joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400baed0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [0x1400ef020]
mov rdi, rax
test rax, rax
jne 0x1400baf12
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400baf59
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400bafb2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400baf70
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400baff3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400cf5ea]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400cf5eb]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400bafc0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400bb010
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400bb04a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400bb04f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400bb098
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400bb098
dec r8
sub rdx, 1
jne 0x1400bb07e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400bc958
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400bc9a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400bc9a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400bc9a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400bc9a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400bc9a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400bc9a4
xor al, al
add rsp, 0x28
ret
Function at 0x1800033e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, rcx
mov r11, qword [rdx]
mov r10, qword [r11 + 0x10]
cmp r10, 0xfb
mov qword [rsp + 0x18], r10
jb 0x180003473
mov eax, dword [0x18074d3a8]
and eax, dword [0x18074d3ac]
mov ecx, 0x3fbb283d
xor edx, edx
div ecx
sub eax, 0x5440dcbc
xor eax, 0x6c3fea03
cmp eax, 0xc3fdbb15
jb 0x180003e4a
mov eax, dword [0x18074d3b0]
sub eax, dword [0x18074d3b4]
mov ecx, 0x23dbeddb
xor edx, edx
div ecx
and eax, 0xaff3949d
mov rbp, qword [r8]
add rbp, 1
mov eax, dword [0x18074d3b8]
or eax, dword [0x18074d3bc]
sub eax, 0x153cfb07
add eax, 0xc2690882
imul eax, eax, 0x366261e4
cmp eax, 0x2225b46
jbe 0x180003e5b
mov eax, dword [0x18074d3c0]
xor eax, dword [0x18074d3c4]
xor eax, 0x6dc88dab
add eax, 0x79366914
imul eax, eax, 0xcac02251
cmp eax, 0xf04c4cfe
je 0x180003e5b
jmp 0x1800036a8
out dx, eax
test al, 0xf5
in eax, dx
jge 0x180003ed6
push 0xffffffffffffffe9
cmp esi, esi
invalid
jmp 0x180003775
Function at 0x1802c34d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0xffffffff893fa1fe
add rdx, 0x202cd8a6
mov rcx, rdx
rol rcx, 6
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
mov ecx, dword [0x1807793d0]
and ecx, dword [0x1807793d4]
and ecx, 0xdee8d295
add ecx, 0x6b6dfc07
and ecx, 0x913c209a
cmp ecx, 0xc931b376
je 0x1802c3544
jmp 0x1802c351d
mov ecx, dword [0x1807793d8]
xor ecx, dword [0x1807793dc]
sub ecx, 0xa66b238e
xor ecx, 0x73ab74b5
and ecx, 0x5a400f2a
cmp ecx, 0x744d94c6
je 0x1802c351d
ret
mov esi, dword [rbp - 0x7a]
sahf
iretd

Function at 0x1802c3590
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
mov r9, r8
add r9, 0x2df05aa5
mov eax, dword [0x1807793e0]
or eax, dword [0x1807793e4]
add eax, 0x33939492
or eax, 0x173ffcd
mov r10d, 0x9bdb414e
xor edx, edx
div r10d
cmp eax, 0xbd53f08d
je 0x1802c3628
jmp 0x1802c35c7
mov eax, dword [0x1807793e8]
and eax, dword [0x1807793ec]
imul eax, eax, 0xa8945e88
imul edx, eax, 0xf44079fd
and edx, 0xbee3a885
mov rax, r9
shr rax, 0x28
mov r10, 0xffffffffd20fa55a
sub r10, r8
xor r10, rax
movabs rax, 0xfffffffffff
xor r10, rax
mov r11, r10
rol r11, 2
xor r11, r10
and r11, 0xffff
mov rax, rcx
add rax, r11
cmp edx, 0x1a12860
jb 0x1802c35c7
jmp 0x1802c3627
ret
enter 0x6e50, 0xfffffffffffffffd
clc
pop rbx
in al, dx
jmp 0x1802c35c5

Function at 0x1802c3640
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1807793f0]
imul eax, dword [0x1807793f4]
mov r9d, 0x548bfa05
xor edx, edx
div r9d
mov r9d, 0x5af0be25
xor edx, edx
div r9d
and eax, 0xa0ab0a0a
cmp eax, 0x7029314d
ja 0x1802c36c6
jmp 0x1802c3674
mov edx, dword [0x1807793f8]
xor edx, dword [0x1807793fc]
and edx, 0x64b6ed8a
or edx, 0x82a8011c
sub edx, 0x46fa47bc
mov rax, r8
add rax, 0xffffffffbdbf1c69
cmp edx, 0xb7d95c13
ja 0x1802c3674
jmp 0x1802c36a5
mov rdx, rax
rol rdx, 5
xor rdx, rax
mov rax, rdx
rol rax, 3
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
call 0x1a92118fa
fsub dword [rdx + 0x49a2eb63]
mov r8, rdx
mov eax, dword [0x180779400]
xor edx, edx
div dword [0x180779404]
xor eax, 0xa8abe7f9
add eax, 0x6b6b0b08
or eax, 0x18983f24
cmp eax, 0x252a0ff9
jae 0x1802c3746
jmp 0x1802c36f9
mov edx, dword [0x180779408]
or edx, dword [0x18077940c]
or edx, 0x1bf0a1c9
add edx, 0x7abf4b1b
xor edx, 0xc5ea3228
imul rax, r8, 0x6fed226b
cmp edx, 0x93d8644e
jb 0x1802c36f9
jmp 0x1802c3728
xor rax, 0xb364c1e
mov rdx, rax
rol rdx, 6
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
ret
Function at 0x1802c3e30
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1807794b0]
imul eax, dword [0x1807794b4]
or eax, 0xd040a573
or eax, 0xe06e02c4
xor eax, 0x8aa67bae
cmp eax, 0x8ac1a327
ja 0x1802c3f51
mov eax, dword [0x1807794b8]
and eax, dword [0x1807794bc]
mov r9d, 0xb0f98ebd
xor edx, edx
div r9d
imul eax, eax, 0xa8beb9cb
add eax, 0x672c706
xor r9d, r9d
sub r9, r8
xor r9, 0xffffffffca94bf83
cmp eax, 0xd2f2a9c9
ja 0x1802c3f51
jmp 0x1802c3e96
mov eax, dword [0x1807794c0]
imul eax, dword [0x1807794c4]
and eax, 0x20b4d6b2
mov r8d, 0xe3f4333
xor edx, edx
div r8d
add eax, 0xba5511f7
cmp eax, 0x1edba9f4
je 0x1802c3f62
jmp 0x1802c3ec5
mov eax, dword [0x1807794c8]
sub eax, dword [0x1807794cc]
imul eax, eax, 0xff64994d
or eax, 0x7374cb9a
sub eax, 0xfc827a77
mov r8, r9
rol r8, 6
xor r8, r9
cmp eax, 0x671e54ec
je 0x1802c3ec5
jmp 0x1802c3ef4
mov eax, dword [0x1807794d0]
or eax, dword [0x1807794d4]
mov r9d, 0x3fce13e2
xor edx, edx
div r9d
sub eax, 0xf2bf892f
and eax, 0x14dd4095
cmp eax, 0xdfd59d8f
je 0x1802c3f73
mov eax, dword [0x1807794d8]
and eax, dword [0x1807794dc]
and eax, 0x1c5b12e0
sub eax, 0xf385cb11
imul edx, eax, 0x48251cb
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xcc1ac739
je 0x1802c3f73
ret
jae 0x1802c3fc5
dec byte [rcx + 0x71]
invalid
push rax
int3
invalid
invalid

Function at 0x1802c4280
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180779520]
imul eax, dword [0x180779524]
xor eax, 0x31ddb6ad
imul eax, eax, 0x3aefb869
mov r9d, 0x59ed69ea
xor edx, edx
div r9d
cmp eax, 0x3424eb56
ja 0x1802c4368
jmp 0x1802c42b3
mov eax, dword [0x180779528]
or eax, dword [0x18077952c]
xor eax, 0x10f61133
add eax, 0x1589399c
imul edx, eax, 0xcdfd21e8
mov rax, r8
add rax, 0xffffffffcdc46f4a
mov r9, rax
rol r9, 3
xor r9, rax
mov rax, r9
rol rax, 5
xor rax, r9
cmp edx, 0x34bdeabc
jbe 0x1802c42b3
jmp 0x1802c42f6
mov edx, dword [0x180779530]
sub edx, dword [0x180779534]
add edx, 0x61a42cd4
imul edx, edx, 0xc7032f02
add edx, 0x6206c62e
cmp edx, 0x72493ee7
jb 0x1802c4379
mov r8d, dword [0x180779538]
or r8d, dword [0x18077953c]
or r8d, 0x253b30f3
and r8d, 0x7901ddd8
add r8d, 0xb7bb9f19
xor r9d, r9d
sub r9, rax
mov rdx, r9
rol rdx, 2
xor rdx, r9
and rdx, 0xffff
cmp r8d, 0x83821309
je 0x1802c4379
jmp 0x1802c4361
add rcx, rdx
mov rax, rcx
ret
or al, 0x5b
cmp rax, 0x1ba46486
and al, 0x91
movsb byte [rdi], byte fs:[rsi]
sbb esp, dword [rcx + rdx*4]
invalid
add al, 0x70
jp 0x1802c436d
push 0xffffffffffffffa1
mov ah, 0xeb
cdq
int3
Function at 0x1802c4390
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180779540]
and eax, dword [0x180779544]
sub eax, 0xd588c7af
sub eax, 0xdc4092a1
xor eax, 0x5138d91f
cmp eax, 0x1287ebf6
je 0x1802c4460
mov eax, dword [0x180779548]
add eax, dword [0x18077954c]
or eax, 0xf617ea3e
imul eax, eax, 0x2f996d26
and eax, 0xba20cab7
mov r9, r8
shr r9, 5
cmp eax, 0x2cc946ea
jae 0x1802c4460
jmp 0x1802c43e5
mov eax, dword [0x180779550]
and eax, dword [0x180779554]
and eax, 0x4e08d2cf
imul eax, eax, 0xf505d785
xor eax, 0xecb5b363
cmp eax, 0x44c41845
jbe 0x1802c4471
jmp 0x1802c440a
mov eax, dword [0x180779558]
sub eax, dword [0x18077955c]
and eax, 0xb0647292
and eax, 0x77e674d2
mov r10d, 0x2a13ddc4
xor edx, edx
div r10d
mov rdx, r9
xor rdx, r8
add rdx, 0xffffffffc458da05
xor rdx, 0x3531afa5
mov r10, rdx
rol r10, 4
cmp eax, 0xc7102caf
ja 0x1802c440a
jmp 0x1802c444f
xor r10, rdx
and r10, 0xffff
add rcx, r10
mov rax, rcx
ret
sal ebx, 0xcd
sbb dl, bl
or bl, ah
and dl, byte [rdi]
adc ah, byte [rbx - 0x17]
invalid
sbb edi, dword [rsi + 0x2f]
in al, 0x2f
invalid

Function at 0x1802c4d30
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180779640]
and eax, dword [0x180779644]
and eax, 0x9f2285fc
imul eax, eax, 0x6cce5c8f
add eax, 0xa9936432
cmp eax, 0x498651a1
jb 0x1802c4da5
jmp 0x1802c4d58
mov eax, dword [0x180779648]
xor edx, edx
div dword [0x18077964c]
sub eax, 0x2406a1d1
xor eax, 0x14c685a5
mov r9d, 0xb39c3f54
xor edx, edx
div r9d
mov rdx, 0xffffffffaa136878
sub rdx, r8
cmp eax, 0x6ecd5865
jae 0x1802c4d58
jmp 0x1802c4d8e
mov rax, rdx
rol rax, 4
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
invalid

Function at 0x1802c4dc0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180779650]
and eax, dword [0x180779654]
or eax, 0x71265b0d
xor eax, 0x799c1e3
or eax, 0x85cf43a3
cmp eax, 0x5b33cc27
jb 0x1802c4e4c
jmp 0x1802c4de7
mov eax, dword [0x180779658]
and eax, dword [0x18077965c]
mov r9d, 0x89c366d8
xor edx, edx
div r9d
add eax, 0x224d4259
imul edx, eax, 0xa3137ab3
mov rax, r8
shr rax, 0x18
xor rax, r8
imul r9, rax, 0xffffffffead584e6
mov rax, r9
rol rax, 6
xor rax, r9
cmp edx, 0x12b41b64
ja 0x1802c4de7
jmp 0x1802c4e2e
add rax, 0xffffffffbbdf742a
mov rdx, rax
rol rdx, 6
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
cld
imul esi, eax, 0xe5496c21
jmp 0x1802c4de5

Function at 0x1802c4ef0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180779670]
imul eax, dword [0x180779674]
and eax, 0x71f69522
mov r9d, 0x32b3c93a
xor edx, edx
div r9d
or eax, 0xce239c49
cmp eax, 0xbf2ef77
jbe 0x1802c4f73
jmp 0x1802c4f1e
mov eax, dword [0x180779678]
xor eax, dword [0x18077967c]
or eax, 0x1eda51b2
sub eax, 0x3ec332fe
imul edx, eax, 0xd6d3c0ee
mov rax, r8
xor rax, 0xffffffff92b27237
cmp edx, 0x7dec71c5
jbe 0x1802c4f1e
jmp 0x1802c4f4d
movabs rdx, 0xb383afdd3581e24
imul rax, rdx
mov rdx, rax
rol rdx, 3
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
jnp 0x1802c4fcd
xchg esi, eax
invalid
movsd dword [rdi], dword [rsi]
Function at 0x1802c5320
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1807796d0]
sub eax, dword [0x1807796d4]
or eax, 0x8f7e9f83
or eax, 0x70be2d2d
sub eax, 0x2b343a0b
cmp eax, 0x342dff7a
je 0x1802c539b
jmp 0x1802c5347
mov eax, dword [0x1807796d8]
add eax, dword [0x1807796dc]
xor eax, 0xd47d79df
and eax, 0xcd076b17
mov r9d, 0x8a81ba6b
xor edx, edx
div r9d
mov edx, 0x30b99c8f
sub rdx, r8
mov r9, rdx
shr r9, 0x17
xor r9, rdx
mov rdx, r9
rol rdx, 4
cmp eax, 0x7708789
ja 0x1802c5347
jmp 0x1802c538a
xor rdx, r9
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
scasd eax, dword [rdi]
out 0xbc, eax
mov ch, 0xc5
invalid

Function at 0x1802c6380
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 1
xor rax, rdx
xor rax, 0xffffffff822018f4
mov r8, rax
rol r8, 1
xor r8, rax
and r8, 0xffff
mov eax, dword [0x180779870]
and eax, dword [0x180779874]
xor eax, 0x9ae0065d
and eax, 0x9170a90
add eax, 0x7deafa09
cmp eax, 0xd632277d
ja 0x1802c63f5
mov eax, dword [0x180779878]
xor edx, edx
div dword [0x18077987c]
xor eax, 0xa2eadf0f
and eax, 0x6a5dc234
mov r9d, 0xd78de54e
xor edx, edx
div r9d
mov edx, eax
mov rax, rcx
add rax, r8
cmp edx, 0x639ad7b7
jae 0x1802c63f5
ret
jle 0x1802c6437
cmc
invalid
shl byte [rcx + 0x3dd64cd8], 0x9a
add ch, ch
jne 0x1802c64b8
push rax
jmp 0x1802c6445
mov eax, dword [0x180779888]
xor edx, edx
div dword [0x18077988c]
or eax, 0x8ccf06e9
and eax, 0xd44ff6d6
xor eax, 0x8b04df27
mov rdx, r8
xor rdx, 0x8b1c5be
add rdx, 0xffffffffab1ffbde
mov r9, rdx
rol r9, 1
cmp eax, 0xdd41bc8
jb 0x1802c6445
jmp 0x1802c6482
xor r9, rdx
and r9, 0xffff
add rcx, r9
mov rax, rcx
ret
add byte [rdi], cl
scasd eax, dword [rdi]
or eax, 0x4b33d4

Function at 0x1802c7030
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180779990]
xor eax, dword [0x180779994]
xor eax, 0xb860c508
or eax, 0xea54f646
xor eax, 0xe50d9fd9
cmp eax, 0x6c12b6e2
jae 0x1802c7105
jmp 0x1802c705b
mov eax, dword [0x180779998]
add eax, dword [0x18077999c]
mov r9d, 0xd6c89803
xor edx, edx
div r9d
add eax, 0x1bb01b5a
add eax, 0x4e346462
mov rdx, r8
rol rdx, 2
xor rdx, r8
add rdx, 0xffffffffac0bbb5a
mov r9, rdx
rol r9, 2
xor r9, rdx
cmp eax, 0x8c5d7440
ja 0x1802c705b
jmp 0x1802c70a0
mov eax, dword [0x1807799a0]
xor eax, dword [0x1807799a4]
add eax, 0x85b5b32c
xor eax, 0xa6ff4227
mov r8d, 0x28798156
xor edx, edx
div r8d
cmp eax, 0xa216d630
ja 0x1802c7112
mov eax, dword [0x1807799a8]
sub eax, dword [0x1807799ac]
or eax, 0x5ea46d2e
and eax, 0x11211f89
imul edx, eax, 0x391d5c05
mov rax, r9
rol rax, 7
xor rax, r9
cmp edx, 0xe81fc8c9
je 0x1802c7112
jmp 0x1802c70f8
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
sbb al, 0x53
sbb dword [rax + riz*2], esp
mov esp, 0x47e98267
invalid
cld
invalid
Function at 0x1802c7350
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, 0xffffffffd59abae8
sub r8, rdx
xor r8, 0xff26bc1
add r8, 0x794eb9fa
mov rax, r8
rol rax, 2
xor rax, r8
and rax, 0xffff
add rcx, rax
mov eax, dword [0x1807799f0]
xor edx, edx
div dword [0x1807799f4]
and eax, 0xec4dc525
or eax, 0x97dfe06a
xor eax, 0xeeebfbaf
cmp eax, 0x90d5232a
jae 0x1802c73c7
jmp 0x1802c73a1
mov eax, dword [0x1807799f8]
add eax, dword [0x1807799fc]
xor eax, 0xb0b5bfa9
xor eax, 0x5335bf89
sub eax, 0x11ff69ad
cmp eax, 0x67cbfb0c
jbe 0x1802c73a1
mov rax, rcx
ret
cvtpi2ps xmm6, mm2
cmpsb byte [rsi], byte [rdi]
mov bh, byte [rdx - 0x5b]
jmp 0x1802c739f

Function at 0x1802c7970
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x180779a90]
or eax, dword [0x180779a94]
sub eax, 0x2ac4f6a8
and eax, 0xc260156b
sub eax, 0x50b91ee0
cmp eax, 0xacd8d071
ja 0x1802c7a4d
mov r8d, dword [0x180779a98]
sub r8d, dword [0x180779a9c]
xor r8d, 0xa2ba6c7d
or r8d, 0xc05e22a4
add r8d, 0xa10e3fdb
mov rax, rdx
add rax, 1
cmp r8d, 0x59ba560c
jb 0x1802c7a4d
jmp 0x1802c79cf
mov r8, rax
shr r8, 0xb
xor r8, rax
mov eax, dword [0x180779aa0]
xor edx, edx
div dword [0x180779aa4]
add eax, 0xbd8e1442
mov r9d, 0xba819d89
xor edx, edx
div r9d
add eax, 0x6fa8636e
cmp eax, 0x7afd979e
jae 0x1802c7a5a
jmp 0x1802c7a05
mov edx, dword [0x180779aa8]
xor edx, dword [0x180779aac]
add edx, 0xc3536c5d
and edx, 0xc72ddcfd
or edx, 0x5bf36af2
mov rax, r8
rol rax, 3
xor rax, r8
mov r9, rax
rol r9, 5
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x8cedf100
je 0x1802c7a05
ret
invalid
jae 0x1802c7ac0
xchg esi, eax
mov dl, 0x6f
and byte [rax + 0x27], cl
jmp 0x1802c7a03
cmp eax, 0xbadf493d
mov byte [rax + rsi - 0x15], dh
add byte [rbx + 0x4b1fe805], cl
add byte [rcx], dh
sal bh, cl
xor eax, 0x4b1fe4

Function at 0x1802c7c70
Capabilities:
Encode data using xor

Disassembly:
mov r8, 0xffffffffd19eae63
sub r8, rdx
movabs rax, 0xe4a0d5bcfd3e9c76
imul r8, rax
mov eax, dword [0x180779ae0]
xor eax, dword [0x180779ae4]
mov r9d, 0x755bdb30
xor edx, edx
div r9d
imul eax, eax, 0xc9064f86
sub eax, 0x1957443b
cmp eax, 0x5a15a06
jbe 0x1802c7d4d
jmp 0x1802c7cb7
mov eax, dword [0x180779ae8]
xor eax, dword [0x180779aec]
mov r9d, 0xdfc56098
xor edx, edx
div r9d
imul eax, eax, 0xb5eba8
and eax, 0x18c160cc
mov r9, r8
rol r9, 2
cmp eax, 0x7c532ec2
jae 0x1802c7cb7
jmp 0x1802c7ce9
mov eax, dword [0x180779af0]
or eax, dword [0x180779af4]
or eax, 0x7e0df1f7
and eax, 0xb0564207
imul eax, eax, 0x54692b3b
cmp eax, 0x96421976
je 0x1802c7d5a
jmp 0x1802c7d0e
mov eax, dword [0x180779af8]
and eax, dword [0x180779afc]
sub eax, 0x73d6e525
add eax, 0x836aff1c
mov r10d, 0x88428ed6
xor edx, edx
div r10d
mov edx, eax
mov r10, r9
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x4efce137
ja 0x1802c7d0e
ret
invalid
int3
Function at 0x1802c7e30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 0x11
xor rax, rdx
add rax, 0xffffffffbb3d7de6
mov rdx, rax
rol rdx, 1
xor rdx, rax
imul rax, rdx, 0xffffffffb5229cc2
mov r8, rax
rol r8, 1
xor r8, rax
and r8, 0xffff
mov eax, dword [0x180779b10]
add eax, dword [0x180779b14]
sub eax, 0x791b126f
mov r9d, 0x5a54f14a
xor edx, edx
div r9d
sub eax, 0x7e783c6f
cmp eax, 0xc4a971db
je 0x1802c7eb7
jmp 0x1802c7e8a
mov eax, dword [0x180779b18]
sub eax, dword [0x180779b1c]
imul eax, eax, 0xbecc7154
imul edx, eax, 0x2fd749cc
xor edx, 0x811ba4df
mov rax, rcx
add rax, r8
cmp edx, 0x5e8db91f
jb 0x1802c7e8a
ret
push rbx
cwde
pushfq
cmp edx, dword [rcx - 0x14464630]
invalid

Function at 0x1802c8130
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180779b50]
and eax, dword [0x180779b54]
mov r9d, 0x8646e6f7
xor edx, edx
div r9d
imul eax, eax, 0x3c8dc0f0
imul eax, eax, 0xc7ef1f91
cmp eax, 0x1cfc59ee
jae 0x1802c81b2
mov edx, dword [0x180779b58]
imul edx, dword [0x180779b5c]
xor edx, 0x5fcda63d
add edx, 0x31b51b21
sub edx, 0xa438d071
mov eax, 0x78e70d6
sub rax, r8
xor rax, 0xffffffff901f40e8
cmp edx, 0xfb1a6ab4
jae 0x1802c81b2
jmp 0x1802c8194
add rax, 0xffffffff95ffbba2
mov rdx, rax
rol rdx, 4
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
and byte [rbx - 0xa48f4e6], dl
out dx, eax
test bl, ch
movabs eax, dword [0x48c88948cccccccc]
mov rax, rcx
imul rcx, rdx, 0xffffffffaad1e0db
movabs rdx, 0xe10b2571629b31b6
add rcx, rdx
mov rdx, rcx
shr rdx, 0xc
mov r8d, dword [0x180779b60]
or r8d, dword [0x180779b64]
imul r8d, r8d, 0x764b3ee7
imul r8d, r8d, 0x841458bb
sub r8d, 0x134726c
cmp r8d, 0xdd92f1f1
jae 0x1802c8255
jmp 0x1802c820c
mov r9d, dword [0x180779b68]
and r9d, dword [0x180779b6c]
xor r9d, 0x143766fc
xor r9d, 0xf1af5798
add r9d, 0x5daa079f
mov r10, rdx
xor r10, rcx
mov r8, r10
rol r8, 5
xor r8, r10
cmp r9d, 0xdb5ecf5c
je 0x1802c820c
jmp 0x1802c824a
and r8, 0xffff
add rax, r8
ret
shr dword [rdx + 0x56], 1
scasd eax, dword [rdi]
pop rax
movabs dword [0xa7ebe3bbc29545a0], eax
int3
Function at 0x1802c8270
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180779b70]
or eax, dword [0x180779b74]
sub eax, 0x453217f5
and eax, 0xc171c73c
xor eax, 0x4fc34d86
cmp eax, 0x78284ac0
je 0x1802c8344
jmp 0x1802c829b
mov eax, dword [0x180779b78]
xor edx, edx
div dword [0x180779b7c]
and eax, 0xfdb9f0b0
add eax, 0x1f449fb6
xor eax, 0xc46e5a6
mov rdx, r8
rol rdx, 6
xor rdx, r8
xor rdx, 0xffffffffe6724c36
add rdx, 0xffffffffee326c28
cmp eax, 0x2feaffa3
ja 0x1802c829b
jmp 0x1802c82d9
mov r8, rdx
rol r8, 1
xor r8, rdx
and r8, 0xffff
mov eax, dword [0x180779b80]
or eax, dword [0x180779b84]
add byte [r11], cl
add eax, 0x4b188f
or eax, 0x4313591f
sub eax, 0xb51b2d43
mov r9d, 0x5dda2d73
xor edx, edx
div r9d
jae 0x1802c8330
ficomp dword [rbp + 0x31]
rol byte [rcx - 9], cl
int1
cmp eax, 0x3ee8523d
jae 0x1802c8355
jmp 0x1802c8313
mov eax, dword [0x180779b88]
xor edx, edx
div dword [0x180779b8c]
mov edx, eax
xor edx, 0xbeaebe5a
or edx, 0x85d868df
and edx, 0xfcaf52bb
loop 0x1802c82ed
push rdx
scasd eax, dword [rdi]
cld
mov rax, rcx
add rax, r8
cmp edx, 0xefa45283
je 0x1802c8313
ret
invalid
jl 0x1802c8301
jl 0x1802c8369
xchg edx, eax
jmp 0x1eee3ebbd
int3

Function at 0x1802c84e0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
sub rax, rdx
mov rdx, rax
rol rdx, 4
xor rdx, rax
mov rax, rdx
shr rax, 0x1b
xor rax, rdx
mov r8d, 0x1ad3d249
sub r8, rax
mov r9, r8
rol r9, 7
mov eax, dword [0x180779bc0]
or eax, dword [0x180779bc4]
imul eax, eax, 0xf08a0e12
xor eax, 0xcb9be72c
mov r10d, 0xfea166d5
xor edx, edx
div r10d
cmp eax, 0xd3849878
jae 0x1802c8574
jmp 0x1802c8534
mov eax, dword [0x180779bc8]
or eax, dword [0x180779bcc]
xor eax, 0x6ffdf306
mov r10d, 0xb2fc9b7d
xor edx, edx
div r10d
mov edx, eax
or edx, 0x990df679
mov r10, r9
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xf7b33112
ja 0x1802c8534
ret
iretd

Function at 0x1802c8670
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180779bf0]
or eax, dword [0x180779bf4]
imul eax, eax, 0x3f07cc84
mov r9d, 0xc811ada4
xor edx, edx
div r9d
and eax, 0x86fd1519
cmp eax, 0x806e0958
je 0x1802c8748
jmp 0x1802c86a2
mov eax, dword [0x180779bf8]
sub eax, dword [0x180779bfc]
and eax, 0x813cd33e
mov r9d, 0xd0a475e4
xor edx, edx
div r9d
imul edx, eax, 0x428d5c63
imul rax, r8, 0xffffffffc5197ee0
add rax, 0xffffffffaf671a3e
mov r9, rax
shr r9, 0x1f
xor r9, rax
xor r10d, r10d
sub r10, r9
mov rax, r10
rol rax, 4
xor rax, r10
cmp edx, 0xe797ecd
jae 0x1802c86a2
jmp 0x1802c86f5
and rax, 0xffff
add rcx, rax
mov eax, dword [0x180779c00]
or eax, dword [0x180779c04]
xor eax, 0x5e09e0dd
or eax, 0xbd6a5269
imul eax, eax, 0xfbb6821c
cmp eax, 0x9de7ce57
je 0x1802c8755
mov eax, dword [0x180779c08]
add eax, dword [0x180779c0c]
add eax, 0x4231afe2
imul eax, eax, 0xda84433b
and eax, 0x454d4ce3
cmp eax, 0xd68cc8a6
ja 0x1802c8755
mov rax, rcx
ret
jae 0x1802c87b6
xor ebp, esp
invalid
mov bl, 0xc6
out 0x85, al
mov esi, 0xccc2eb41
mov ecx, eax

Function at 0x1802c9560
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180779d80]