joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180273990
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov eax, dword [0x180521d00]
imul eax, dword [0x180521d04]
imul eax, eax, 0xd3838751
add eax, 0xf7195d8e
xor eax, 0x72ce9592
cmp eax, 0x78ba9cde
ja 0x180273b9c
jmp 0x1802739c1
mov eax, dword [0x180521d08]
sub eax, dword [0x180521d0c]
xor eax, 0x7896a20c
xor eax, 0xa0140fbb
imul edx, eax, 0xa012d567
mov rsi, qword [rcx]
mov rbx, qword [rcx + 8]
mov rax, rbx
add rax, 0x10
cmp edx, 0xd31982ed
je 0x1802739c1
jmp 0x1802739f5
mov rdi, qword [rax]
mov rax, qword [rbx]
cmp rax, 0
sete cl
test cl, 1
jne 0x180273a20
jmp 0x180273a09
mov rdx, rdi
add rdx, 0xffffffffffffffff
and rdx, 0xfffffffffffffff0
add rdx, 0x10
mov rcx, rsi
add rcx, rdx
call rax
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete al
test al, 1
jne 0x180273b94
jmp 0x180273a37
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete cl
jmp 0x180273a47
mov eax, dword [0x180521d10]
imul eax, dword [0x180521d14]
mov r8d, 0xef1c898f
xor edx, edx
div r8d
add eax, 0xb81e9c6
imul eax, eax, 0x587963fb
cmp eax, 0x5262f891
je 0x180273ba9
jmp 0x180273a77
mov eax, dword [0x180521d18]
or eax, dword [0x180521d1c]
add eax, 0xb616ed7
imul eax, eax, 0x25db9368
add eax, 0x2e6d0e3
cmp eax, 0x51955c63
jae 0x180273a77
test cl, 1
jne 0x180273aa4
jmp 0x180273b94
mov eax, dword [0x180521d20]
imul eax, dword [0x180521d24]
mov ecx, 0x2fbe6ff8
xor edx, edx
div ecx
xor eax, 0xebba8c0d
add eax, 0x90582f58
cmp eax, 0x939058e7
ja 0x180273bba
jmp 0x180273ad1
mov eax, dword [0x180521d28]
mov ecx, dword [0x180521d2c]
add eax, ecx
imul ecx, eax, 0x447d6c3a
add ecx, 0x8b101076
mov rax, rbx
add rax, 8
cmp ecx, 0xbfd994fc
ja 0x180273ad1
jmp 0x180273afc
mov rax, qword [rax]
mov rcx, rdi
sub rcx, 9
mov r8d, 8
cmovae r8, rdi
mov rcx, r8
add rcx, 0xf
mov edx, dword [0x180521d30]
or edx, dword [0x180521d34]
or edx, 0xdc65e01b
imul edx, edx, 0xa24ec1c2
xor edx, 0x9bb67752
cmp edx, 0x7be4dc71
ja 0x180273bc7
jmp 0x180273b43
mov edx, dword [0x180521d38]
sub edx, dword [0x180521d3c]
add edx, 0xc0e6b9ea
and edx, 0xa579d9d5
imul r10d, edx, 0xc4a4d48f
mov rdx, rcx
add rdx, rax
xor r9d, r9d
sub r9, r8
and rdx, r9
cmp rdx, 0
sete r9b
cmp r10d, 0xee90ec4c
je 0x180273b43
test r9b, 1
jne 0x180273b94
jmp 0x180273b8a
mov rcx, rsi
call fcn.1802cbf20
jmp 0x180273b94
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
in eax, 0x10
mov bl, 8
jrcxz 0x180273bc6
ror edi, cl
jmp 0x1802739bf
xchg ebx, eax
sbb eax, 0x71c4315b
in eax, 0xe7
push 0x20
jmp 0x17ee32595
and eax, 0x5998a6f2
or al, 0x33
cmc
jmp 0x180273acf
invalid
std
nop
invalid
Function at 0x180274340
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x180521df0]
and eax, dword [0x180521df4]
or eax, 0xabce5673
sub eax, 0x9421f48a
add eax, 0xb2c04074
cmp eax, 0x33ea0c4d
je 0x180274432
mov eax, dword [0x180521df8]
sub eax, dword [0x180521dfc]
add eax, 0x8380b1a5
mov ecx, 0x7fd4753d
xor edx, edx
div ecx
or eax, 0xe232be08
mov rcx, rsi
add rcx, 0x10
cmp eax, 0x97d43c90
je 0x180274432
jmp 0x1802743a1
call fcn.180271f00
mov rax, 0xffffffffffffffff
cmp rsi, rax
je 0x18027442c
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete al
test al, 1
jne 0x1802743c6
jmp 0x18027442c
mov eax, dword [0x180521e00]
xor edx, edx
div dword [0x180521e04]
and eax, 0xf998699b
sub eax, 0x88a5774d
mov ecx, 0x95ab6c4
xor edx, edx
div ecx
cmp eax, 0x17aad2a2
je 0x180274443
jmp 0x1802743f0
mov eax, dword [0x180521e08]
mov ecx, dword [0x180521e0c]
add eax, ecx
xor eax, 0x97094af5
imul rax, rax, 0x13cd49a7
shr rax, 0x3c
cmp eax, 0x3a88528
jae 0x1802743f0
jmp 0x180274417
mov rcx, rsi
mov edx, 0x88
mov r8d, 8
call fcn.1802cbf20
jmp 0x18027442c
add rsp, 0x20
pop rsi
ret
shrd dword [rcx + rdi + 0x5aff279c], edx, 0x77
invalid
fidiv word [rcx - 0x21]
cmp bl, bl
xor cl, byte [rdx - 0x1ea507c0]
invalid

Function at 0x180274460
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x180521e10]
sub eax, dword [str.J__]
imul eax, eax, 0xd5a0dd1c
xor eax, 0x8c698e1
imul eax, eax, 0x71203768
cmp eax, 0xe808de27
ja 0x1802745b7
mov eax, dword [0x180521e18]
imul eax, dword [0x180521e1c]
imul eax, eax, 0xc82d76a3
add eax, 0xc0a8827a
mov r8d, 0xd3a9eabf
xor edx, edx
div r8d
mov rsi, qword [rcx]
cmp eax, 0x336be2b
je 0x1802745b7
jmp 0x1802744c1
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rax, 0xffffffffffffffff
cmp rsi, rax
je 0x1802745b0
mov eax, dword [0x180521e20]
add eax, dword [0x180521e24]
and eax, 0xec26151b
sub eax, 0x8d11af3e
or eax, 0x4660756b
cmp eax, 0x45637239
je 0x1802745c8
jmp 0x180274503
mov eax, dword [0x180521e28]
xor edx, edx
div dword [0x180521e2c]
mov ecx, 0x6c822b6b
xor edx, edx
div ecx
or eax, 0x8f9bd20a
mov ecx, 0xdf7c3983
xor edx, edx
div ecx
mov rcx, rsi
add rcx, 8
cmp eax, 0x4c86fffa
je 0x180274503
jmp 0x180274538
lock dec qword [rcx]
sete al
test al, 1
jne 0x180274545
jmp 0x1802745b0
mov eax, dword [0x180521e30]
add eax, dword [0x180521e34]
mov ecx, 0x3987c8bd
xor edx, edx
div ecx
imul eax, eax, 0x4351ff39
and eax, 0x618a4dfa
cmp eax, 0xbe67e73c
je 0x1802745d5
jmp 0x18027456e
mov eax, dword [0x180521e38]
and eax, dword [0x180521e3c]
mov ecx, 0xd2f02397
xor edx, edx
div ecx
mov edi, eax
add edi, 0x6618c3de
xor edi, 0x91b28cf7
mov rcx, rsi
mov edx, 0x18
mov r8d, 8
call fcn.1802cbf20
cmp edi, 0xbd595b7a
jbe 0x18027456e
jmp 0x1802745ae
jmp 0x1802745b0
add rsp, 0x28
pop rdi
pop rsi
ret
cmp ch, bl
neg dword [rcx + 0xceabce5]
fistp dword [rdx + 0x57]
test cl, ch
invalid
sbb byte ss:[rbx - 0x34], cl
sub dword [rcx - 0x23], 0xff2ce944
invalid
cld
mov dl, 0xba
xor byte [rsi - 0x1d], 0x8d
mov rcx, rsi
mov edx, 0x18
mov r8d, 8
call fcn.1802cbf20
jmp 0x18027456c
Function at 0x180274f50
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [rcx]
mov rcx, rsi
add rcx, 0x18

Function at 0x180275380
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp rsi, 0
setne al
mov rcx, rsi
add rcx, 0x10
call fcn.180298a50
mov r8, qword [rsi + 0x10]
cmp r8, 0
sete al
test al, 1
jne 0x180275412
jmp 0x1802753ac
mov eax, dword [0x180521f90]
imul eax, dword [0x180521f94]
or eax, 0x2f97c823
and eax, 0xad2cffba
or eax, 0xb564e190
cmp eax, 0x2c643d9b
je 0x1802754fe
jmp 0x1802753d5
mov eax, dword [0x180521f98]
add eax, dword [0x180521f9c]
mov ecx, 0x9e8c57c9
xor edx, edx
div ecx
and eax, 0x1bf91b27
xor eax, 0x409d0847
mov rcx, qword [rsi + 0x18]
cmp eax, 0xda497fea
jae 0x1802753d5
jmp 0x180275401
imul rdx, r8, 0x70
mov r8d, 8
call fcn.1802cbf20
jmp 0x180275412
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete al
test al, 1
jne 0x1802754ad
jmp 0x180275429
mov rcx, rsi
add rcx, 8
mov eax, dword [0x180521fa0]
sub eax, dword [0x180521fa4]
add eax, 0xc7fe7182
xor eax, 0xa45294fb
imul eax, eax, 0x71fcdb50
cmp eax, 0xb204f007
jb 0x18027550f
jmp 0x180275459
mov eax, dword [0x180521fa8]
imul eax, dword [0x180521fac]
mov r8d, 0xd47d0a9b
xor edx, edx
div r8d
mov r8d, 0xd453283d
xor edx, edx
div r8d
sub eax, 0x86772efb
lock dec qword [rcx]
sete dl
cmp eax, 0xb1a28498
je 0x180275459
jmp 0x180275491
test dl, 1
jne 0x180275498
jmp 0x1802754ad
mov rcx, rsi
mov edx, 0x30
mov r8d, 8
call fcn.1802cbf20
jmp 0x1802754ad
mov eax, dword [0x180521fb0]
xor eax, dword [0x180521fb4]
sub eax, 0x57999fc
sub eax, 0xd1636e51
mov ecx, 0x3201c6d7
xor edx, edx
div ecx
cmp eax, 0x186a0ff3
jae 0x180275527
jmp 0x1802754d5
mov eax, dword [0x180521fb8]
add eax, dword [0x180521fbc]
imul eax, eax, 0x2aa1744a
sub eax, 0xd2b83791
xor eax, 0xc6885f69
cmp eax, 0x18c8e858
jbe 0x1802754d5
add rsp, 0x20
pop rsi
ret
invalid
cdq
jb 0x18027558c
xor bh, byte [rdi + rcx*4]
jo 0x180275528
sal dword [rcx - 0x64], 0xed
lock dec qword [rcx]
sete al
jmp 0x180275457
fist word [rdi - 0x69fc71d3]
sbb dword [rcx - 0x15], ebp
movabs byte [0xcccccccccccccccc], al
int3
xchg edi, eax
sub eax, 0x1996038e
imul ebp, ebx, 0xcccccca2
int3
cmp esi, eax
Function at 0x1802757b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rsi
add rbx, 0x10
mov eax, dword [0x180521ff0]
sub eax, dword [0x180521ff4]
xor eax, 0x4f221319
imul eax, eax, 0xe4d08607
imul eax, eax, 0x28cf9c09
cmp eax, 0x358b83a9
je 0x180275a06
mov eax, dword [0x180521ff8]
or eax, dword [0x180521ffc]
sub eax, 0x859d560b
sub eax, 0xaf7192bc
or eax, 0x4c9da6be
mov r14, rsi
add r14, 0x18
mov r15, qword [rsi + 0x18]
cmp eax, 0x83f43544
jbe 0x180275a06
jmp 0x180275825
mov eax, dword [0x180522000]
sub eax, dword [0x180522004]
mov ecx, 0x7f5b85b7
xor edx, edx
div ecx
or eax, 0x731f58aa
and eax, 0x55b2b601
cmp eax, 0x18c38e67
jbe 0x180275a13
jmp 0x180275851
mov eax, dword [0x180522008]
or eax, dword [0x18052200c]
and eax, 0x3e95736c
sub eax, 0x7964f573
imul ecx, eax, 0x19f88abb
mov r12, qword [rsi + 0x20]
cmp r12, 0
sete al
cmp ecx, 0x4c8116d2
jbe 0x180275851
test al, 1
jne 0x180275919
jmp 0x18027588a
xor r13d, r13d
jmp 0x18027588f
mov rax, r13
shl rax, 4
mov rdi, r15
add rdi, rax
add r13, 1
mov rax, qword [rdi]
lock dec qword [rax]
sete al
test al, 1
je 0x180275908
mov eax, dword [0x180522010]
and eax, dword [0x180522014]
xor eax, 0xf27007a3
xor eax, 0x62508eeb
or eax, 0xbf242997
cmp eax, 0xea9f4891
je 0x180275a20
jmp 0x1802758d6
mov ebp, dword [0x180522018]
add ebp, dword [0x18052201c]
and ebp, 0xf8ba54da
add ebp, 0x4b4c605e
xor ebp, 0x440e02a1
mov rcx, rdi
call fcn.180273990
cmp ebp, 0x4f6abca4
jbe 0x1802758d6
jmp 0x180275906
jmp 0x180275908
cmp r13, r12
sete al
test al, 1
jne 0x180275917
jmp 0x18027588f
jmp 0x180275919
mov eax, dword [0x180522020]
sub eax, dword [0x180522024]
or eax, 0x66301689
add eax, 0x252e015a
sub eax, 0x5ec26438
cmp eax, 0xa6cab344
ja 0x180275a35
jmp 0x180275941
mov eax, dword [0x180522028]
xor edx, edx
div dword [0x18052202c]
or eax, 0x8244814d
add eax, 0xd7077aa0
and eax, 0xdc3a9aa6
mov rdx, qword [rbx]
cmp eax, 0x7d3eb859
je 0x180275941
jmp 0x18027596a
cmp rdx, 0
je 0x180275982
mov rcx, qword [r14]
shl rdx, 4
mov r8d, 8
call fcn.1802cbf20
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete al
test al, 1
jne 0x1802759f5
jmp 0x180275995
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete al
test al, 1
jne 0x1802759a9
jmp 0x1802759f5
mov eax, dword [str.__a_V]
sub eax, dword [0x180522034]
mov ecx, 0x987239cf
xor edx, edx
div ecx
add eax, 0x5daa0bb4
imul eax, eax, 0x6fe3c022
cmp eax, 0x7c9f3a6e
je 0x180275a46
invalid
jmp 0x1802759d2
mov eax, 0x81913fc7
cmp eax, 0xf0dfa2a5
jae 0x1802759d2
jmp 0x1802759e0
mov rcx, rsi
mov edx, 0x28
mov r8d, 8
call fcn.1802cbf20
jmp 0x1802759f5
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test byte [rdi], 0x33
jle 0x1802759ac
fild dword [rsi]
jmp 0x1802757f2
sbb esi, dword [rax - 0x7f]
mov byte [rbp - 0x16ce111c], bh
invalid
mov ebp, 0xccc78e5e
in eax, dx
mov al, byte [rax + rcx*2 - 0x77]
stc
call fcn.180273990
jmp 0x1802758d4
push rsp
add bl, byte cs:[rbp + rbp - 0x4490b23f]
mov edx, 0xf9e9cc1c
invalid
lodsd eax, dword [rsi]
sbb eax, 0x44ccca01
invalid
Function at 0x180275eb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, dword [0x1805220a8]
add eax, dword [0x1805220ac]
sub eax, 0xdef1feb5
and eax, 0xe405a152
add eax, 0x5b40a7ff
cmp eax, 0x60494d4f
jbe 0x1802760a4
jmp 0x180275ee0
mov eax, dword [0x1805220b0]
imul eax, dword [0x1805220b4]
xor eax, 0x94925ccf
sub eax, 0xe4f800e2
and eax, 0x991a2696
mov rsi, qword [rcx]
cmp eax, 0x7ab0952a
jbe 0x180275ee0
jmp 0x180275f08
mov rax, qword [rsi + 0x60]
cmp rax, 0
je 0x180275f89
mov rcx, rsi
add rcx, 0x58
mov rdi, qword [rcx]
imul rbx, rax, 0x18
mov eax, dword [0x1805220b8]
and eax, dword [0x1805220bc]
add eax, 0x20b68b9
mov ecx, 0x7ed3cda0
xor edx, edx
div ecx
mov ecx, 0x33d67b76
xor edx, edx
div ecx
cmp eax, 0x74350a7c
jae 0x1802760b5
jmp 0x180275f50
mov ebp, dword [0x1805220c0]
sub ebp, dword [0x1805220c4]
add ebp, 0x294aba76
and ebp, 0xaa54f449
and ebp, 0xf4bd3cd3
mov rcx, rdi
mov rdx, rbx
mov r8d, 8
call fcn.1802cbf20
cmp ebp, 0xac992c02
jae 0x180275f50
jmp 0x180275f89
mov rcx, rsi
add rcx, 0x20
mov rax, qword [rcx]
cmp rax, 0
je 0x180275faf
lock dec qword [rax]
sete al
jmp 0x180275fa2
test al, 1
jne 0x180275fa8
jmp 0x180275faf
call fcn.180273990
jmp 0x180275faf
mov rcx, rsi
add rcx, 0x30
mov rax, qword [rcx]
cmp rax, 0
je 0x180275fd5
lock dec qword [rax]
sete al
jmp 0x180275fc8
test al, 1
jne 0x180275fce
jmp 0x180275fd5
call fcn.180273990
jmp 0x180275fd5
mov rcx, rsi
add rcx, 0xc0
call fcn.180271aa0
mov rcx, rsi
add rcx, 0x148
mov rax, qword [rcx]
lock dec qword [rax]
sete al
test al, 1
je 0x180276003
call fcn.180275a50
jmp 0x180276003
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete al
test al, 1
jne 0x18027609b
jmp 0x18027601a
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete al
test al, 1
jne 0x18027602e
jmp 0x18027609b
mov eax, dword [0x1805220c8]
xor eax, dword [0x1805220cc]
and eax, 0xaca27f6
or eax, 0x9b0bede0
mov ecx, 0xcaeadd3e
xor edx, edx
div ecx
cmp eax, 0x8aef72ed
ja 0x1802760d3
jmp 0x180276056
mov eax, dword [0x1805220d0]
mov ecx, dword [0x1805220d4]
and eax, ecx
imul eax, eax, 0xcc5bfb12
mov ecx, 0x8a646f67
imul rax, rcx
shr rax, 0x3f
imul eax, eax, 0x362fee6a
cmp eax, 0x7a4847ac
jae 0x180276056
jmp 0x180276086
mov rcx, rsi
mov edx, 0x160
mov r8d, 8
call fcn.1802cbf20
jmp 0x18027609b
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
sub byte [0x1f0a5afa1], bl
retf
lahf
push rsi
int 0x1b
and eax, ebp
or ecx, dword [rax - 0x77]
stc
mov rdx, rbx
mov r8d, 8
call fcn.1802cbf20
jmp 0x180275f4e
pop rax
cmp dword [rsi], edx
call qword [rcx + 0x9d5c4ce]
int 0x2c
mov al, 0xe9
jo 0x1802760e1
invalid
invalid
Function at 0x180277290
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x180522258]
xor edx, edx
div dword [0x18052225c]

Function at 0x180277420
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [rcx]
mov rax, rsi
add rax, 0x10
mov rcx, qword [rax]
mov edx, 0x800
mov r8d, 8
call fcn.1802cbf20
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete al
test al, 1
jne 0x1802774da
jmp 0x180277459
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete cl
jmp 0x180277469
mov eax, dword [0x180522288]
xor edx, edx
div dword [0x18052228c]
mov r8d, 0xd80e7d4c
xor edx, edx
div r8d
xor eax, 0xd3288344
mov r8d, 0x974b24d0
xor edx, edx
div r8d
cmp eax, 0x82ce83
jae 0x1802774e0
jmp 0x18027749b
mov eax, dword [0x180522290]
or eax, dword [0x180522294]
imul eax, eax, 0x9a5789ef
xor eax, 0x5246990d
and eax, 0x525d6c4f
cmp eax, 0x6b79bc8e
ja 0x18027749b
test cl, 1
jne 0x1802774c5
jmp 0x1802774da
mov rcx, rsi
mov edx, 0x28
mov r8d, 8
call fcn.1802cbf20
jmp 0x1802774da
add rsp, 0x20
pop rsi
ret
invalid

Function at 0x180277530
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [rcx]
mov rax, rsi
add rax, 0x18
mov rcx, qword [rax]
cmp rcx, 0
je 0x180277564
lock dec qword [rcx]
sete cl
jmp 0x180277551
test cl, 1
jne 0x180277558
jmp 0x180277564
mov rcx, qword [rax]
mov rdx, qword [rsi + 0x20]
call fcn.180272440
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete cl
mov eax, dword [0x180522298]
imul eax, dword [0x18052229c]
or eax, 0xfb579fc4
sub eax, 0x79170a12
or eax, 0xcfa14ea9
cmp eax, 0x14b76882
jb 0x1802775f4
jmp 0x180277596
mov eax, dword [0x1805222a0]
or eax, dword [0x1805222a4]
mov r8d, 0x2ade09dd
xor edx, edx
div r8d
xor eax, 0x1e01c091
or eax, 0x8c0ccfce
cmp eax, 0x12763f81
je 0x180277596
test cl, 1
jne 0x1802775ee
jmp 0x1802775c5
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete al
test al, 1
jne 0x1802775d9
jmp 0x1802775ee
mov rcx, rsi
mov edx, 0x28
mov r8d, 8
call fcn.1802cbf20
jmp 0x1802775ee
add rsp, 0x20
pop rsi
ret
test eax, 0x4cc1cfe6
sbb al, 0x2f
pushfq
jmp 0x180277594
Function at 0x180277600
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [rcx]
mov rcx, rsi
add rcx, 0x10
mov al, byte [rsi + 0x20]
cmp al, 3
je 0x180277765
cmp al, 2
sete al
test al, 1
jne 0x180277628
jmp 0x180277730
mov eax, dword [0x1805222a8]
imul eax, dword [0x1805222ac]
imul eax, eax, 0xf0f784b6
sub eax, 0x9f858800
or eax, 0x9c8720ac
cmp eax, 0xe475c160
jb 0x1802777f5
mov eax, dword [0x1805222b0]
sub eax, dword [str.PaHT]
add eax, 0x4b219fcd
and eax, 0xe4dfd97c
xor eax, 0x8696520b
cmp eax, 0x6bc84b2e
ja 0x1802777f5
jmp 0x180277678
mov eax, dword [0x1805222b8]
imul eax, dword [0x1805222bc]
xor eax, 0x21189ddf
and eax, 0x7020a631
xor eax, 0x12764029
cmp eax, 0x40f23a8e
jbe 0x180277802
jmp 0x1802776a1
mov eax, dword [0x1805222c0]
imul eax, dword [0x1805222c4]
xor eax, 0x995f7a12
imul eax, eax, 0x343eae32
mov r8d, 0x203cc8bb
xor edx, edx
div r8d
mov rdx, qword [rcx]
lock dec qword [rdx]
sete dl
cmp eax, 0x998ced34
ja 0x1802776a1
test dl, 1
jne 0x1802776df
jmp 0x180277765
mov eax, dword [0x1805222c8]
sub eax, dword [0x1805222cc]
or eax, 0x64a32bb6
or eax, 0xd033ee2a
or eax, 0x1255ffa2
cmp eax, 0xf4de20ee
je 0x18027781d
jmp 0x180277707
mov eax, dword [0x1805222d0]
mov edx, dword [0x1805222d4]
sub eax, edx
imul eax, eax, 0x49151981
or eax, 0xbbb9d5ff
cmp eax, 0xb0fa711d
jbe 0x180277707
jmp 0x180277729
call fcn.1802763b0
jmp 0x180277765
mov rax, qword [rcx]
lock dec qword [rax]
sete al
test al, 1
je 0x180277745
call fcn.1802763b0
jmp 0x180277745
mov rax, rsi
add rax, 0x18
mov rcx, qword [rax]
lock dec qword [rcx]
sete cl
test cl, 1
jne 0x18027775d
jmp 0x180277765
mov rcx, qword [rax]
call fcn.180273be0
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete al
test al, 1
jne 0x1802777ef
jmp 0x180277778
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete al
jmp 0x180277788
test al, 1
jne 0x18027778e
jmp 0x1802777ef
mov rcx, rsi
mov edx, 0x28
mov r8d, 8
call fcn.1802cbf20
mov eax, dword [0x1805222d8]
and eax, dword [0x1805222dc]
mov ecx, 0xf40fbc94
xor edx, edx
div ecx
and eax, 0x95f36849
sub eax, 0x891e41e6
cmp eax, 0x5b70bb2c
je 0x18027782a
mov eax, dword [0x1805222e0]
and eax, dword [0x1805222e4]
sub eax, 0xb73c3546
sub eax, 0xd22efe6b
mov ecx, 0x52d44803
xor edx, edx
div ecx
cmp eax, 0x26013a8a
ja 0x18027782a
jmp 0x1802777ef
add rsp, 0x20
pop rsi
ret
cmpsd dword [rsi], dword [rdi]
ret 0x7cc3
push 0x5432c51a
invalid
cmp dh, dh
or edx, dword [rdi - 1]
xchg esp, eax
fcmovbe st(0), st(7)
jmp 0x180277705
invalid
Function at 0x180279d20
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [rcx]
mov rcx, rsi
add rcx, 0x10
mov rax, qword [rsi + 0x10]
lock dec qword [rax]
sete al
test al, 1
jne 0x180279d40
jmp 0x180279d92
call fcn.180272e10
mov eax, dword [0x180522658]
or eax, dword [0x18052265c]
mov ecx, 0x638da754
xor edx, edx
div ecx
add eax, 0x723a0be1
sub eax, 0x6e07f202
cmp eax, 0x3ddf74c2
ja 0x180279dd4
jmp 0x180279d6d
mov eax, dword [0x180522660]
xor eax, dword [0x180522664]
add eax, 0xb04064be
add eax, 0x9931f8b8
imul eax, eax, 0x74fd0a17
cmp eax, 0x623bf82b
jbe 0x180279d6d
jmp 0x180279d92
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete al
test al, 1
jne 0x180279dce
jmp 0x180279da5
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete al
test al, 1
jne 0x180279db9
jmp 0x180279dce
mov rcx, rsi
mov edx, 0x30
mov r8d, 8
call fcn.1802cbf20
jmp 0x180279dce
add rsp, 0x20
pop rsi
ret
and dword [rax - 0x73821b7c], ebx
cmp ebx, esi
jmp 0x180279d6b
Function at 0x18027b320
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rbx, r8
mov rdi, rcx
mov rsi, rdi

Function at 0x18027bc00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov rdi, rdx
mov rsi, rcx
mov eax, dword [0x180522878]
imul eax, dword [0x18052287c]
add eax, 0xad5f69fc
add eax, 0xd4254f1e
and eax, 0x1d9ecc46
cmp eax, 0x4806ff54
je 0x18027be0c
jmp 0x18027bc38
mov eax, dword [0x180522880]
add eax, dword [0x180522884]
and eax, 0xd22146fd
xor eax, 0x390e3cb
or eax, 0xeb22136e
cmp rdi, 0
setne cl
cmp eax, 0x27d6995c
je 0x18027bc38
jmp 0x18027bc63
add rdi, 0x10
mov rcx, rdi
call fcn.1803c0b00
test al, 1
jne 0x18027bde0
mov r8, qword [rsi]
mov eax, dword [0x180522888]
sub eax, dword [0x18052288c]
add eax, 0xea7a0cf0
mov ecx, 0xc21ece65
xor edx, edx
div ecx
sub eax, 0xf97cd04b
cmp eax, 0xf10a538b
ja 0x18027be1d
jmp 0x18027bca6
mov eax, dword [0x180522890]
sub eax, dword [0x180522894]
or eax, 0x79a70b13
imul ecx, eax, 0x3e40addc
sub ecx, 0x13eec0ae
cmp r8, 0
sete al
cmp ecx, 0x52c0285f
jb 0x18027bca6
test al, 1
jne 0x18027bcf2
jmp 0x18027bcd8
mov rax, rsi
add rax, 8
mov rcx, qword [rax]
mov rdx, r8
mov r8d, 1
call fcn.1802cbf20
jmp 0x18027bcf2
mov rdx, qword [rsi + 0x18]
movabs rax, 0x8000000000000000
cmp rdx, rax
sete al
test al, 1
jne 0x18027bd2e
jmp 0x18027bd0c
cmp rdx, 0
sete al
test al, 1
jne 0x18027bd2e
jmp 0x18027bd19
mov rax, rsi
add rax, 0x20
mov rcx, qword [rax]
mov r8d, 1
call fcn.1802cbf20
mov rax, rsi
add rax, 0x30
mov rdx, qword [rax]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x18027bd6b
cmp rdx, 0
sete al
test al, 1
jne 0x18027bd6b
jmp 0x18027bd54
mov rax, rsi
add rax, 0x38
mov rcx, qword [rax]
mov r8d, 1
call fcn.1802cbf20
jmp 0x18027bd6b
mov rax, rsi
add rax, 0x50
mov rcx, qword [rax]
cmp rcx, 0
sete al
xor edx, edx
test al, 1
mov eax, 0
jne 0x18027bdc5
jmp 0x18027bd89
mov rax, qword [rsi + 0x60]
mov rdx, qword [rsi + 0x58]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x20]
add rcx, 0x38
mov qword [rcx], rdx
mov edx, 1
jmp 0x18027bdc5
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x20]
call fcn.180265460
jmp 0x18027be02
lea rcx, [rsp + 0x68]
mov rdx, rsi
mov r8d, 0x70
call fcn.180468b10
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.18026fc90
jmp 0x18027be02
add rsp, 0xd8
pop rdi
pop rsi
ret
push 0x40c4546
invalid
push rax
invalid
Function at 0x18027d7e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rax, rsi
add rax, 0xb8
movzx ecx, byte [rax]
mov eax, dword [0x180522a78]
or eax, dword [0x180522a7c]
sub eax, 0x9e127a7e
mov r8d, 0x889cffbb
xor edx, edx
div r8d
mov r8d, 0xe0536ae8
xor edx, edx
div r8d
cmp eax, 0xa018c043
jae 0x18027da24
jmp 0x18027d82a
mov eax, dword [0x180522a80]
or eax, dword [0x180522a84]
add eax, 0x37719bdc
and eax, 0xe07cca33
add eax, 0xc8a9baf7
cmp eax, 0xffb0c751
jae 0x18027d82a
test ecx, ecx
je 0x18027d865
jmp 0x18027d852
sub ecx, 3
je 0x18027d967
jmp 0x18027d85d
mov rdx, qword [rsi]
cmp rdx, 0
sete al
test al, 1
jne 0x18027d88c
jmp 0x18027d875
mov rax, rsi
add rax, 8
mov rcx, qword [rax]
mov r8d, 1
call fcn.1802cbf20
jmp 0x18027d88c
mov rax, rsi
add rax, 0x18
mov ecx, dword [0x180522a88]
sub ecx, dword [0x180522a8c]
xor ecx, 0x4af7f1a3
add ecx, 0xf35af578
xor ecx, 0xf939b1c1
cmp ecx, 0x8a354578
je 0x18027da31
mov ecx, dword [0x180522a90]
sub ecx, dword [0x180522a94]
add ecx, 0x12bee10c
and ecx, 0x999f0693
and ecx, 0xa69ad29e
mov rdi, qword [rax]
cmp ecx, 0xe0528ff1
je 0x18027da31
jmp 0x18027d8ec
cmp rdi, 0
je 0x18027d85d
add rsi, 0x20
mov eax, dword [0x180522a98]
or eax, dword [0x180522a9c]
xor eax, 0xd43787f2
add eax, 0x793c00e7
xor eax, 0x6441998a
cmp eax, 0x853b0d61
je 0x18027da42
mov rax, rsi
add rax, 0xb0
cmp byte [rax], 0
sete al
test al, 1
jne 0x18027d97c
jmp 0x18027d9a7
mov rax, rsi
add rax, 0x90
mov rdx, qword [rax]
cmp rdx, 0
je 0x18027d9a7
mov rax, rsi
add rax, 0x98
mov rcx, qword [rax]
mov r8d, 1
call fcn.1802cbf20
jmp 0x18027d9a7
mov rdi, rsi
add rdi, 0xbb
mov al, byte [rsi + 0xbb]
cmp al, 0
sete al
test al, 1
jne 0x18027d9c2
jmp 0x18027d9d4
mov rbx, rsi
add rbx, 0xba
mov al, byte [rbx]
cmp al, 0
je 0x18027d9f5
jmp 0x18027da00
mov rax, rsi
add rax, 0x40
mov rdx, qword [rax]
cmp rdx, 0
je 0x18027d9c2
mov rcx, qword [rsi + 0x48]
mov r8d, 1
call fcn.1802cbf20
jmp 0x18027d9c2
mov byte [rbx], 0
mov byte [rdi], 0
jmp 0x18027d85d
mov rax, rsi
add rax, 0x58
mov rdx, qword [rax]
cmp rdx, 0
je 0x18027d9f5
add rsi, 0x60
mov rcx, qword [rsi]
mov r8d, 1
call fcn.1802cbf20
jmp 0x18027d9f5
sti
xlatb
adc eax, 0xbb6f4df8
adc eax, 0xfffdf7e9
jmp qword [0x17da68d1e]
jle 0x18027da33
and eax, 0xfd7eb2e8
mov dh, 0x3b