joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180337320
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180785250]
xor edx, edx
div dword [0x180785254]
imul eax, eax, 0x73acffe8
imul eax, eax, 0x33ac1be5
add eax, 0xc8fa30b2
cmp eax, 0xea4c7ed7
je 0x1803373ac
jmp 0x18033734b
mov edx, dword [0x180785258]
add edx, dword [0x18078525c]
and edx, 0x96a12031
xor edx, 0x5205b544
add edx, 0xf8379914
imul rax, r8, 0x4a845d52
mov r9, rax
rol r9, 7
xor r9, rax
imul rax, r9, 0x1332bc9e
mov r9, rax
shr r9, 0x1c
xor r9, rax
mov rax, r9
rol rax, 5
xor rax, r9
cmp edx, 0xca5e39ad
jbe 0x18033734b
jmp 0x18033739f
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
invalid

Function at 0x180337550
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180785290]
sub eax, dword [0x180785294]
sub eax, 0xd7372aaa
mov r9d, 0x53d6ac96
xor edx, edx
div r9d
add eax, 0xba4e5bd5
cmp eax, 0x862909f1
jb 0x180337624
mov eax, dword [0x180785298]
imul eax, dword [0x18078529c]
and eax, 0x33139d0c
and eax, 0xa7d0c499
and eax, 0x4c6b4a84
mov r9, r8
xor r9, 0xffffffffffffffff
mov r10, r9
shr r10, 0x1f
cmp eax, 0xe058ddf8
jae 0x180337624
jmp 0x1803375b2
mov eax, dword [str._93Bl]
or eax, dword [0x1807852a4]
mov r8d, 0xd33ce8b2
xor edx, edx
div r8d
add eax, 0xf4d7d6cc
add eax, 0x19172945
cmp eax, 0xfb461017
jae 0x180337635
jmp 0x1803375dc
mov eax, dword [0x1807852a8]
sub eax, dword [0x1807852ac]
or eax, 0xfb599c72
and eax, 0x34d7d64b
mov r8d, 0x73a37eb4
xor edx, edx
div r8d
mov r8, r10
xor r8, r9
mov rdx, r8
rol rdx, 6
cmp eax, 0x17c64f11
je 0x1803375dc
jmp 0x180337613
xor rdx, r8
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
push rsp
xchg esp, eax
sbb bh, dl
out 0xa5, al
out 0x4c, eax
clc
mov edi, dword [rsi - 0xb516dd]
invalid
retf 0xbcc5

Function at 0x180338510
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x180785420]
and eax, dword [0x180785424]
xor eax, 0x4b71eb38
xor eax, 0x53735bee
or eax, 0xefd4dbe5
cmp eax, 0x3c5f274c
je 0x1803385e6
jmp 0x180338538
mov r8d, dword [0x180785428]
add r8d, dword [0x18078542c]
sub r8d, 0x6a33f12b
or r8d, 0xc29d4c0b
or r8d, 0x79f57535
imul rax, rdx, 0x25d3f9b3
mov r9, rax
shr r9, 0x11
xor r9, rax
imul rax, r9, 0xfffffffff88a7b3a
cmp r8d, 0x7ee558ff
jb 0x180338538
jmp 0x18033857e
mov rdx, rax
rol rdx, 7
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov eax, dword [0x180785430]
xor eax, dword [0x180785434]
or eax, 0x2beb4076
xor eax, 0x4177a7d2
mov r8d, 0xb2445267
xor edx, edx
div r8d
cmp eax, 0xdc90158b
je 0x1803385f7
cwde
invalid
mov eax, dword [0x180785438]
or eax, dword [0x18078543c]
add eax, 0x9c3e8c4f
sub eax, 0x28389741
mov r8d, 0x4b3b8570
xor edx, edx
div r8d
cmp eax, 0x764baf89
jae 0x1803385f7
mov rax, rcx
ret
jbe 0x180338594
mov ah, 0x60
leave
invalid
cmc
cmp qword [rcx - 0x2e8f9f65], 0xffffffffccccb9eb
int3
Function at 0x180338640
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180785440]
and eax, dword [0x180785444]
mov r9d, 0xa69b7a6e
xor edx, edx
div r9d
imul eax, eax, 0x119abf49
xor eax, 0x15e61da4
cmp eax, 0x1ff3b59e
je 0x18033872d
mov eax, dword [0x180785448]
add eax, dword [0x18078544c]
mov r9d, 0x97f50646
xor edx, edx
div r9d
sub eax, 0x4c7e3854
sub eax, 0xd7b3b250
mov r9, r8
rol r9, 1
cmp eax, 0x37c1e589
je 0x18033872d
jmp 0x1803386a4
xor r9, r8
mov eax, dword [0x180785450]
xor edx, edx
div dword [0x180785454]
or eax, 0x54272e7f
mov r8d, 0xc0d6c2a9
xor edx, edx
div r8d
sub eax, 0xc586babc
cmp eax, 0x6252c3ff
je 0x18033873a
jmp 0x1803386d3
mov eax, dword [0x180785458]
or eax, dword [0x18078545c]
add eax, 0xc3c93b27
sub eax, 0xa14080a
mov r8d, 0x6b4de651
xor edx, edx
div r8d
mov edx, eax
imul rax, r9, 0xffffffffb593bb10
add rax, 0xffffffff90f594cf
mov r8, rax
shr r8, 9
xor r8, rax
mov r10, r8
rol r10, 3
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x9e25ab4e
je 0x1803386d3
ret
nop
invalid
push rbp
jae 0x180338766
pop rsi
mov edi, 0xeb8d03d1
invalid
test eax, 0xca894835

Function at 0x180338ab0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1807854c0]
or eax, dword [0x1807854c4]
and eax, 0x7d4af453
mov r9d, 0xabfe55b1
xor edx, edx
div r9d
and eax, 0x531cf9e2
cmp eax, 0x8be7b3b6
jae 0x180338b8e
jmp 0x180338ae1
mov eax, dword [0x1807854c8]
add eax, dword [0x1807854cc]
mov r9d, 0x305180e5
xor edx, edx
div r9d
sub eax, 0xee13db03
and eax, 0xff9a03bd
imul rdx, r8, 0xffffffff9d8cc7c3
add rdx, 0xffffffffc8a12e42
mov r9, rdx
rol r9, 6
xor r9, rdx
mov rdx, r9
rol rdx, 5
xor rdx, r9
cmp eax, 0x4d80f51c
jae 0x180338ae1
jmp 0x180338b2d
and rdx, 0xffff
add rcx, rdx
mov eax, dword [0x1807854d0]
xor eax, dword [0x1807854d4]
add eax, 0xf2795d95
imul eax, eax, 0x4a1bbde0
and eax, 0x54648d78
cmp eax, 0x56b8d6c0
jae 0x180338b9f
jmp 0x180338b5c
mov eax, dword [0x1807854d8]
and eax, dword [0x1807854dc]
mov r8d, 0x59f4e4
xor edx, edx
div r8d
mov r8d, 0xfee9614a
xor edx, edx
div r8d
xor eax, 0xc9a10a29
cmp eax, 0xfa7194bc
je 0x180338b5c
mov rax, rcx
ret
invalid
cmp esp, dword [rsi]
xchg byte [rsi - 0x4b3671d8], al
xor al, 0x5b
outsb dx, byte [rsi]
retf

Function at 0x180338be0
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x2586d84c
movabs rax, 0xe0ab507cf9ea94a6
imul rdx, rax
add rdx, 0xffffffffd63b5a1c
mov r8, rdx
rol r8, 1
mov eax, dword [0x1807854e0]
imul eax, dword [0x1807854e4]
add eax, 0x1c030202
xor eax, 0xda656bad
xor eax, 0x5a91d3c2
cmp eax, 0x8439f78e
ja 0x180338c69
jmp 0x180338c27
mov r9d, dword [0x1807854e8]
add r9d, dword [0x1807854ec]
or r9d, 0xbfc9277f
xor r9d, 0xad322bdd
or r9d, 0xa28ea4f6
mov r10, r8
xor r10, rdx
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r9d, 0x5ad8e5d1
je 0x180338c27
jmp 0x180338c68
ret
sub eax, 0xc067a45a
xor eax, 0xb2ebdc35
int3
Function at 0x180339170
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffffe9a562c7
add rdx, 0x11c7c95a
mov rax, rdx
rol rax, 2
xor rax, rdx
imul rax, rax, 0xffffffff8348230c
mov r8, rax
rol r8, 5
xor r8, rax
mov eax, dword [0x180785580]
or eax, dword [0x180785584]
or eax, 0x3fce1467
mov r9d, 0x1d19d8a7
xor edx, edx
div r9d
and eax, 0x54b1cc0c
cmp eax, 0x20211900
je 0x1803391fb
jmp 0x1803391c3
mov edx, dword [0x180785588]
add edx, dword [0x18078558c]
or edx, 0x4929086a
add edx, 0xdcd3c668
xor edx, 0xcb791d05
mov rax, r8
and rax, 0xffff
cmp edx, 0x263582cf
jbe 0x1803391c3
jmp 0x1803391f4
add rcx, rax
mov rax, rcx
ret
or esp, dword [rbp - 0x470f361a]
or al, dl
jmp 0x1803391c1

Function at 0x180339c50
Capabilities:
Encode data using xor

Disassembly:
mov r8, 0xffffffffaaf5d57c
sub r8, rdx
mov rax, r8

Function at 0x180339d70
Capabilities:
Encode data using xor

Disassembly:
mov r9, 0xffffffffa6269145
sub r9, rdx
mov eax, dword [0x1807856e0]
add eax, dword [0x1807856e4]
add eax, 0x2e0de0f2
xor eax, 0x91ba16e9
add eax, 0x48b18c4c
cmp eax, 0x35b3a089
jbe 0x180339e46
jmp 0x180339da2
mov eax, dword [0x1807856e8]
imul eax, dword [0x1807856ec]
xor eax, 0x2bd50b67
sub eax, 0xcf957608
mov r8d, 0x7c862441
xor edx, edx
div r8d
mov r8, r9
xor r8, 0x61c23593
cmp eax, 0x53f5db63
je 0x180339da2
jmp 0x180339dd7
mov eax, dword [0x1807856f0]
add eax, dword [0x1807856f4]
add byte [rbx], r8b
add eax, 0x44b911
or eax, 0xde3d4ced
imul eax, eax, 0x1c8d778c
mov r9d, 0x58aea0f1
xor edx, edx
div r9d
cmp eax, 0x116e1976
je 0x180339e57
jmp 0x180339e02
mov eax, dword [0x1807856f8]
add eax, dword [0x1807856fc]
imul eax, eax, 0x2fc883c7
sub eax, 0x3f879d82
imul edx, eax, 0x9292d3a4
mov rax, r8
add rax, 1
mov r9, rax
rol r9, 2
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x926b53ec
ja 0x180339e02
ret
fisttp word [rax + 0x469a48cc]
fisub dword [rsi - 0x163b0351]
invalid
loope 0x180339ddb
ficomp word [rax]
cmp al, 0x33
invalid

Function at 0x180339f90
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180785720]
imul eax, dword [0x180785724]
mov r9d, 0x3b435ba9
xor edx, edx
div r9d
or eax, 0xbd5a65bc
and eax, 0xb35d3aef
cmp eax, 0x5bfce7b7
jb 0x18033a05d
jmp 0x180339fc2
mov eax, dword [0x180785728]
sub eax, dword [0x18078572c]
sub eax, 0xb2e0027e
and eax, 0xe08f77da
imul edx, eax, 0x79d1ed0d
mov rax, 0xffffffff88e6a1f1
sub rax, r8
mov r9, rax
shr r9, 2
xor r9, rax
add r9, 1
mov rax, r9
rol rax, 7
xor rax, r9
and rax, 0xffff
cmp edx, 0x99d75001
je 0x180339fc2
jmp 0x18033a010
add rcx, rax
mov eax, dword [0x180785730]
sub eax, dword [0x180785734]
xor eax, 0xb95a4ac7
add byte [0x1398deaeb], dh
or eax, 0x4eb989a0
or eax, 0xf7232ded
cmp eax, 0xe27066bb
jbe 0x18033a06e
jmp 0x18033a037
mov eax, dword [0x180785738]
or eax, dword [0x18078573c]
xor eax, 0xd4c02321
xor eax, 0x1360d1f6
and eax, 0x427652d
cmp eax, 0xfece0979
ja 0x18033a037
mov rax, rcx
ret
pop rbx
pop rdx
loop 0x18033a01e
iretd
retf 0xbfb4
Function at 0x18033a680
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
movabs rax, 0xf5318f1e0df06196
imul r8, rax
mov eax, dword [0x1807857f0]
xor edx, edx
div dword [0x1807857f4]
and eax, 0xb8caa98e
xor eax, 0x92746554
xor eax, 0xfd5ff72f
cmp eax, 0x5e01c1b8
jb 0x18033a765
mov eax, dword [0x1807857f8]
imul eax, dword [0x1807857fc]
sub eax, 0xbdfa5570
add eax, 0xbff0d04b
or eax, 0xf25bb781
movabs rdx, 0xb0fdeeed686fa98
mov r9, r8
add r9, rdx
mov r10, r9
rol r10, 5
cmp eax, 0x514794bc
je 0x18033a765
jmp 0x18033a6f5
mov eax, dword [0x180785800]
imul eax, dword [0x180785804]
imul eax, eax, 0x68cdc9ff
xor eax, 0xac345558
xor eax, 0xf4c00f33
cmp eax, 0x2d4323e
je 0x18033a776
jmp 0x18033a71b
mov eax, dword [0x180785808]
and eax, dword [0x18078580c]
mov r8d, 0x9408edf7
xor edx, edx
div r8d
mov edx, eax
add edx, 0xa90da50b
xor edx, 0x4487c685
mov rax, r10
xor rax, r9
mov r8, rax
rol r8, 1
xor r8, rax
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0x926c679a
jb 0x18033a71b
ret
xchg dword [rcx - 0x5d], edx
xchg ebx, eax
pop rbx
invalid
push rcx
lahf
invalid

Function at 0x18033a970
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movabs rax, 0xfd79cbf206b8e28f
imul rdx, rax
movabs rax, 0x215c0e4d02340a3
add rdx, rax
mov rax, rdx
shr rax, 0x12
xor rax, rdx
mov r8, rax
rol r8, 6
xor r8, rax
mov eax, dword [0x180785830]
xor edx, edx
div dword [0x180785834]
or eax, 0xbf5e853c
or eax, 0x20ec9620
mov r9d, 0x1d460e8c
xor edx, edx
div r9d
cmp eax, 0xa7eac5bc
ja 0x18033aa02
jmp 0x18033a9cb
mov edx, dword [0x180785838]
and edx, dword [0x18078583c]
xor edx, 0x1f09393
or edx, 0x376db6f9
sub edx, 0x32ef9e00
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xdb2ccd8f
ja 0x18033a9cb
ret
scasd eax, dword [rdi]
mov edi, 0x9585aea6
int1
mov dword [rbx - 0x3c], edi
sbb al, 0x1d
jmp 0x18033a9c9

Function at 0x18033b0b0
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x72bcfcc7
add rdx, 1
xor rdx, 0x1c476d6a
add rdx, 0x5a1c84ea
mov r8, rdx
rol r8, 4
xor r8, rdx
and r8, 0xffff
mov eax, dword [0x1807858f0]
and eax, dword [0x1807858f4]
add eax, 0xa297dc77
imul eax, eax, 0x1d29c75b
sub eax, 0x40b28e88
cmp eax, 0x64f2d643
ja 0x18033b12a
jmp 0x18033b0ff
mov eax, dword [0x1807858f8]
xor eax, dword [0x1807858fc]
xor eax, 0x449e3f17
or eax, 0xaf97cf4b
imul edx, eax, 0x7bdcfffb
mov rax, rcx
add rax, r8
cmp edx, 0xa25e40a2
jae 0x18033b0ff
ret
sub al, 0x45
scasd eax, dword [rdi]
pmaxsw mm1, qword [rsi - 0x61]
jmp 0x18033b0fd
Function at 0x18033b210
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180785900]
add eax, dword [0x180785904]
add eax, 0xf7e6010d
and eax, 0x52d4323a
xor eax, 0xf829eb8d
cmp eax, 0xbb91a3f3
jae 0x18033b328
mov eax, dword [0x180785908]
xor edx, edx
div dword [0x18078590c]
mov r9d, 0xeea5a4e9
xor edx, edx
div r9d
and eax, 0x5172ff27
and eax, 0x12fffd69
mov r9, r8
add r9, 0x39591a6e
cmp eax, 0xb12e3f44
ja 0x18033b328
jmp 0x18033b273
mov eax, dword [0x180785910]
add eax, dword [0x180785914]
sub eax, 0x3329dc4a
and eax, 0xbc34b559
and eax, 0xe8e41533
cmp eax, 0x5cf49665
ja 0x18033b339
mov eax, dword [0x180785918]
add eax, dword [0x18078591c]
or eax, 0xa752993f
or eax, 0x956d239e
or eax, 0x550d672e
mov r8, r9
rol r8, 6
cmp eax, 0x529a5d94
jbe 0x18033b339
jmp 0x18033b2c4
mov eax, dword [0x180785920]
sub eax, dword [0x180785924]
xor eax, 0x1b983865
xor eax, 0x75ca4979
sub eax, 0x7857f202
cmp eax, 0x1e4e120a
jb 0x18033b346
jmp 0x18033b2e8
mov eax, dword [0x180785928]
xor eax, dword [0x18078592c]
or eax, 0x5a034e80
imul eax, eax, 0xc3a2d087
mov r10d, 0xc478e415
xor edx, edx
div r10d
mov edx, eax
mov r10, r8
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xf1a8ad3b
je 0x18033b2e8
ret
sbb eax, dword [rdx - 0x4429ef63]
or al, 0xc5
invalid
sbb al, 0xc5
and byte [rbx + 0x1e], al
imul eax, dword [ebx - 0x17], 0xffffff53
test dword [rdi + 0x4e], esi
xor eax, 0x2e4743f1
jmp 0x18033b2e6

Function at 0x18033ba40
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0x574c0ade
add rdx, 0x3b8019d1
mov ecx, dword [0x1807859f0]
and ecx, dword [0x1807859f4]
imul ecx, ecx, 0x3b15d5e1
xor ecx, 0xd5d928ff
sub ecx, 0x7637ae5e
cmp ecx, 0xa791cf58
ja 0x18033babc
jmp 0x18033ba79
mov r8d, dword [0x1807859f8]
xor r8d, dword [0x1807859fc]
xor r8d, 0x3b555221
or r8d, 0xbe101e55
sub r8d, 0x41a3e636
mov rcx, rdx
rol rcx, 3
xor rcx, rdx
cmp r8d, 0xe34cd052
ja 0x18033ba79
jmp 0x18033bab1
and rcx, 0xffff
add rax, rcx
ret
mov cl, 0x8f
xchg esp, eax
fcomp dword [rdi]
movabs eax, dword gs:[0xccadebca77fe4eed]
int3

Function at 0x18033bdb0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 0xf
xor rax, rdx
mov rdx, rax
shr rdx, 0xc
xor rdx, rax
imul rdx, rdx, 0xffffffff8d380b12
xor rdx, 0x3917a5f6
mov eax, dword [0x180785a50]
imul eax, dword [0x180785a54]
and eax, 0xffb32a11
add eax, 0x4422ae75
or eax, 0xc82fa76a
cmp eax, 0x41b48166
jbe 0x18033be35
jmp 0x18033bdf7
mov eax, dword [0x180785a58]
add eax, dword [0x180785a5c]
sub eax, 0x191de473
xor eax, 0xce65af3e
imul r8d, eax, 0xd140328e
mov r9, rdx
rol r9, 6
xor r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0x4982b0cf
jae 0x18033bdf7
ret
jmp 0x1a75c4765
Function at 0x18033c830
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
movabs rax, 0xffffffff2bcb7ce4
add r8, rax
mov eax, dword [0x180785b60]
add eax, dword [0x180785b64]
xor eax, 0xddf2d4a9
xor eax, 0x665fb3f9
imul eax, eax, 0x5e52e861
cmp eax, 0xf0bec655
je 0x18033c8f9
mov eax, dword [0x180785b68]
add eax, dword [str.Z__rqv_t]
imul eax, eax, 0x617d3bf3
imul eax, eax, 0x4c9239f0
and eax, 0x3c39774e
mov r9, r8
rol r9, 1
cmp eax, 0xbeb7457a
ja 0x18033c8f9
jmp 0x18033c893
mov eax, dword [0x180785b70]
xor eax, dword [0x180785b74]
and eax, 0x9838e559
or eax, 0x2176aec1
imul eax, eax, 0xabdca0b1
cmp eax, 0x6b582d11
jb 0x18033c906
jmp 0x18033c8b8
mov eax, dword [0x180785b78]
xor edx, edx
div dword [0x180785b7c]
or eax, 0x38911848
and eax, 0x9be8d358
mov r10d, 0x74112c52
xor edx, edx
div r10d
mov edx, eax
mov r10, r9
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x8892b5c3
je 0x18033c8b8
ret
xchg ecx, eax
movabs al, byte [0x61e9b90bc3a80a0c]
invalid
xlatb
push r12
stc
sub eax, 0x17
retf

Function at 0x18033c910
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x180785b80]
sub ecx, dword [0x180785b84]
imul ecx, ecx, 0x629a5104
add ecx, 0xb0d63149
xor ecx, 0x5677873b
cmp ecx, 0xbcc938a3
ja 0x18033c995
jmp 0x18033c93b
mov r8d, dword [0x180785b88]
and r8d, dword [str.DQgn4]
or r8d, 0xb887de63
and r8d, 0x541801fd
add r8d, 0x945bce2a
movabs r9, 0xe21c0a1d
mov rcx, rdx
add rcx, r9
xor rcx, 0xadf3e1d
cmp r8d, 0xb5ec35ac
jb 0x18033c93b
jmp 0x18033c980
mov rdx, rcx
rol rdx, 3
xor rdx, rcx
and rdx, 0xffff
add rax, rdx
ret
invalid

Function at 0x18033cba0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x180785bc0]
add ecx, dword [0x180785bc4]
sub ecx, 0x302e0fde
or ecx, 0xf2cd4036
xor ecx, 0x9420135d
cmp ecx, 0x80abd53d
je 0x18033cc80
jmp 0x18033cbcf
mov ecx, dword [0x180785bc8]
and ecx, dword [0x180785bcc]
add ecx, 0xa8ba598b
and ecx, 0x190c1e30
imul r8d, ecx, 0x4137efc0
mov rcx, rdx
rol rcx, 7
xor rcx, rdx
imul rcx, rcx, 0xffffffffc35c369d
movabs r9, 0xf01be0d6b4559222
add rcx, r9
cmp r8d, 0x65422153
jb 0x18033cbcf
jmp 0x18033cc17
mov edx, dword [0x180785bd0]
and edx, dword [0x180785bd4]
or edx, 0x80e5d8ed
or edx, 0xcc6511b9
imul edx, edx, 0xb169cc53
cmp edx, 0x588de7d2
je 0x18033cc91
mov r8d, dword [0x180785bd8]
and r8d, dword [0x180785bdc]
or r8d, 0xcfb5796f
xor r8d, 0x9f556c98
add r8d, 0xec08bd0d
mov rdx, rcx
rol rdx, 2
xor rdx, rcx
and rdx, 0xffff
cmp r8d, 0xf3d8d4e2
ja 0x18033cc91
jmp 0x18033cc7c
add rax, rdx
ret
wait
int1
sahf
outsb dx, byte [rsi]
movabs dword [0x3ce91f759a5cef99], eax
invalid
invalid
Function at 0x18033d300
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180785c80]
sub eax, dword [0x180785c84]
and eax, 0x6e2cc20d
mov r9d, 0x93699eb4
xor edx, edx
div r9d
xor eax, 0x36a3347f
cmp eax, 0x14241b9d
jbe 0x18033d386
jmp 0x18033d32d
mov edx, dword [0x180785c88]
imul edx, dword [0x180785c8c]
sub edx, 0x9e047e3
or edx, 0xb091ef38
or edx, 0x8aaa61cd
xor eax, eax
sub rax, r8
xor rax, 0x1784d713
add rax, 1
cmp edx, 0xeeb4cb0
je 0x18033d32d
jmp 0x18033d365
mov rdx, rax
rol rdx, 2
xor rdx, rax
mov rax, rdx
rol rax, 3
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
mov bh, byte [rbp - 0x29]
and eax, 0x8c534e52
jmp 0x18033d32b

Function at 0x18033d4f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
add r8, 0xffffffffeb5a078f
mov eax, dword [0x180785cb0]
xor eax, dword [0x180785cb4]
mov r9d, 0x516ece7
xor edx, edx
div r9d
or eax, 0x28df4cb9
imul eax, eax, 0x507ee343
cmp eax, 0x6534a7c4
jae 0x18033d57e
jmp 0x18033d525
mov eax, dword [0x180785cb8]
xor eax, dword [0x180785cbc]
add eax, 0xc64a91d0
add eax, 0xd01eac8d
mov r9d, 0x82e58a8b
xor edx, edx
div r9d
mov rdx, r8
rol rdx, 7
xor rdx, r8
cmp eax, 0xb0777ee
ja 0x18033d525
jmp 0x18033d559
mov rax, rdx
shr rax, 0x14
xor rdx, rax
xor rdx, 0xffffffffffffffff
mov rax, rdx
rol rax, 3
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
pop rax
call 0x17a31da67
pop rax
pop rax
cmpsd dword [rsi], dword [rdi]
fdivr dword [rdx - 0x33681459]
int3

Function at 0x18033e8f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
shr r8, 0x1c
xor r8, rdx
mov eax, dword [0x180785e90]
xor edx, edx
div dword [0x180785e94]
or eax, 0x77f6d652
mov r9d, 0x1ff8a90f
xor edx, edx
div r9d
or eax, 0x4c8d32
cmp eax, 0x7e953644
jae 0x18033e97e
jmp 0x18033e926
mov eax, dword [0x180785e98]
and eax, dword [0x180785e9c]
mov r9d, 0x5f2f6326
xor edx, edx
div r9d
imul edx, eax, 0x5d6b20e1
xor edx, 0xc3f071ad
imul r9, r8, 0x6044750f
movabs rax, 0xdaa2b7ad28ad5dee
add r9, rax
mov rax, r9
rol rax, 3
xor rax, r9
and rax, 0xffff
cmp edx, 0xc76b899e
je 0x18033e926
jmp 0x18033e977
add rcx, rax
mov rax, rcx
ret
jo 0x18033e997
sbb byte [rcx + rdx*8 - 0x14936c69], bh
pushfq
int3

Function at 0x18033ed50
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [str.2u.E]
and ecx, dword [0x180785ee4]
add ecx, 0x1d479d57
sub ecx, 0x6614cab0
or ecx, 0x49aeeb13
cmp ecx, 0x9518f1ab
je 0x18033ede2
jmp 0x18033ed7b
mov r8d, dword [0x180785ee8]
and r8d, dword [0x180785eec]
xor r8d, 0xe92e2912
and r8d, 0x9fcf08fb
and r8d, 0xf6bc3989
mov r9, rdx
xor r9, 0xffffffffbee5185d
add r9, 0x21f568b2
mov rcx, r9
rol rcx, 4
xor rcx, r9
cmp r8d, 0xa8d0d0fb
ja 0x18033ed7b
jmp 0x18033edc4
mov rdx, rcx
rol rdx, 6
xor rdx, rcx
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
ret
add esi, esi
mov esp, 0x92982ca3
push rbp
jmp 0x18033ed79
Function at 0x18033f070
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x509cdb90
sub rax, rdx
imul rax, rax, 0x581c7b
mov rdx, rax
rol rdx, 7
xor rdx, rax
and rdx, 0xffff
mov eax, dword [0x180785f40]
add eax, dword [0x180785f44]
sub eax, 0x82c41176
and eax, 0x342a1655
or eax, 0xdb270c20
cmp eax, 0xe3bfdbe9
jae 0x18033f0e7
jmp 0x18033f0b4
mov r8d, dword [0x180785f48]
xor r8d, dword [0x180785f4c]
add r8d, 0x82f7e7be
add r8d, 0x71055642
or r8d, 0xf322dd08
mov rax, rcx
add rax, rdx
cmp r8d, 0x44cc6347
jb 0x18033f0b4
ret
xchg esp, eax
invalid

Function at 0x18033fcf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x180786080]
and eax, dword [0x180786084]
sub eax, 0x7463d7ed
imul eax, eax, 0x5b51c1a5
or eax, 0x570755d8
cmp eax, 0x8ea988e4
ja 0x18033fe1c
jmp 0x18033fd19
mov eax, dword [0x180786088]
xor eax, dword [str.1kP]
xor eax, 0x5a12b770
imul r8d, eax, 0xf2e39884
sub r8d, 0xf5f5c4eb
mov rax, rdx
rol rax, 4
xor rax, rdx
cmp r8d, 0xf630659b
je 0x18033fd19
jmp 0x18033fd4d
mov edx, dword [0x180786090]
xor edx, dword [0x180786094]
add edx, 0xee5430ec
and edx, 0xf68f6e87
and edx, 0x231b9b83
cmp edx, 0xa74cb4a9
ja 0x18033fe2d
jmp 0x18033fd79
mov r8d, dword [0x180786098]
add r8d, dword [0x18078609c]
xor r8d, 0x46a330e3
xor r8d, 0x29853e3b
add r8d, 0x2ee0377a
imul r9, rax, 0xffffffffcb06bd88
xor r9, 0xffffffffb221f5ae
mov rdx, r9
rol rdx, 1
xor rdx, r9
cmp r8d, 0xe86c2063
je 0x18033fd79
jmp 0x18033fdbe
mov eax, dword [0x1807860a0]
add eax, dword [0x1807860a4]
add eax, 0x18560ab4
add eax, 0x78c23cf8
sub eax, 0xeace9ae3
cmp eax, 0x95b08ce2
jbe 0x18033fe3a
jmp 0x18033fde2
mov eax, dword [0x1807860a8]
xor eax, dword [0x1807860ac]
imul eax, eax, 0x910a98b
imul r8d, eax, 0xed8a019a
xor r8d, 0xaf20ff3d
mov r9, rdx
and r9, 0xfffb
mov rax, rcx
add rax, r9
cmp r8d, 0xf341e3c5
jb 0x18033fde2
jmp qword [rax]
ret
ret 0x3347
shr dword [rcx + rsi*4], 1
jbe 0x18033fdff
adc al, byte [rax + rbx*4 - 0x17]
cmp eax, 0x1fffffff
inc byte [rdx - 0x34e6b8c5]
xor ebp, ebx
pushfq
int3
invalid

Function at 0x1803402f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180786120]
or eax, dword [0x180786124]
and eax, 0x8dea1b1
or eax, 0xcc8f3394
imul eax, eax, 0x9a962377
cmp eax, 0xc4073279
je 0x1803403bc
mov eax, dword [0x180786128]
add eax, dword [0x18078612c]
mov r9d, 0x7cd86b59
xor edx, edx
div r9d
add eax, 0xd08d227b
and eax, 0x9080d1b0
movabs rdx, 0xffffffff1133a6a2
sub rdx, r8
cmp eax, 0x2fb64454
jbe 0x1803403bc
jmp 0x180340351
mov r8, rdx
rol r8, 2
xor r8, rdx
mov eax, dword [0x180786130]
sub eax, dword [0x180786134]
and eax, 0x99fc1348
mov r9d, 0x4f40b79
xor edx, edx
div r9d
and eax, 0x58848969
cmp eax, 0xb611a941
je 0x1803403cd
jmp 0x180340385
mov edx, dword [0x180786138]
add edx, dword [0x18078613c]
add edx, 0xfcd63a3c
xor edx, 0x3dc2a38e
and edx, 0xb2cc49ec
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xca3078fd
jae 0x180340385
ret
and dword [rcx - 0x7c171822], ecx
push 0x50
pop rsp
ret 0xd463
invalid