4706
mov eax, dword [0x1807aa6f8]
xor edx, edx
div dword [0x1807aa6fc]
add eax, 0xbca12cd5
imul edx, eax, 0xf3a3e442
or edx, 0xc6c23c7
cmp r13, rcx
seta al
cmp edx, 0xf9900b6a
je 0x1804a4706
jmp 0x1804a460a
imul rcx, rbp, 0x18
add r12, rcx
xor r14d, r14d
test al, 1
jne 0x1804a461d
jmp 0x1804a46d6
xor r14d, r14d
cmp r12, rdi
je 0x1804a46d6
mov eax, dword [0x1807aa700]
add eax, dword [0x1807aa704]
add eax, 0x10bf154
sub eax, 0xfa6c837f
imul eax, eax, 0x757419ba
cmp eax, 0xc058ac68
jbe 0x1804a4717
jmp 0x1804a4652
mov eax, dword [0x1807aa708]
xor edx, edx
div dword [0x1807aa70c]
xor eax, 0xfef8be66
sub eax, 0xb23fdc90
or eax, 0xd37508e8
cmp eax, 0x2522fd45
je 0x1804a4652
mov r15, r8
jmp 0x1804a467b
sub rdi, r12
mov ecx, 0x18
mov rax, rdi
xor edx, edx
div rcx
mov r14, rax
xor edi, edi
imul rax, rdi, 0x18
mov rdx, r12
add rdx, rax
lea rcx, [rsp + 0x20]
call fcn.180688140
imul rax, rdi, 0x18
mov rcx, rbx
add rcx, rax
mov rax, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x28]
and al, 0x28
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rcx + 0x10], rax
add rdi, 1
cmp rdi, r14
jne 0x1804a4690
mov r8, r15
jmp 0x1804a46d6
mov qword [rsi], r8
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r14
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
fsub dword [rdx + 0x22]
invalid
sbb eax, dword [rdx - 0x4a0b7347]
loop 0x1804a46b8
invalid
sal dword [rdi], 1
mov dh, 0xd8
jmp 0x1804a45d7
js 0x1804a476c
push rsi
pop rcx
cdq
xchg edi, eax
ja 0x1804a4709
sub al, 0xff
invalid
invalid
Function at 0x1804a6870
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x118
mov qword [rsp + 0x88], r8
mov r10, rdx
mov qword [rsp + 0x58], rcx
mov rdi, r10
add rdi, 0x10
mov r13, qword [r10 + 0x10]
mov r12, qword [r10]
mov edx, 0x2000
cmp qword [rsp + 0x88], 0
mov qword [rsp + 0x40], r12

Function at 0x1804aa450
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], rcx
mov eax, dword [0x1807aafc0]
add eax, dword [0x1807aafc4]
or eax, 0xa9ea22de
imul eax, eax, 0x6213bced
add eax, 0xded21260
cmp eax, 0x89295abc
jae 0x1804ab19f
Function at 0x1804b7a80
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x1807ac5c8]
add eax, dword [0x1807ac5cc]
or eax, 0x2a6b9173
xor eax, 0xea1d1bf0
add eax, 0xa7f8a120
cmp eax, 0x65f9aa9d
je 0x1804b7b74
mov eax, dword [0x1807ac5d0]
xor eax, dword [0x1807ac5d4]
and eax, 0xd7e26389
add eax, 0x91d1dc5
mov r8d, 0xc7650ab8
xor edx, edx
div r8d
mov rsi, qword [rcx]
mov rdx, rsi
add rdx, 0x10
cmp eax, 0x22981bfe
je 0x1804b7b74
jmp 0x1804b7ae3
mov rcx, rdx
call fcn.1804b6c60
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete al
test al, 1
jne 0x1804b7b6e
jmp 0x1804b7afe
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete al
test al, 1
jne 0x1804b7b12
jmp 0x1804b7b6e
mov rcx, rsi
mov edx, 0x38
mov r8d, 8
call fcn.1804cafa0
mov eax, dword [0x1807ac5d8]
and eax, dword [0x1807ac5dc]
xor eax, 0x2faa47e4
or eax, 0x290c9a77
imul eax, eax, 0x3abb2ab9
cmp eax, 0xeaee9d81
ja 0x1804b7b81
invalid
jmp 0x1804b7b4a
mov eax, dword [0x1807ac5e0]
xor eax, dword [0x1807ac5e4]
and eax, 0xbe35339c
xor eax, 0xadde35ce
xor eax, 0xb04c76f7
cmp eax, 0xf5f6a223
ja 0x1804b7b4a
jmp 0x1804b7b6e
add rsp, 0x20
pop rsi
ret
loopne 0x1804b7b35
sbb eax, 0xf8096413
test ecx, ebp
sub bh, bh
invalid
mov edi, 0x69e86241
stosd dword [rdi], eax
invalid
Function at 0x1804b7d10
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [rcx]
mov rax, rsi
add rax, 0x10
mov rcx, qword [rax]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [0x1807ac610]
and eax, dword [0x1807ac614]
xor eax, 0xb0047a5c
and eax, 0x56669c44
sub eax, 0x5196d45a
cmp eax, 0xd4e7d676
ja 0x1804b7eb8
jmp 0x1804b7d50
mov eax, dword [0x1807ac618]
add eax, dword [0x1807ac61c]
xor eax, 0xad858abb
imul ecx, eax, 0x509249b7
or ecx, 0xae05bb6d
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete al
cmp ecx, 0x7389673
je 0x1804b7d50
test al, 1
jne 0x1804b7eb2
jmp 0x1804b7d8c
mov eax, dword [0x1807ac620]
xor edx, edx
div dword [0x1807ac624]
and eax, 0x982da014
imul eax, eax, 0x6a4d3b97
and eax, 0x5f4c234
cmp eax, 0xc2002f8a
je 0x1804b7ec5
jmp 0x1804b7db7
mov ecx, dword [0x1807ac628]
imul ecx, dword [0x1807ac62c]
or ecx, 0xfe6a71b5
add ecx, 0xe7a7a2f5
add ecx, 0xb815a651
mov rax, rsi
add rax, 8
cmp ecx, 0x92787d1a
jb 0x1804b7db7
jmp 0x1804b7de7
mov rcx, 0xffffffffffffffff
lock xadd qword [rax], rcx
mov eax, dword [0x1807ac630]
or eax, dword [0x1807ac634]
or eax, 0x49e30e0e
mov r8d, 0x628b1379
xor edx, edx
div r8d
imul eax, eax, 0x224e623e
cmp eax, 0xac2a0c79
ja 0x1804b7ed6
jmp 0x1804b7e22
mov edx, dword [0x1807ac638]
xor edx, dword [0x1807ac63c]
or edx, 0x859a2a42
and edx, 0x7bcd3be1
sub edx, 0x6c6bdca7
cmp rcx, 1
sete al
cmp edx, 0x8b9d2e5c
jbe 0x1804b7e22
test al, 1
jne 0x1804b7e55
jmp 0x1804b7eb2
mov eax, dword [0x1807ac640]
xor edx, edx
div dword [0x1807ac644]
xor eax, 0xd4598781
or eax, 0xcd14f00a
imul eax, eax, 0x139fdc8b
cmp eax, 0xd021f378
jb 0x1804b7ee7
jmp 0x1804b7e7c
mov eax, dword [0x1807ac648]
mov ecx, dword [0x1807ac64c]
xor eax, ecx
or eax, 0xffc7f7bf
add eax, 0x58eb8028
cmp eax, 0xe6593a0
je 0x1804b7e7c
jmp 0x1804b7e9d
mov rcx, rsi
mov edx, 0x18
mov r8d, 8
call fcn.1804cafa0
jmp 0x1804b7eb2
add rsp, 0x20
pop rsi
ret
xlatb
in al, dx
popfq
invalid
jg 0x1804b7f21
sub al, 0x65
mov ch, 0x19
fsubr qword [0x10ac21c90]
jmp 0x1804b7db5
invalid
or dword [rsi + rax*8 - 0x12244b41], edi
invalid
Function at 0x1804b7f00
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x1807ac650]
add eax, dword [0x1807ac654]
add eax, 0x3287d723
mov r8d, 0x425a5a6c
xor edx, edx
div r8d
add eax, 0x7161cf26
cmp eax, 0xaa2e5dea
je 0x1804b8080
jmp 0x1804b7f33
mov eax, dword [0x1807ac658]
or eax, dword [0x1807ac65c]
mov r8d, 0x2cdabbe0
xor edx, edx
div r8d
xor eax, 0x4024110c
xor eax, 0xf9153440
mov rsi, qword [rcx]
mov rdx, qword [rsi + 0x10]
cmp eax, 0x9d818591
jbe 0x1804b7f33
jmp 0x1804b7f64
mov eax, dword [0x1807ac660]
add eax, dword [0x1807ac664]
add eax, 0x7ee79baf
sub eax, 0x7ed58541
imul eax, eax, 0x36b900b
cmp eax, 0xa1a2115b
je 0x1804b808d
mov eax, dword [0x1807ac668]
add eax, dword [0x1807ac66c]
sub eax, 0x66ff8b55
xor eax, 0x2688de3c
imul ecx, eax, 0x838ffda1
cmp rdx, 0
sete al
cmp ecx, 0xe3af3247
jbe 0x1804b808d
jmp 0x1804b7fbc
test al, 1
jne 0x1804b7fcf
jmp 0x1804b7fc2
mov rcx, qword [rsi + 0x18]
add rdx, 0x18
mov rax, qword [rdx]
call rax
mov rax, qword [rsi + 0x28]
cmp rax, 0
sete cl
test cl, 1
jne 0x1804b7ff0
jmp 0x1804b7fe1
mov rcx, rsi
add rcx, 0x30
mov rcx, qword [rcx]
call qword [rax + 0x18]
jmp 0x1804b7ff0
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete al
mov ecx, dword [0x1807ac670]
or ecx, dword [0x1807ac674]
or ecx, 0x1caa3abf
or ecx, 0x44e71e80
imul ecx, ecx, 0x14f45b0a
cmp ecx, 0x77ca2b49
jae 0x1804b809a
mov ecx, dword [0x1807ac678]
sub ecx, dword [0x1807ac67c]
sub ecx, 0xa5dbcd49
and ecx, 0x7bdb28c5
sub ecx, 0xe7cad6e3
cmp ecx, 0x3ae37895
jbe 0x1804b809a
invalid
test al, 1
jne 0x1804b807a
jmp 0x1804b804f
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete al
jmp 0x1804b805f
test al, 1
jne 0x1804b8065
jmp 0x1804b807a
mov rcx, rsi
mov edx, 0x40
mov r8d, 8
call fcn.1804cafa0
jmp 0x1804b807a
add rsp, 0x20
pop rsi
ret
jb 0x1804b802b
and al, 0xa2
xor al, 0x19
imul cl
movsb byte [rdi], byte [rsi]
invalid
push rdx
sub al, 0xfb
sub al, ch
test byte [r9], spl
jmp 0x1804b7f8b
int1
invalid
mov cl, bl
lodsb al, byte [rsi]
fisubr word [rcx]
jg 0x1804b8096
sub esi, dword [rbx + 0x37]
clc
xor ebp, ecx
js 0x1804b80a8
invalid
invalid
Function at 0x1804b90a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, dword [0x1807ac870]
or eax, dword [str._VJx]
and eax, 0xd78b63cd
mov r8d, 0x2493bbbe
xor edx, edx
div r8d
or eax, 0xf00ef02c
cmp eax, 0x56a42e62
je 0x1804b96dc
mov eax, dword [0x1807ac878]
imul eax, dword [0x1807ac87c]
sub eax, 0xde88b651
Function at 0x1804bb540
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rsi, qword [rcx]
mov eax, dword [0x1807accf0]
xor edx, edx
div dword [0x1807accf4]
Function at 0x1804be380
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rsi
add rbx, 0x10
mov eax, dword [0x1807ad298]
sub eax, dword [0x1807ad29c]
or eax, 0x4fd18921
imul eax, eax, 0x8a43583b
add eax, 0x311c02d5
cmp eax, 0xd3e4b14f
jae 0x1804be6ae
mov edi, 0xf84d8b9b
lodsb al, byte [rsi]
pop rbp
enter 0x3e9, 0xfffffffffffffffd
invalid
Function at 0x1804c0f60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1807ad7f8]
or eax, dword [0x1807ad7fc]
imul eax, eax, 0x119540c5
sub eax, 0x12c5014c
or eax, 0xd0baf9a8
cmp eax, 0x9b4c96f3
je 0x1804c109a
mov eax, dword [0x1807ad800]
xor eax, dword [0x1807ad804]
sub eax, 0xd4a75a79
xor eax, 0x62484315
add eax, 0xecbd93a4
cmp rcx, 0
setne dl
cmp eax, 0xbc19ba68
je 0x1804c109a
jmp 0x1804c0fba
mov rax, 0xffffffffffffffff
cmp rcx, rax
je 0x1804c1095
mov rax, 0xffffffffffffffff
lock xadd qword [rcx + 8], rax
mov edx, dword [0x1807ad808]
sub edx, dword [0x1807ad80c]
or edx, 0xf7b830bf
add edx, 0xff12b27e
xor edx, 0x6e83e309
cmp edx, 0xba815f4b
je 0x1804c10ab
jmp 0x1804c1003
mov edx, dword [0x1807ad810]
and edx, dword [0x1807ad814]
imul r8d, edx, 0xeae86b95
xor r8d, 0x980af60d
or r8d, 0x3a23633c
cmp rax, 1
sete dl
cmp r8d, 0xcecef44b
je 0x1804c1003
jmp 0x1804c1036
test dl, 1
jne 0x1804c103d
jmp 0x1804c1095
mov edx, 0x18
mov r8d, 8
call fcn.1804cafa0
mov eax, dword [0x1807ad818]
sub eax, dword [0x1807ad81c]
xor eax, 0x2a6d3a09
and eax, 0x5bae816c
add eax, 0xc7dc54b0
cmp eax, 0x9928977e
jb 0x1804c10b8
mov eax, dword [0x1807ad820]
xor edx, edx
div dword [0x1807ad824]
or eax, 0xcc8f27cc
xor eax, 0x6a1f507b
xor eax, 0x7dd79167
cmp eax, 0xb020620b
jbe 0x1804c10b8
jmp 0x1804c1095
add rsp, 0x28
ret
invalid
insd dword [rdi], dx
adc al, 0x9b
rcr byte [rcx + 0x77], 0x94
jmp 0x1804c1001
jmp 0x1804c106d
Function at 0x1804c1900
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, qword [rcx]
add rcx, 8
mov r14, qword [rcx]
mov rbx, qword [r14 + 0x10]
mov r15, qword [r14]
cmp r15, 0
je 0x1804c1a40
mov eax, dword [0x1807ad928]
imul eax, dword [0x1807ad92c]
mov ecx, 0xb8bc197f
xor edx, edx
div ecx
add eax, 0xe381f81d
or eax, 0xd4f383e4
cmp eax, 0x2037a385
jb 0x1804c1b1e
mov eax, dword [0x1807ad930]
sub eax, dword [0x1807ad934]
or eax, 0x2bb17081
add eax, 0x99981a2a
and eax, 0x70835d18
mov rcx, rbx
add rcx, 0xffffffffffffffff
cmp eax, 0x83ebb657
je 0x1804c1b1e
jmp 0x1804c1981
mov eax, dword [0x1807ad938]
imul eax, dword [0x1807ad93c]
imul eax, eax, 0x5cf15871
and eax, 0x83e0d189
mov r8d, 0x67839a83
xor edx, edx
div r8d
cmp eax, 0xa014c328
jae 0x1804c1b2f
jmp 0x1804c19b1
mov eax, dword [0x1807ad940]
xor eax, dword [0x1807ad944]
and eax, 0x4f33f56
mov r8d, 0x3335d3b8
xor edx, edx
div r8d
and eax, 0x728c94a
mov rdx, rcx
and rdx, 0xfffffffffffffff0
add rdx, 0x10
mov rdi, rsi
add rdi, rdx
cmp eax, 0xe3bccbb2
jae 0x1804c19b1
jmp 0x1804c19ec
mov eax, dword [0x1807ad948]
sub eax, dword [0x1807ad94c]
and eax, 0xe81deabf
xor eax, 0xc3af0997
and eax, 0xc47c69ff
cmp eax, 0x8ce48854
jbe 0x1804c1b3c
jmp 0x1804c1a14
mov eax, dword [0x1807ad950]
sub eax, dword [0x1807ad954]
and eax, 0xf657aacb
sub eax, 0x65b6d81d
imul ebp, eax, 0xd7652c26
mov rcx, rdi
call r15
cmp ebp, 0xafa62c8a
ja 0x1804c1a14
jmp 0x1804c1a40
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete al
test al, 1
jne 0x1804c1b11
jmp 0x1804c1a57
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete al
test al, 1
jne 0x1804c1a6e
jmp 0x1804c1b11
mov rax, qword [r14 + 8]
mov rcx, rbx
sub rcx, 9
mov r8d, 8
cmovae r8, rbx
mov r9, r8
add r9, 0xf
add r9, rax
xor eax, eax
sub rax, r8
and r9, rax
movabs rax, 0x8000000000000001
cmp r8, rax
setb al
mov eax, dword [0x1807ad958]
sub eax, dword [0x1807ad95c]
or eax, 0x851c686a
add eax, 0x9e24f4b3
mov ecx, 0xef021f11
xor edx, edx
div ecx
cmp eax, 0x34c1e333
jae 0x1804c1b4f
jmp 0x1804c1ad1
mov ecx, dword [0x1807ad960]
xor ecx, dword [0x1807ad964]
or ecx, 0xfa45e7a1
and ecx, 0xbe77952a
or ecx, 0xf926e1a
cmp r9, 0
sete al
cmp ecx, 0x33c9f2fa
jb 0x1804c1ad1
test al, 1
jne 0x1804c1b11
jmp 0x1804c1b04
mov rcx, rsi
mov rdx, r9
call fcn.1804cafa0
jmp 0x1804c1b11
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
invalid
mov esp, 0xf65190f2
adc rax, 0xfffffffffe73e969
invalid
add byte [rdi + rdi*4], dl
xor edi, 0xffffff95
xchg edx, eax
test eax, 0x41f98948
call rdi
jmp 0x1804c1a12
movsb byte [rdi], byte [rsi]
invalid
Function at 0x1804c2d70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov eax, dword [0x1807adba8]
imul eax, dword [0x1807adbac]
xor eax, 0x96efc658
mov r8d, 0x196388ee
xor edx, edx
div r8d
mov r8d, 0xe402940b
xor edx, edx
div r8d
cmp eax, 0x50ea0120
jae 0x1804c2eed
mov eax, dword [0x1807adbb0]
and eax, dword [0x1807adbb4]
imul eax, eax, 0xb415270a
and eax, 0x87851c12
imul edx, eax, 0xedde8768
mov rsi, qword [rcx]
mov rdi, rsi
add rdi, 0x10
mov rax, qword [rsi + 0x10]
lock dec qword [rax]
sete al
cmp edx, 0x6d5484fe
jb 0x1804c2eed
jmp 0x1804c2dea
jmp 0x1804c2dec
test al, 1
jne 0x1804c2df2
jmp 0x1804c2e55
mov eax, dword [0x1807adbb8]
xor edx, edx
div dword [0x1807adbbc]
sub eax, 0x9b07a7aa
and eax, 0xc5a7723b
mov ecx, 0x97f1fd77
xor edx, edx
div ecx
cmp eax, 0x64e4f926
je 0x1804c2f05
mov eax, dword [0x1807adbc0]
imul eax, dword [0x1807adbc4]
imul eax, eax, 0xce236c85
imul ebx, eax, 0xf5f73894
add ebx, 0x1ebd9aa9
mov rcx, rdi
call fcn.1804c3d10
cmp ebx, 0x39523fb7
jae 0x1804c2f05
jmp 0x1804c2e53
jmp 0x1804c2e55
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete al
test al, 1
jne 0x1804c2ee5
jmp 0x1804c2e68
mov eax, dword [0x1807adbc8]
or eax, dword [0x1807adbcc]
xor eax, 0xdbb0c576
imul eax, eax, 0x74262222
or eax, 0x7e641478
cmp eax, 0x28a9bf9c
je 0x1804c2f1e
jmp 0x1804c2e91
mov eax, dword [0x1807adbd0]
xor eax, dword [0x1807adbd4]
sub eax, 0xf3d99159
mov ecx, 0xda1b86c0
xor edx, edx
div ecx
add eax, 0xdd23de6e
mov rcx, rsi
add rcx, 8
lock dec qword [rcx]
sete cl
cmp eax, 0x5c235dac
jb 0x1804c2e91
jmp 0x1804c2ec7
jmp 0x1804c2ec9
test cl, 1
jne 0x1804c2ed0
jmp 0x1804c2ee5
mov rcx, rsi
mov edx, 0x28
mov r8d, 8
call fcn.1804cafa0
jmp 0x1804c2ee5
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
sahf
xor ch, byte [rsi - 0x379c2b6e]
insb byte [rdi], dx
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
lock dec qword [rax]
jmp 0x1804c2daa
sub bh, byte [rcx - 0x155c9629]
nop
iretd
invalid
Function at 0x1804c2f40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov eax, dword [0x1807adbd8]
or eax, dword [0x1807adbdc]
add eax, 0x5bab784f
imul eax, eax, 0xf6989b66
imul eax, eax, 0xea0b6463
cmp eax, 0x3652f7bd
jae 0x1804c30f3
jmp 0x1804c2f71
mov eax, dword [0x1807adbe0]
xor edx, edx
div dword [0x1807adbe4]
add eax, 0x52490303
and eax, 0x9511092
imul edx, eax, 0x8b1f1cee
mov rax, 0xffffffffffffffff
cmp rcx, rax
sete al
cmp edx, 0xed66e443
ja 0x1804c2f71
jmp 0x1804c2fa6
test al, 1
jne 0x1804c30ee
jmp 0x1804c2fb0
mov eax, dword [0x1807adbe8]
and eax, dword [0x1807adbec]
mov r9d, 0xf9ffe135
xor edx, edx
div r9d
or eax, 0xd71223fb
and eax, 0xa4446054
cmp eax, 0x47c6985c
jbe 0x1804c3104
jmp 0x1804c2fde
mov eax, dword [0x1807adbf0]
or eax, dword [0x1807adbf4]
sub eax, 0xf745cd8a
imul edx, eax, 0x76637f31
add edx, 0xb8e5f997
mov rax, rcx
add rax, 8
cmp edx, 0xf090c92f
je 0x1804c2fde
jmp 0x1804c300c
lock dec qword [rax]
sete al
test al, 1
jne 0x1804c301c
jmp 0x1804c30ee
mov eax, dword [0x1807adbf8]
and eax, dword [0x1807adbfc]
or eax, 0x1df68790
or eax, 0x8f9fce8a
or eax, 0xb023c572
cmp eax, 0x7a42787b
jb 0x1804c3115
mov eax, dword [0x1807adc00]
xor eax, dword [0x1807adc04]
xor eax, 0xe1632975
xor eax, 0xc800d6e8
xor eax, 0xda3a9d62
mov r9, r8
add r9, 0x17
cmp eax, 0xef2ea7f6
ja 0x1804c3115
jmp 0x1804c3071
mov eax, dword [0x1807adc08]
xor edx, edx
div dword [0x1807adc0c]
mov r8d, 0x6268c303
xor edx, edx
div r8d
imul eax, eax, 0x93127652
imul eax, eax, 0x7882831
cmp eax, 0xd2c2a61c
jae 0x1804c3126
mov r8d, dword [0x1807adc10]
xor r8d, dword [0x1807adc14]
xor r8d, 0xd2fc0aaf
sub r8d, 0xe77a1bc2
sub r8d, 0x3aa1f5d1
mov rdx, r9
and rdx, 0xfffffffffffffff8
cmp rdx, 0
sete al
cmp r8d, 0x8cccb3f
jbe 0x1804c3126
test al, 1
jne 0x1804c30ee
jmp 0x1804c30e1
mov r8d, 8
call fcn.1804cafa0
jmp 0x1804c30ee
add rsp, 0x28
ret
movabs al, byte [0x34f1c48c5605ed5e]
invalid
mov ecx, 0xcca9e1b1
js 0x1804c3178
shl dword [rax - 0x16fdca85], cl
invalid
push 0xffffffffffffff9a
in eax, dx
clc
mov dh, 0xa0
push rbp
nop
outsb dx, byte [rsi]
mov dword [rdi], edx
jmp 0x1804c3042
mov cl, 0x13
xchg dword [rax], ebp
mov ebp, 0xe9d3ce7c
outsb dx, byte [rsi]
invalid
movsb byte [rdi], byte [rsi]
stosb byte [rdi], al
add byte cs:[rbx], ah
add eax, 0x2eaaa2
Function at 0x1804c34a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x1807adc88]
or eax, dword [0x1807adc8c]
and eax, 0x36146daa
xor eax, 0x809d5b30
or eax, 0x92dc1f73
cmp eax, 0x1afb68d5
je 0x1804c3901
jmp 0x1804c34d3
cwde
int 0x3f
scasb al, byte [rdi]
cmp bh, byte [rdi + 0x6b]
jmp 0x1804c34d1
Function at 0x1804c75d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, rsi
add rcx, 0x10
call fcn.18045daa0
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete al
test al, 1
jne 0x1804c767a
jmp 0x1804c75fb
mov rcx, rsi
add rcx, 8
mov eax, dword [0x1807ae4b8]
sub eax, dword [0x1807ae4bc]
add eax, 0x9759caac
sub eax, 0xa5afb311
mov r8d, 0x6c5b57f3
xor edx, edx
div r8d
cmp eax, 0x84ca5c3c
ja 0x1804c76c7
jmp 0x1804c7630
mov edx, dword [0x1807ae4c0]
sub edx, dword [0x1807ae4c4]
or edx, 0xcbe8b785
xor edx, 0x4dd45029
and edx, 0xe2f601d9
lock dec qword [rcx]
sete al
cmp edx, 0x7d4ebcc1
jbe 0x1804c7630
jmp 0x1804c765f
test al, 1
jne 0x1804c7665
jmp 0x1804c767a
mov rcx, rsi
mov edx, 0x40
mov r8d, 8
call fcn.1804cafa0
jmp 0x1804c767a
mov eax, dword [0x1807ae4c8]
xor eax, dword [0x1807ae4cc]
xor eax, 0xbde8050
and eax, 0xd3b4cfc2
or eax, 0xaf0fdffe
cmp eax, 0xde468c01
jae 0x1804c76db
mov eax, dword [0x1807ae4d0]
xor edx, edx
div dword [0x1807ae4d4]
sub eax, 0xf7e85f55
and eax, 0x57c5f2d9
imul eax, eax, 0x38b475c8
cmp eax, 0x8859573
jbe 0x1804c76db
add rsp, 0x20
pop rsi
ret
or eax, 0xa4d0aee7
fdivr dword [rcx + 0x68]
lock dec qword [rcx]
sete al
jmp 0x1804c762e
invalid
Function at 0x1804c8430
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1807ae688]
xor edx, edx
div dword [0x1807ae68c]
sub eax, 0xd296b181
and eax, 0xe6996d49
imul eax, eax, 0x906a6355
cmp eax, 0x9a049d2a
je 0x1804c85cd
jmp 0x1804c8463
mov eax, dword [0x1807ae690]
or eax, dword [0x1807ae694]
and eax, 0x92cbf1a1
xor eax, 0x7906090
and eax, 0x5c001cd7
mov rcx, rsi
add rcx, 0x10
cmp eax, 0x3dd7ffc9
je 0x1804c8463
jmp 0x1804c848e
call fcn.18045ced0
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete al
test al, 1
jne 0x1804c85c7
jmp 0x1804c84aa
mov eax, dword [0x1807ae698]
xor eax, dword [0x1807ae69c]
imul eax, eax, 0xff832501
mov ecx, 0xea602f26
xor edx, edx
div ecx
imul eax, eax, 0x1e515e2e
cmp eax, 0x3d319a10
jae 0x1804c85da
mov eax, dword [0x1807ae6a0]
add eax, dword [0x1807ae6a4]
and eax, 0xa42a50
and eax, 0xc71a4ec3
add eax, 0x5dd024b8
mov rcx, rsi
add rcx, 8
cmp eax, 0x5b3c9750
jbe 0x1804c85da
jmp 0x1804c8505
mov eax, dword [0x1807ae6a8]
add eax, dword [0x1807ae6ac]
and eax, 0x779885ee
and eax, 0x2488d064
imul eax, eax, 0x1cbca860
cmp eax, 0x14162584
jbe 0x1804c85e7
jmp 0x1804c852e
mov eax, dword [0x1807ae6b0]
xor edx, edx
div dword [0x1807ae6b4]
and eax, 0xd24ed28a
imul edx, eax, 0x483ed917
xor edx, 0x1977e73a
lock dec qword [rcx]
sete al
cmp edx, 0x55402952
ja 0x1804c852e
jmp 0x1804c855e
test al, 1
jne 0x1804c8564
jmp 0x1804c85c7
mov rcx, rsi
mov edx, 0x40
mov r8d, 8
call fcn.1804cafa0
mov eax, dword [0x1807ae6b8]
and eax, dword [0x1807ae6bc]
xor eax, 0x85adf0f4
mov ecx, 0x3608a789
xor edx, edx
div ecx
sub eax, 0xcd0ebdd5
cmp eax, 0x61188b1a
ja 0x1804c85f8
jmp 0x1804c859f
add byte [rbx + 0x2e611b05], cl
add byte [rbx], dh
add eax, 0x2e6119
mov eax, dword [0x1807ae6c0]
xor eax, dword [0x1807ae6c4]
mov ecx, 0xfd7f3ad
xor edx, edx
div ecx
sub eax, 0xf11a7418
sub eax, 0xbeccc22c
cmp eax, 0x91e085f9
ja 0x1804c859f
jmp 0x1804c85c7
add rsp, 0x20
pop rsi
ret
jge 0x1804c85de
and ah, byte [rcx]
invalid
jae 0x1804c8622
adc rax, 0x54e93e28
jmp 0x1804c84d6
sub byte [rsi], bh
jmp 0x17f3c6f39
popfq
sub esi, dword [rdx + 0x75]
invalid
xor eax, 0xe1bc5841
jp 0x1804c859e
sar byte [rdi - 0x14cf283c], 0x97
int3
add esi, 0x10
Function at 0x1804c9720
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rsi
mov rdx, rdi
call fcn.1806405a0
mov r8, qword [rdi]
cmp r8, 0
je 0x1804c97f9
mov eax, dword [0x1807ae900]
or eax, dword [0x1807ae904]
imul eax, eax, 0x521df1cb
sub eax, 0x259a1d2
sub eax, 0xa9bb2334
cmp eax, 0xbbbff573
je 0x1804c9803
jmp 0x1804c976d
mov eax, dword [0x1807ae908]
sub eax, dword [0x1807ae90c]
xor eax, 0xc1bdec37
imul eax, eax, 0xf0f8948
mov ecx, 0xd213d597
xor edx, edx
div ecx
mov rcx, rdi
add rcx, 8
cmp eax, 0x8a26ca6d
jae 0x1804c976d
jmp 0x1804c979d
mov rcx, qword [rcx]
mov rdx, r8
mov r8d, 1
call fcn.1804cafa0
mov eax, dword [0x1807ae910]
and eax, dword [0x1807ae914]
or eax, 0x94dccbb4
and eax, 0xb551d1f6
imul eax, eax, 0x637489dd
cmp eax, 0x706453b1
jb 0x1804c9814
mov eax, dword [str.zAx_]
xor eax, dword [0x1807ae91c]
mov ecx, 0xde8ea101
xor edx, edx
div ecx
and eax, 0x81ec5c5b
sub eax, 0x5888bcf2
cmp eax, 0x973119
je 0x1804c9814
jmp 0x1804c97f9
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
retf
test bh, dl
or ah, byte [rax + 0x589937c9]
jmp 0x1804c97d1