joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180353390
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
sub byte [rax - 0x77], cl
invalid
mov al, byte [rsi + 0x22e]
movzx ecx, al
mov eax, ecx
sub ecx, 0x35
ja 0x1803533bf
lea rcx, [0x1806c47c8]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov eax, dword [0x1807884c0]
or eax, dword [0x1807884c4]
and eax, 0x399e791a
mov ecx, 0xd8d391a0
xor edx, edx
div ecx
or eax, 0x4e9eea0b
cmp eax, 0xa6686a04
je 0x180354c8d
jmp 0x1803533eb
mov eax, dword [0x1807884c8]
sub eax, dword [0x1807884cc]
add byte [0x1c391dee5], ch
xor eax, 0xf434890f
add eax, 0x6f741b84
cmp eax, 0xb33f9713
ja 0x1803533eb
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
popfq
ret 0x34e8
Function at 0x180358310
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov eax, dword [0x180788e50]
imul eax, dword [0x180788e54]
mov ecx, 0x22ccd522
xor edx, edx
div ecx
sub eax, 0x2c8e6ce8
imul eax, eax, 0x8298a547
cmp eax, 0xe36595af
ja 0x180358495
jmp 0x180358351
mov eax, dword [0x180788e58]
add eax, dword [0x180788e5c]
imul eax, eax, 0x32f7755b
sub eax, 0x7065a173
imul eax, eax, 0x5f2a0480
cmp eax, 0xf3fc3de4
ja 0x180358351
jmp 0x180358377
mov eax, dword [0x180788e60]
or eax, dword [str.F_Ud]
or eax, 0x6445a23d
imul eax, eax, 0x882ebef0
imul eax, eax, 0x24084ca
cmp eax, 0x2d22df1a
jbe 0x1803584a6
jmp 0x1803583a1
mov eax, dword [0x180788e68]
xor eax, dword [0x180788e6c]
add eax, 0x64006b68
add eax, 0x15e8a8f
imul ecx, eax, 0x9b68949e
cmp rsi, 0
setl al
cmp ecx, 0x5d465692
jb 0x1803583a1
jmp 0x1803583ce
xor ecx, ecx
test al, 1
jne 0x180358469
jmp 0x1803583da
cmp rsi, 0
sete al
mov r14d, 1
test al, 1
jne 0x180358471
jmp 0x1803583f1
mov al, byte [0x1807afe04]
mov eax, dword [0x180788e70]
sub eax, dword [0x180788e74]
imul eax, eax, 0x79dca9f4
mov ecx, 0x10e37208
xor edx, edx
div ecx
mov ecx, 0xbe4d8646
xor edx, edx
div ecx
cmp eax, 0x456de0bc
ja 0x1803584b7
mov eax, dword [0x180788e78]
xor eax, dword [0x180788e7c]
sub eax, 0x86790939
add eax, 0x90eaa0c2
imul ebp, eax, 0xab94281a
mov rcx, rsi
mov edx, 1
call fcn.1804caf90
mov r14, rax
cmp ebp, 0x18cf9891
jbe 0x1803584b7
jmp 0x18035845c
mov ecx, 1
cmp r14, 0
je 0x180358469
jmp 0x180358471
mov rdx, rsi
call fcn.18063bc30
mov rcx, r14
mov rdx, rbx
mov r8, rsi
call fcn.1806a7400
mov qword [rdi], rsi
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
movabs al, byte [0x2cb84d86357cd656]
or byte [rax], bl
in al, 0xe9
test eax, 0x92fffffe
xchg edx, eax
pop rax
cmp al, 0x3a
invalid
cmc
invalid
Function at 0x180359d10
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
Function at 0x18037cc90
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov eax, dword [0x18078c3c0]
xor edx, edx
div dword [0x18078c3c4]
xor eax, 0xb33ee546
Function at 0x180388bf0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov al, byte [rsi + 0xad]
mov ecx, dword [0x18078d940]
imul ecx, dword [0x18078d944]
scasd eax, dword [rdi]
or eax, 0x404d2e
Function at 0x1803c4240
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx]
mov eax, dword [0x180793040]
add eax, dword [0x180793044]
imul eax, eax, 0xec68caa3
mov r8d, 0x92cbdaff
xor edx, edx
div r8d
and eax, 0x4993b571
cmp eax, 0x9a5baf30
jae 0x1803c43cb
mov eax, dword [0x180793048]
imul eax, dword [0x18079304c]
mov r8d, 0xa75ec38b
xor edx, edx
div r8d
mov r8d, 0x3caa6bf5
xor edx, edx
div r8d
add eax, 0x8a87da55
cmp rsi, 0
sete dl
cmp eax, 0x16b84940
jb 0x1803c43cb
jmp 0x1803c42b3
test dl, 1
jne 0x1803c43c3
jmp 0x1803c42be
mov eax, dword [0x180793050]
imul eax, dword [0x180793054]
add eax, 0x72b279ad
sub eax, 0x38382095
mov r8d, 0x72aac24c
xor edx, edx
div r8d
cmp eax, 0xcb7dd3e9
je 0x1803c43d8
jmp 0x1803c42ed
mov eax, dword [0x180793058]
and eax, dword [0x18079305c]
xor eax, 0x81cb67dd
imul eax, eax, 0x6d156a8
imul eax, eax, 0xccf35a37
mov rdi, qword [rcx + 8]
cmp eax, 0x638c6993
je 0x1803c42ed
jmp 0x1803c4317
mov eax, dword [0x180793060]
add eax, dword [0x180793064]
sub eax, 0xc39261fc
or eax, 0x218c8da0
mov ecx, 0xa02fd280
xor edx, edx
div ecx
cmp eax, 0xd657eb59
jae 0x1803c43e9
mov eax, dword [0x180793068]
and eax, dword [0x18079306c]
sub eax, 0x293fc8e5
imul eax, eax, 0x9498c56d
imul ebx, eax, 0x1b43143
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call fcn.1804cafa0
cmp ebx, 0xc9c3c2e
je 0x1803c43e9
jmp 0x1803c4379
mov eax, dword [0x180793070]
sub eax, dword [0x180793074]
add eax, 0xc8881fd0
xor eax, 0xe7687f11
and eax, 0xe2faaa88
cmp eax, 0x61c95649
jbe 0x1803c440b
mov eax, dword [0x180793078]
xor eax, dword [0x18079307c]
and eax, 0x6f9f503f
mov ecx, 0x3408ae6
xor edx, edx
div ecx
xor eax, 0xca627707
cmp eax, 0xde996a93
je 0x1803c440b
jmp 0x1803c43c3
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xchg eax, esp
mov esi, 0xca7282b8
add al, 0xe9
lahf
invalid
xor eax, dword [rcx - 0x4eaf125]
stosd dword [rdi], eax
xor r14b, byte [r13 + 0x6d]
sahf
jmp 0x1803c42eb
adc dword [rax + rbp*2 + 0x16], edi
sub ebx, eax
and al, 0xc2
mov bh, 0x5d
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call fcn.1804cafa0
jmp 0x1803c4341
leave
cdq
xchg ebp, eax
mov al, 0x5c
adc edx, dword [rdi + 0x1f]
cwde
or eax, 0xcc82eb49
int3
Function at 0x1803c69c0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rcx, rsi
add rcx, 0x40
mov eax, dword [0x180793510]
xor edx, edx
div dword [0x180793514]
imul eax, eax, 0xb19fd5c6
mov r8d, 0x338f0325
xor edx, edx
div r8d
add eax, 0xef6be41
cmp eax, 0x64313ad7
ja 0x1803c6c24
jmp 0x1803c6a04
mov eax, dword [0x180793518]
xor edx, edx
div dword [0x18079351c]
and eax, 0xfc3f8d6a
imul edx, eax, 0x73a25e42
xor edx, 0xf295b697
movzx eax, byte [rcx]
cmp edx, 0x30561a09
jae 0x1803c6a04
jmp 0x1803c6a30
test eax, eax
je 0x1803c6a4b
jmp 0x1803c6a36
sub eax, 3
je 0x1803c6c13
jmp 0x1803c6a41
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r14, rsi
add r14, 8
mov rdi, qword [r14]
cmp rdi, 0
sete al
test al, 1
jne 0x1803c6bae
jmp 0x1803c6a66
mov rcx, rdi
call fcn.1806595d0
mov rax, qword [rdi]
lock dec qword [rax]
sete al
test al, 1
jne 0x1803c6a7e
jmp 0x1803c6add
mov eax, dword [0x180793520]
xor edx, edx
div dword [0x180793524]
or eax, 0x78719c89
sub eax, 0x15aec299
xor eax, 0x3679c934
cmp eax, 0xccbc327e
je 0x1803c6c35
mov ebx, dword [0x180793528]
imul ebx, dword [0x18079352c]
xor ebx, 0x81f1cf97
add ebx, 0x6275235f
or ebx, 0xde885e3e
mov rcx, rdi
call fcn.1804b9d30
cmp ebx, 0x79ee5842
jbe 0x1803c6c35
jmp 0x1803c6adb
jmp 0x1803c6add
mov eax, dword [0x180793530]
sub eax, dword [0x180793534]
add eax, 0xea31e98e
and eax, 0xb28e89a5
and eax, 0x8c57a9b0
cmp eax, 0x2155fd25
jbe 0x1803c6c4a
jmp 0x1803c6b05
mov eax, dword [0x180793538]
add eax, dword [0x18079353c]
imul eax, eax, 0xe8e423fe
sub eax, 0x9cdf542b
sub eax, 0x55bf480f
mov rbx, rdi
add rbx, 8
cmp eax, 0xf69aabef
jae 0x1803c6b05
jmp 0x1803c6b31
mov rax, qword [rbx]
lock dec qword [rax]
sete al
test al, 1
je 0x1803c6b99
mov eax, dword [0x180793540]
add eax, dword [0x180793544]
or eax, 0x2e0d0668
add eax, 0xe1ecd09f
add eax, 0xec29dd08
cmp eax, 0x8bfd2216
jae 0x1803c6c57
mov eax, dword [0x180793548]
xor eax, dword [0x18079354c]
xor eax, 0x5914cdd
or eax, 0x514b30fd
imul edi, eax, 0x9c475d4a
mov rcx, rbx
call fcn.1804c6740
cmp edi, 0x79734db4
je 0x1803c6c57
jmp 0x1803c6b97
jmp 0x1803c6b99
mov rcx, qword [r14]
mov edx, 0x20
mov r8d, 8
call fcn.1804cafa0
jmp 0x1803c6bae
mov rsi, qword [rsi]
mov eax, dword [0x180793550]
or eax, dword [0x180793554]
or eax, 0xe0e82f20
sub eax, 0x2cb4f9e6
imul eax, eax, 0x63b19be6
cmp eax, 0xe35b4b7c
je 0x1803c6c70
jmp 0x1803c6bda
mov eax, dword [0x180793558]
or eax, dword [0x18079355c]
xor eax, 0x3a46f5d5
xor eax, 0xf1643520
mov ecx, 0xb690e54f
xor edx, edx
div ecx
mov edi, eax
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
cmp edi, 0x4511926c
ja 0x1803c6bda
jmp 0x1803c6c0e
jmp 0x1803c6a41
add rsi, 0x10
mov rcx, rsi
call fcn.1803c5780
jmp 0x1803c6a41
mov word [rcx], gs
test dword [0x16aff524b], esp
or edx, ecx
jmp 0x1803c6a02
in al, 0x99
push rsi
xchg edi, eax
out 0x48, al
mov ecx, edi
call fcn.1804b9d30
jmp 0x1803c6aa6
retfq 0xffffffffffffcd45
lodsd eax, dword [rsi]
add dl, byte [rcx]
scasd eax, dword [rdi]
rcl byte [rdi + 0x2e]
sub ebp, ecx
mov cs, word [rsp + riz*8 + 0x48]
mov ecx, ebx
call fcn.1804c6740
jmp 0x1803c6b65
pop rsi
jl 0x1803c6c6b
and byte [rcx + 0x2709f48b], cl
invalid
Function at 0x1803dfd50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r9, rdx
mov rsi, rcx
mov r8b, byte [rsi]
mov al, byte [r9]
cmp r8b, al
sete al
xor ecx, ecx
test al, 1
jne 0x1803dfd72
jmp 0x1803dfd95
movzx eax, r8b
mov cl, 1
add rax, 0xfffffffffffffffe
mov rdx, rax
sub rdx, 0xe
ja 0x1803dfd95
lea rcx, [0x1806c5df4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov eax, dword [0x1807957a0]
add eax, dword [0x1807957a4]
imul eax, eax, 0xa29cf362
xor eax, 0xe253e8fc
and eax, 0x4787c0cc
cmp eax, 0x492001f0
jae 0x1803e09d8
jmp 0x1803dfdbe
mov eax, dword [0x1807957a8]
xor edx, edx
div dword [0x1807957ac]
add eax, 0x9c21a02c
xor eax, 0x4e6a2ee8
xor eax, 0xc980286
cmp eax, 0x830ee64c
jbe 0x1803dfdbe
and cl, 1
movzx eax, cl
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
punpckhwd mm1, qword [rdi - 0x4d136ec1]
push rsp
sub ch, byte [rax - 0x2c16ba1d]
invalid
Function at 0x1803e6850
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov rcx, rsi
call fcn.1804cda80
mov r12, rax
mov r13, rdx
mov eax, dword [0x1807960a8]
xor edx, edx
div dword [0x1807960ac]
mov ecx, 0x90f99683
xor edx, edx
div ecx
imul eax, eax, 0x1c5a12d4
or eax, 0x570478c0
cmp eax, 0x169e9b96
jb 0x1803e69cb
mov eax, dword [0x1807960b0]
xor eax, dword [0x1807960b4]
mov ecx, 0x87fbd349
xor edx, edx
div ecx
mov ebp, eax
and ebp, 0x4c6ee36f
add ebp, 0x4f171054
mov rcx, r12
mov rdx, r13
mov r8, r15
mov r9, r14
call fcn.18066bdb0
mov rdi, rax
mov rbx, rdx
mov r8, qword [rsi]
cmp r8, 0
sete cl
cmp ebp, 0x79ffaf4c
ja 0x1803e69cb
jmp 0x1803e68f6
mov eax, dword [0x1807960b8]
sub eax, dword [0x1807960bc]
or eax, 0xd1babe10
or eax, 0xd0fca623
or eax, 0x58bde31d
cmp eax, 0x22a500ea
jb 0x1803e69ed
jmp 0x1803e691e
mov eax, dword [0x1807960c0]
xor edx, edx
div dword [0x1807960c4]
add eax, 0x2d014a62
or eax, 0xcb10913f
xor eax, 0x9a60fc2c
cmp eax, 0x17095dca
je 0x1803e691e
test cl, 1
jne 0x1803e69b4
jmp 0x1803e6949
add rsi, 8
mov eax, dword [0x1807960c8]
add eax, dword [0x1807960cc]
add eax, 0x81f9c1c
mov ecx, 0xf1966c8c
xor edx, edx
div ecx
xor eax, 0xc2b197b9
cmp eax, 0xffe2aeaa
je 0x1803e69fe
jmp 0x1803e6979
mov eax, dword [0x1807960d0]
and eax, dword [0x1807960d4]
mov ecx, 0x44c0290f
xor edx, edx
div ecx
imul eax, eax, 0xa8278f05
imul eax, eax, 0xdaac2f56
mov rcx, qword [rsi]
cmp eax, 0x3d27855
jb 0x1803e6979
jmp 0x1803e69a6
mov rdx, r8
mov r8d, 1
call fcn.1804cafa0
add al, ch
in al, dx
invalid
mov rax, rdi
mov rdx, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, dword [rdx + 0x4fde8bd6]
popfq
adc al, 0x9b
stosb byte [rdi], al
cmp al, 0x4c
mov ecx, esp
mov rdx, r13
mov r8, r15
mov r9, r14
call fcn.18066bdb0
jmp 0x1803e68a4
push rbp
mov bl, 0xdc
rol dword [rdi + 0x54], 1
test ebx, edx
sbb al, 0x1a
jmp 0x1803e69e3
pop rdx
jmp 0x1803e69ae
Function at 0x1803ecfa0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov r8, rdx
mov rsi, rcx
mov r9, qword [r8]
mov rcx, r8
add rcx, 8
mov eax, dword [0x180796bb8]
or eax, dword [0x180796bbc]
imul eax, eax, 0x7a390dcf
sub eax, 0x1fef707c
mov r10d, 0xb6f1dfbf
xor edx, edx
div r10d
cmp eax, 0x8c121133
jae 0x1803ed322
jmp 0x1803ecfe5
mov edx, dword [0x180796bc0]
xor edx, dword [0x180796bc4]
add edx, 0xa835ca76
add edx, 0x598ddbd7
sub edx, 0xfcd6f3a0
mov r10, qword [rcx]
cmp r10, 5
setb al
cmp edx, 0xf79c259d
ja 0x1803ecfe5
test al, 1
jne 0x1803ed01b
jmp 0x1803ed07f
mov rcx, rsi
mov rdx, r8
call fcn.1803eecd0
mov eax, dword [0x180796bc8]
or eax, dword [0x180796bcc]
xor eax, 0x966f4f2d
or eax, 0x88dc274f
or eax, 0x3e0de0a5
cmp eax, 0xbaeeaf54
jbe 0x1803ed32f
mov eax, dword [0x180796bd0]
or eax, dword [0x180796bd4]
mov ecx, 0x448a25f8
xor edx, edx
div ecx
mov ecx, 0x6216ee0a
xor edx, edx
div ecx
sub eax, 0x32812a2f
cmp eax, 0xf9532b84
jae 0x1803ed32f
jmp 0x1803ed318
mov r11, r9
add r11, 1
mov al, byte [r9]
cmp al, 0xfb
setb dl
test dl, 1
jne 0x1803ed102
jmp 0x1803ed095
mov edx, dword [0x180796bd8]
or edx, dword [0x180796bdc]
sub edx, 0x77d6894a
xor edx, 0x85c60373
and edx, 0x27589b5e
cmp edx, 0x2417acc1
ja 0x1803ed340
mov edx, dword [0x180796be0]
or edx, dword [0x180796be4]
add edx, 0x95d2b784
or edx, 0x4b6efc37
or edx, 0xe97d0430
cmp edx, 0x44f7b51d
je 0x1803ed340
add al, 5
movzx edx, al
sub al, 3
ja 0x1803ed10f
lea rax, [0x1806c647c]
movsxd rdx, dword [rax + rdx*4]
add rdx, rax
jmp rdx
movzx eax, al
mov edx, 1
jmp 0x1803ed2a4
mov eax, dword [0x180796be8]
xor edx, edx
div dword [0x180796bec]
add eax, 0xb00aa33d
and eax, 0x1a9b37d6
add eax, 0xfc12693a
cmp eax, 0x40fa23b
jbe 0x1803ed34d
jmp 0x1803ed139
mov eax, dword [0x180796bf0]
and eax, dword [0x180796bf4]
imul eax, eax, 0x88690286
add eax, 0xaca70a4
imul edi, eax, 0xedc70a43
mov rcx, rsi
mov edx, 0xc
call fcn.1806a7f10
cmp edi, 0xfa662f36
je 0x1803ed139
jmp 0x1803ed16d
jmp 0x1803ed318
add r9, rdx
sub r10, rdx
mov qword [r8], r9
mov qword [rcx], r10
mov dword [rsi + 4], eax
mov byte [rsi], 0x11
jmp 0x1803ed318
add bl, ch
add byte [rbx + 0x3a994605], cl
add byte [rbx], dh
add eax, 0x3a9944
mov eax, dword [0x180796c30]
xor eax, dword [0x180796c34]
imul edx, eax, 0x59776838
sub edx, 0xc0576660
add edx, 0xdf20d669
mov eax, dword [r11]
cmp edx, 0xa8786e63
ja 0x1803ed2e4
jmp 0x1803ed30f
bswap eax
mov edx, 5
jmp 0x1803ed2a4
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
jnp 0x1803ed320
xchg ebp, eax
mov ch, 0xaf
loopne 0x1803ed39b
invalid
wait
cwde
ret
invalid
je 0x1803ed2e1
invalid
jnp 0x1803ed3f5
mov ecx, 0xfffec9e9
jmp rax
add byte [rcx - 0x40], ch
sub ah, byte [rdx]
invalid
Function at 0x1803efd80
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rbx, rdi
add rbx, 8
mov r14, rdi
add r14, 0x10
mov r15, rdi
add r15, 0x18
mov r8, qword [r14]
mov rcx, qword [r15]
mov r12, r8
sub r12, rcx
cmp r8, rcx
jne 0x1803efdbd
xor eax, eax
jmp 0x1803efddc
mov rcx, qword [rdi]
mov rdx, rsi
mov r8, rbx
call fcn.18063ac80
mov r8, rax
mov rcx, rdx
mov eax, 2
cmp r8, 0
je 0x1803efe40
mov edx, dword [0x1807970e8]
imul edx, dword [0x1807970ec]
xor edx, 0x3a3d643e
imul edx, edx, 0x95d676a9
sub edx, 0xa34611e3
cmp edx, 0xe611ff54
ja 0x1803eff78
mov edx, dword [0x1807970f0]
mov r8d, dword [0x1807970f4]
xor edx, r8d
imul edx, edx, 0xb68fcbd2
and edx, 0x80488806
cmp edx, 0x28648a89
je 0x1803eff78
mov rdx, rcx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp rcx, 0
sete dl
mov eax, 1
test dl, 1
jne 0x1803efe53
jmp 0x1803efddc
mov eax, dword [0x1807970f8]
xor edx, edx
div dword [0x1807970fc]
mov ecx, 0x62219876
xor edx, edx
div ecx
xor eax, 0x4b7fd24a
xor eax, 0xe80518f8
cmp eax, 0xd56c6d81
je 0x1803eff85
jmp 0x1803efe81
mov eax, dword [0x180797100]
imul eax, dword [0x180797104]
sub eax, 0x1763b6a7
imul eax, eax, 0x55580839
xor eax, 0x9ef28173
mov r8, qword [r14]
cmp eax, 0x63a09a9a
jbe 0x1803efe81
jmp 0x1803efeaa
mov eax, dword [str.hMK]
and eax, dword [0x18079710c]
mov ecx, 0x63b974bd
xor edx, edx
div ecx
and eax, 0xf1ddb09f
mov ecx, 0xf1b7a796
xor edx, edx
div ecx
cmp eax, 0xac92d2d3
ja 0x1803eff96
mov eax, dword [0x180797110]
sub eax, dword [0x180797114]
add eax, 0xf5e4cda0
or eax, 0x3b3c02c8
imul eax, eax, 0x7fe002bb
mov rcx, qword [r15]
cmp eax, 0xa67758fa
ja 0x1803eff96
jmp 0x1803eff04
mov rax, r8
sub rax, rcx
cmp rax, r12
jne 0x1803efdae
call fcn.18064b380
mov rcx, rax
mov eax, dword [0x180797118]
imul eax, dword [0x18079711c]
imul eax, eax, 0x52da675e
imul eax, eax, 0x3fd1e74b
add eax, 0xdfe6eea5
cmp eax, 0x91a67464
ja 0x1803effa7
mov eax, dword [0x180797120]
and eax, dword [0x180797124]
mov r8d, 0xdd84aaac
xor edx, edx
div r8d
xor eax, 0x4e896b4a
mov r8d, 0xa4a0bc2
xor edx, edx
div r8d
cmp eax, 0x8f97dbdf
ja 0x1803effa7
mov eax, 1
jmp 0x1803efddc
adc r13, rcx
fisttp qword [rbx - 0x16fb056f]
invalid
invalid
fnstcw word [rsi + 0x1d]
jne 0x1803effd1
loope 0x1803f000c
push rbp
mov dl, 0xda
jo 0x1803f001c
jmp 0x1803efed8
rcl ebp, cl
test dword [rcx], ebx
xchg edi, eax
or dh, bh
ret 0xe4d1
add byte [rax], al
add byte [rax], al
add esp, eax
Function at 0x1803f6e60
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rsi]
movabs rax, 0x7ffffffffffffffb
mov rdx, rcx
add rdx, rax
cmp rdx, 2
setb r8b
movabs rax, 0x7ffffffffffffffc
mov rdx, rcx
add rdx, rax
xor eax, eax
test r8b, 1
cmovne rax, rdx
Function at 0x1803fe6d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [rcx]
cmp rsi, 0
sete al
test al, 1
jne 0x1803fe6e5
jmp 0x1803fe739
mov eax, dword [0x180798bf0]
and eax, dword [0x180798bf4]
or eax, 0x6330fb43
xor eax, 0x4f0acea4
mov ecx, 0xa9cd471a
xor edx, edx
div ecx
cmp eax, 0xfc22f12
jae 0x1803fe7a2
jmp 0x1803fe711
mov eax, dword [str._ti5_93o]
or eax, dword [0x180798bfc]
and eax, 0x24c4db36
xor eax, 0x77e0d6b9
or eax, 0x230ef00e
cmp eax, 0x60665eb1
jb 0x1803fe711
add rsp, 0x20
pop rsi
ret
mov rcx, rsi
call fcn.18063b3a0
test al, 1
jne 0x1803fe747
jmp 0x1803fe6e5
mov rcx, rsi
call fcn.18063bbc0
mov eax, dword [0x180798c00]
and eax, dword [0x180798c04]
xor eax, 0xbb3734bb
sub eax, 0x538f3a57
mov ecx, 0x591ab9aa
xor edx, edx
div ecx
cmp eax, 0x9514622b
je 0x1803fe7b3
jmp 0x1803fe777
mov eax, dword [0x180798c08]
or eax, dword [0x180798c0c]
mov ecx, 0xf465aca7
xor edx, edx
div ecx
xor eax, 0x6747670d
or eax, 0x2eb270fe
cmp eax, 0x7fb09968
je 0x1803fe777
jmp 0x1803fe6e5
add esp, edi
invalid
add edx, dword [rsi - 0x5f5efc90]
adc dword [rax], ebp
int1
in al, 0xfb
pop rax
jmp 0x1803fe775
Function at 0x180403d00
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov rcx, rsi
call fcn.18063b360
cmp rax, 0
sete al
test al, 1
jne 0x180403d4d
jmp 0x180403d1d
mov rcx, qword [rsi + 0x28]
call fcn.18063f660
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdx
mov rcx, rsi
add rcx, 0x30
call fcn.18034ee30
mov byte [rsi + 0xd8], 5
lea rcx, [rsp + 0x20]
call fcn.18063f700
mov rcx, rsi
call fcn.18063b3a0
test al, 1
jne 0x180403d5e
jmp 0x180403e69
mov rcx, rsi
add rcx, 0x20
mov rax, qword [rsi + 0x20]
lock dec qword [rax]
sete r8b
jmp 0x180403d73
mov eax, dword [0x180799618]
xor eax, dword [0x18079961c]
add eax, 0x8b26fcf1
add eax, 0xfb7126df
imul eax, eax, 0xb15aad72
cmp eax, 0x277aa3b
jb 0x180403e6f
jmp 0x180403d9c
mov eax, dword [0x180799620]
xor edx, edx
div dword [0x180799624]
xor eax, 0x3aae020a
mov r9d, 0x17ff7ecb
xor edx, edx
div r9d
imul eax, eax, 0x687c0cf0
cmp eax, 0x1d0540a9
jbe 0x180403d9c
test r8b, 1
jne 0x180403dcf
jmp 0x180403e20
mov eax, dword [0x180799628]
sub eax, dword [0x18079962c]
imul eax, eax, 0xc64554c
and eax, 0xc91a3220
or eax, 0xebb68b76
cmp eax, 0x6f913c63
jb 0x180403e80
jmp 0x180403df8
mov eax, dword [0x180799630]
mov edx, dword [0x180799634]
add eax, edx
or eax, 0x7cfdb6e6
add eax, 0xff898cfc
cmp eax, 0x3990522f
jbe 0x180403df8
jmp 0x180403e19
call fcn.1804b80b0
jmp 0x180403e20
mov rcx, rsi
add rcx, 0x30
call fcn.1803f5ec0
mov rax, qword [rsi + 0xf0]
cmp rax, 0
sete cl
test cl, 1
jne 0x180403e54
jmp 0x180403e41
mov rcx, rsi
add rcx, 0xf8
mov rcx, qword [rcx]
mov rax, qword [rax + 0x18]
call rax
mov rcx, rsi
mov edx, 0x100
mov r8d, 0x80
call fcn.1804cafa0
jmp 0x180403e69
add rsp, 0x30
pop rsi
ret
outsd dx, dword [rsi]
test ebp, ecx
invalid
add eax, 0xa7488f80
sahf
popfq
xor al, byte [rsi - 0x16848c9d]
invalid
Function at 0x180405ba0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rcx, rsi
call fcn.18063b360
cmp rax, 0
sete al
test al, 1
jne 0x180405c49
jmp 0x180405bc2
mov eax, dword [0x1807999a0]
imul eax, dword [0x1807999a4]
imul eax, eax, 0x3315b218
sub eax, 0x5b4f88c1
add eax, 0x3413311e
cmp eax, 0x9b9ea24
jb 0x180405d64
jmp 0x180405bec
mov eax, dword [0x1807999a8]
and eax, dword [0x1807999ac]
imul eax, eax, 0x11083537
add eax, 0x332750a6
imul eax, eax, 0x82bfb509
cmp eax, 0xc49e589a
jbe 0x180405bec
jmp 0x180405c12
mov rcx, qword [rsi + 0x28]
call fcn.18063f660
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rdx
mov rcx, rsi
add rcx, 0x30
call fcn.180351160
movabs rax, 0x8000000000000001
mov qword [rsi + 0x30], rax
lea rcx, [rsp + 0x28]
call fcn.18063f700
mov rcx, rsi
call fcn.18063b3a0
test al, 1
jne 0x180405c5a
jmp 0x180405d11
mov rcx, rsi
add rcx, 0x20
mov rax, qword [rcx]
lock dec qword [rax]
sete al
test al, 1
jne 0x180405c71
jmp 0x180405c78
call fcn.1804b80b0
jmp 0x180405c78
mov rcx, rsi
add rcx, 0x30
call fcn.1803fe7d0
mov rax, rsi
add rax, 0x3f8
mov rax, qword [rax]
cmp rax, 0
sete cl
test cl, 1
jne 0x180405cab
jmp 0x180405c9e
mov rcx, qword [rsi + 0x400]
mov rax, qword [rax + 0x18]
call rax
mov eax, dword [0x1807999b0]
xor eax, dword [0x1807999b4]
sub eax, 0xba576052
or eax, 0x16bd4e09
xor eax, 0xb0876f96
cmp eax, 0x3c7bcdf
jb 0x180405d75
jmp 0x180405cd3
mov edi, dword [0x1807999b8]
imul edi, dword [0x1807999bc]
or edi, 0x5f6023e0
xor edi, 0x259cd7c0
sub edi, 0x85ea4304
mov rcx, rsi
mov edx, 0x480
mov r8d, 0x80
call fcn.1804cafa0
cmp edi, 0x75c98a14
ja 0x180405cd3
jmp 0x180405d0f
jmp 0x180405d11
mov eax, dword [0x1807999c0]
imul eax, dword [0x1807999c4]
and eax, 0x2f6b15dc
xor eax, 0x5f1774d7
and eax, 0x469d2c49
cmp eax, 0x1e19e2e1
je 0x180405d95
jmp 0x180405d36
mov eax, dword [0x1807999c8]
imul eax, dword [0x1807999cc]
add eax, 0xc4bf0f3f
xor eax, 0xdf060401
mov ecx, 0x65339ccc
add dword [rsi + rax], eax
fistp qword [rcx + 0x65339ccc]
xor edx, edx
div ecx
cmp eax, 0x35a0ebd1
ja 0x180405d36
add rsp, 0x38
pop rdi
pop rsi
ret
push rdi
sar dword [rbp + 8], 1
xlatb
std
ja 0x180405d49
fidivr dword [rax]
jmp 0x180405bea
invalid
out dx, al
sbb eax, 0x53d1fe1f
xchg edx, eax
int 0x5c
in al, 0xb6
push rsi
jmp 0x180405d34

Function at 0x18040f390
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov rsi, rcx
mov eax, dword [0x18079a818]
add eax, 0x38b46a
sub eax, dword [0x18079a81c]
mov ecx, 0x28f9b32a
xor edx, edx
div ecx
xor eax, 0x10b97bae
or eax, 0xdf0a160c
or bl, bh