joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180322550
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x180783010]
or eax, dword [0x180783014]
or eax, 0x8a1b7ac0
or eax, 0xe13c3e5c
or eax, 0xe7966f3f
cmp eax, 0xe016a5a1
jb 0x180322616
mov eax, dword [0x180783018]
add eax, dword [0x18078301c]
imul eax, eax, 0x389ac810
or eax, 0xf8076b68
add eax, 0x97767a20
imul r8, rdx, 0x39641
cmp eax, 0x67993613
je 0x180322616
jmp 0x1803225a2
xor r8, 0xffffffffffffffff
mov eax, dword [0x180783020]
and eax, dword [0x180783024]
xor eax, 0x94712b23
and eax, 0x56217f60
or eax, 0x58e296ef
cmp eax, 0x9b8b19b4
jae 0x180322623
jmp 0x1803225ca
mov eax, dword [0x180783028]
add eax, dword [0x18078302c]
imul eax, eax, 0x57c6dc14
mov r9d, 0xebf551bb
xor edx, edx
div r9d
mov edx, eax
xor edx, 0xe6de0551
imul rax, r8, 0xfbf045b
mov r9, rax
rol r9, 4
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xbdac3188
jb 0x1803225ca
ret
cmpsb byte [rsi], byte [rdi]
add eax, 0x5ada5e01
mov dh, 0xc6
jmp 0x180322576
out dx, al
invalid

Function at 0x180322740
Capabilities:
Encode data using xor

Disassembly:
movabs rax, 0xcde7417b25726783
imul rdx, rax
xor rdx, 0xffffffffffffffff
mov r8, rdx
rol r8, 7
xor r8, rdx
and r8, 0xffff
mov eax, dword [0x180783050]
sub eax, dword [0x180783054]
or eax, 0x3b1c0b82
sub eax, 0xdc12b6a1
or eax, 0xba509e93
cmp eax, 0xee447780
jb 0x1803227b4
jmp 0x180322787
mov edx, dword [0x180783058]
xor edx, dword [0x18078305c]
sub edx, 0x782e7295
or edx, 0x3e8726c7
or edx, 0xf125288d
mov rax, rcx
add rax, r8
cmp edx, 0xe043f1dc
jbe 0x180322787
ret
fsub qword [rsi + 0x602a3d1]
fld qword [rcx - 0x33333815]

Function at 0x180322890
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
movabs rcx, 0xe4b45992519b05c0
imul rdx, rcx
mov rcx, rdx
shr rcx, 0x1a
mov r8d, dword [0x180783070]
xor r8d, dword [0x180783074]
xor r8d, 0xdd37aaf9
and r8d, 0xad004a00
sub r8d, 0x78d52a6f
cmp r8d, 0x502f8a23
jae 0x180322926
jmp 0x1803228d6
mov r9d, dword [0x180783078]
and r9d, dword [0x18078307c]
add r9d, 0xb0b2a6bd
and r9d, 0x3d511d65
xor r9d, 0x87d2edc2
mov r8, rcx
xor r8, rdx
cmp r9d, 0x131eab3
je 0x1803228d6
jmp 0x18032290a
add r8, 0xffffffff88c77f2b
mov rcx, r8
rol rcx, 6
xor rcx, r8
and rcx, 0xffff
add rax, rcx
ret
and bl, byte [rsi]
rol byte [rbx], 0x16
invalid
Function at 0x180322a90
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xffffffffb08a3182
sub rax, rdx
xor rax, 0xffffffffbce135a4
mov rdx, rax
shr rdx, 0x19
xor rdx, rax
mov r8, rdx
rol r8, 4
mov eax, dword [0x1807830a0]
add eax, dword [0x1807830a4]
or eax, 0xec4cfa9d
xor eax, 0xbc864f1
imul eax, eax, 0x530a10cc
cmp eax, 0x9af15e4e
je 0x180322b1f
jmp 0x180322ad6
mov r9d, dword [0x1807830a8]
xor r9d, dword [0x1807830ac]
add r9d, 0x375bb618
sub r9d, 0xdb578b62
xor r9d, 0x9f66ef13
mov rax, r8
xor rax, rdx
mov r10, rax
rol r10, 1
xor r10, rax
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r9d, 0x82a06462
je 0x180322ad6
ret
jb 0x180322b6d
int 0x9b
invalid
or eax, 0x4217355a
push 0x5d
or eax, 0xee66aa91
movabs rdx, 0x93a93750
mov r9, r8
add r9, rdx
mov rdx, r9
rol rdx, 2
cmp eax, 0x1cf2f58
je 0x180322baa
jmp 0x180322b99
xor rdx, r9
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
stosb byte [rdi], al
sar dword [edx - 0x14825807], 0xa8
int3

Function at 0x180323c20
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
sub rax, rdx
mov rdx, rax
rol rdx, 7
mov r8d, dword [0x180783280]
imul r8d, dword [0x180783284]
or r8d, 0x9cf98e07
or r8d, 0x9da286b0
and r8d, 0xe4c5ac62
cmp r8d, 0x25b85e37
je 0x180323d0a
jmp 0x180323c5f
mov r9d, dword [0x180783288]
imul r9d, dword [0x18078328c]
add r9d, 0xa2e1be6b
sub r9d, 0x5d068d02
xor r9d, 0x55081bde
mov r8, rdx
xor r8, rax
cmp r9d, 0xa75daec0
ja 0x180323c5f
jmp 0x180323c94
mov eax, dword [0x180783290]
and eax, dword [str.Q2P0R]
sub eax, 0xece4d6ac
sub eax, 0xedfe3348
imul eax, eax, 0x5bb93dbd
cmp eax, 0x92b918ae
jb 0x180323d1b
mov eax, dword [0x180783298]
xor edx, edx
div dword [0x18078329c]
sub eax, 0x190c7053
mov r9d, 0x79e4d00b
xor edx, edx
div r9d
mov r9d, 0x3b78b7df
xor edx, edx
div r9d
mov edx, eax
mov eax, 0xb6dcb265
sub rax, r8
mov r9, rax
rol r9, 4
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x17f0e829
je 0x180323d1b
ret
adc bh, byte [rdi + rdi*8]
invalid
scasd eax, dword [rdi]
movabs byte [0x92eb9a244c4766f9], al
int3

Function at 0x180323d90
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0x15952e7e
xor rdx, 0x2477c682
add rdx, 1
mov rax, rdx
rol rax, 3
xor rax, rdx
mov rdx, rax
rol rdx, 2
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov eax, dword [0x1807832a0]
xor edx, edx
div dword [0x1807832a4]
sub eax, 0xac3db641
or eax, 0x96208c01
mov r8d, 0x8bbd9080
xor edx, edx
div r8d
cmp eax, 0x7468e02f
je 0x180323e14
jmp 0x180323dec
mov eax, dword [0x1807832a8]
xor eax, dword [0x1807832ac]
imul eax, eax, 0xcef2e91e
and eax, 0x9963185d
imul eax, eax, 0xc4acc6ff
cmp eax, 0x10da5621
jbe 0x180323dec
mov rax, rcx
ret
pop rbx
in eax, dx
sbb bh, byte [rcx]
invalid
Function at 0x180324390
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180783330]
add eax, dword [0x180783334]
imul eax, eax, 0xcc010e6d
mov r9d, 0x9b5a8abf
xor edx, edx
div r9d
mov r9d, 0x81c1d2b2
xor edx, edx
div r9d
cmp eax, 0xb941f9fd
jae 0x180324413
mov eax, dword [0x180783338]
add eax, dword [0x18078333c]
mov r9d, 0x2c86d20e
xor edx, edx
div r9d
sub eax, 0x36263b67
imul edx, eax, 0x97c6fa9d
imul rax, r8, 0x73e94179
add rax, 0xffffffffa7538ad8
cmp edx, 0x73fc8e38
je 0x180324413
jmp 0x1803243fb
mov rdx, rax
rol rdx, 2
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
mov ebx, 0x50136f3f
jle 0x180324437
cwde
xor ch, cl
xor al, ah
jmp 0x1803243c2
add byte [r9], r14b
sal bh, cl
xor eax, 0x45ef03

Function at 0x180324b90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, 0x5ba76dc0
sub rcx, rdx
mov edx, dword [0x1807833e0]
and edx, dword [0x1807833e4]
add edx, 0x57887d2c
sub edx, 0x398bb159
imul edx, edx, 0x9e56d991
cmp edx, 0x8ada800c
jbe 0x180324c21
jmp 0x180324bc3
mov r9d, dword [0x1807833e8]
xor r9d, dword [0x1807833ec]
sub r9d, 0xf5668e47
or r9d, 0xb9b8a8c3
add r9d, 0x77d36e3d
mov r8, rcx
xor r8, 0x1b0ee601
mov rdx, r8
shr rdx, 2
xor rdx, r8
add rdx, 0x74ca182f
mov r8, rdx
rol r8, 3
cmp r9d, 0xdeea16af
je 0x180324bc3
jmp 0x180324c13
xor r8, rdx
and r8, 0xffff
add rax, r8
ret
pop rdx
invalid

Function at 0x180324cd0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov r9, r8
shr r9, 0x19
mov eax, dword [0x180783400]
imul eax, dword [0x180783404]
xor eax, 0x29a57515
sub eax, 0xc3a97bf4
sub eax, 0xda66a9ed
cmp eax, 0xd8664cac
ja 0x180324d57
jmp 0x180324cff
mov eax, dword [0x180783408]
xor edx, edx
div dword [str.__p5]
mov r10d, 0x8cc8956f
xor edx, edx
div r10d
or eax, 0xe75d51f6
add eax, 0xbd2db597
mov rdx, r9
xor rdx, r8
imul r10, rdx, 0xffffffffd6b8f5da
add r10, 0xffffffffc13bf206
mov rdx, r10
rol rdx, 6
xor rdx, r10
and rdx, 0xffff
cmp eax, 0x41d07b83
jbe 0x180324cff
jmp 0x180324d50
add rcx, rdx
mov rax, rcx
ret
scasb al, byte [rdi]
int 3
xor al, byte [rbx - 0x6724d1d7]
sub eax, 0x98eb84d5
int3

Function at 0x180325400
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 4
xor rax, rdx
mov r8, rax
xor r8, 0xffffffffffffffff
shr r8, 0x1f
xor r8, rax
mov rdx, r8
rol rdx, 7
xor rdx, r8
and rdx, 0xffff
mov eax, dword [0x1807834d0]
and eax, dword [0x1807834d4]
xor eax, 0x54286d54
add eax, 0xafddc348
or eax, 0xd40ee9d7
cmp eax, 0xd94184eb
jbe 0x180325482
jmp 0x18032544d
mov r8d, dword [0x1807834d8]
xor r8d, dword [0x1807834dc]
add r8d, 0x7ed45123
xor r8d, 0xedac95b8
or r8d, 0x25ecdd31
mov rax, rcx
add rax, rdx
cmp r8d, 0x769205cf
jb 0x18032544d
jmp 0x180325481
ret
fistp word [rcx - 0x39]
insb byte [rdi], dx
in al, 0xde
push rdx
pop rdi
jmp 0x18032544b
Function at 0x180325490
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0x5d8bf3b
add r8, 0x625f2131
xor r8, 0xffffffffd757665c
mov r9, r8
rol r9, 6
mov eax, dword [0x1807834e0]
xor edx, edx
div dword [0x1807834e4]
or eax, 0x4003f6ef
sub eax, 0x8624eb5b
and eax, 0x722895f
cmp eax, 0x4806ef15
jae 0x180325513
jmp 0x1803254d5
mov eax, dword [0x1807834e8]
xor eax, dword [0x1807834ec]
xor eax, 0x140077b4
mov r10d, 0xa0dbeac9
xor edx, edx
div r10d
imul edx, eax, 0x78c04cc
mov r10, r9
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x122cb364
ja 0x1803254d5
ret
and dh, byte [rax - 0x1a]
stosb byte [rdi], al
invalid

Function at 0x1803257e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 8
xor rax, rdx
mov edx, dword [0x180783530]
xor edx, dword [0x180783534]
imul edx, edx, 0x1bb86a4d
or edx, 0x2af907ee
xor edx, 0x8f12d55f
cmp edx, 0x1195876d
je 0x1803258bb
jmp 0x180325816
mov edx, dword [0x180783538]
or edx, dword [0x18078353c]
sub edx, 0x8d6b444
xor edx, 0xb35966cc
sub edx, 0x5590c8da
mov r8, rax
xor r8, 0xffffffffffffffff
mov r9, r8
shr r9, 0xf
xor r9, r8
imul r8, r9, 0xffffffff92df3695
mov r9, r8
rol r9, 4
xor r9, r8
and r9, 0xffff
mov r8, rcx
add r8, r9
cmp edx, 0x3dd15091
je 0x180325816
jmp 0x18032586d
mov eax, dword [0x180783540]
sub eax, dword [0x180783544]
xor eax, 0xcdbbe0fe
or eax, 0x87f398b0
sub eax, 0xfa1412d2
cmp eax, 0xea53bf93
jbe 0x1803258c8
jmp 0x180325891
mov eax, dword [0x180783548]
or eax, dword [0x18078354c]
xor eax, 0x8a3a1114
mov ecx, 0x8abf891d
xor edx, edx
div ecx
add eax, 0xb92e9c8f
cmp eax, 0x62bb94b0
jbe 0x180325891
mov rax, r8
ret
invalid
invalid

Function at 0x1803258e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 6
xor rax, rdx
mov edx, 0x26be067c
sub rdx, rax
imul r8, rdx, 0xffffffffd5e63fc5
mov eax, dword [0x180783550]
xor eax, dword [0x180783554]
sub eax, 0x1a163035
mov r9d, 0x7f54730b
xor edx, edx
div r9d
mov r9d, 0xf8c87e8f
xor edx, edx
div r9d
cmp eax, 0x65ee5eab
je 0x180325972
jmp 0x180325929
mov eax, dword [0x180783558]
imul eax, dword [0x18078355c]
and eax, 0x373359eb
imul edx, eax, 0xcc1a20f7
or edx, 0xefb41fed
mov rax, r8
shr rax, 0x1b
xor rax, r8
mov r9, rax
rol r9, 1
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x95613b07
je 0x180325929
jmp 0x180325971
ret
fist dword [rax + riz*4]
push rax
call 0x1a68d7fc9
mov ch, byte [rdx + 0x54]
jmp 0x180325927
Function at 0x180325e40
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1807835e0]
sub eax, dword [0x1807835e4]
xor eax, 0x617e3960
sub eax, 0x5d49fa2d
add eax, 0x1441fcd9
cmp eax, 0x7d6c0ec3
jae 0x180325f10
jmp 0x180325e6b
mov eax, dword [0x1807835e8]
xor edx, edx
div dword [0x1807835ec]
imul edx, eax, 0x1501576
or edx, 0xcaf9f891
and edx, 0x7ec6d6c
mov r9, r8
xor r9, 0x6687efab
add r9, 1
mov rax, r9
rol rax, 6
xor rax, r9
cmp edx, 0x2a71ed0f
ja 0x180325e6b
jmp 0x180325ead
mov edx, dword [0x1807835f0]
and edx, dword [0x1807835f4]
xor edx, 0x9735f89c
or edx, 0x9a0b8d45
sub edx, 0xa8f6f64d
cmp edx, 0x4276638d
jb 0x180325f21
mov edx, dword [str.8Gu]
imul edx, dword [0x1807835fc]
xor edx, 0x9170d1db
imul r8d, edx, 0x589901ef
or r8d, 0x2e68e6e0
mov rdx, rax
and rdx, 0xffff
cmp r8d, 0xcbfde890
jb 0x180325f21
jmp 0x180325f09
add rcx, rdx
mov rax, rcx
ret
pop rdi
stosb byte [rdi], al
cli
fcompi st(0)
or esp, dword [0x1902ca97e]
jmp 0x180325e69
invalid

Function at 0x180325f60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor eax, eax
sub rax, rdx
mov r8, rax
rol r8, 4
xor r8, rax
xor r8, 0xffffffffc680e0e4
add r8, 0xffffffffb02d98b0
mov r9, r8
rol r9, 3
mov eax, dword [0x180783600]
xor edx, edx
div dword [0x180783604]
xor eax, 0x668dd135
and eax, 0xa4d223db
sub eax, 0x33207a62
cmp eax, 0xf00c21be
jb 0x180325fe9
jmp 0x180325faa
mov eax, dword [0x180783608]
imul eax, dword [0x18078360c]
sub eax, 0x4ade33f0
mov r10d, 0x9a4918cf
xor edx, edx
div r10d
imul edx, eax, 0x460942e2
mov r10, r9
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xf009b3ae
jae 0x180325faa
ret
xchg edx, eax
shl ch, 1
and dl, byte [rsi - 0x4a143a63]
int3
Function at 0x180326150
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180783630]
or eax, dword [0x180783634]
imul eax, eax, 0x88a9619e
or eax, 0x106e64d4
mov r9d, 0x5f3bcfa1
xor edx, edx
div r9d
cmp eax, 0x47e9c8f6
jae 0x18032627c
jmp 0x180326182
mov eax, dword [0x180783638]
xor eax, dword [0x18078363c]
mov r9d, 0x506d0754
xor edx, edx
div r9d
add eax, 0x52f6ca62
and eax, 0xe44abc10
mov r9d, 0x4f348f25
sub r9, r8
movabs rdx, 0x184f4f77a000f91e
imul r9, rdx
add r9, 0x531c27c6
mov rdx, r9
rol rdx, 1
xor rdx, r9
cmp eax, 0xeddbeb8a
ja 0x180326182
jmp 0x1803261d3
mov eax, dword [0x180783640]
and eax, dword [0x180783644]
or eax, 0x40415476
add eax, 0xb7b1fcc3
add eax, 0x386dc676
cmp eax, 0x6ae82ab2
jb 0x180326289
jmp 0x1803261fb
mov eax, dword [0x180783648]
xor eax, dword [0x18078364c]
xor eax, 0x4e7968c4
xor eax, 0x23f7ee0
sub eax, 0xcc093768
mov r9, rdx
and r9, 0xffff
mov r8, rcx
add r8, r9
cmp eax, 0x157939d7
jbe 0x1803261fb
jmp 0x18032622f
mov eax, dword [0x180783650]
xor edx, edx
div dword [0x180783654]
sub eax, 0x4bef8a4d
sub eax, 0x6fe69
xor eax, 0x565e2896
cmp eax, 0xa412eda2
jb 0x18032629a
jmp 0x180326255
mov eax, dword [0x180783658]
imul eax, dword [0x18078365c]
xor eax, 0xd53793e6
or eax, 0x55a93785
sub eax, 0x56ffead1
cmp eax, 0x1cfdb05
jbe 0x180326255
mov rax, r8
ret
sub dl, byte [rax]
invalid
jnp 0x1803262b4
sub eax, 0xd5d23d43
or eax, 0x203dd5a7
jmp 0x1803261f9
xor ah, dl
cmp ebx, edx
insd dword [rdi], dx
sbb byte [rbp + rax*2 - 0x33335015], dl
int3
add eax, 0x45d3a7
Function at 0x1803262b0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180783660]
xor eax, dword [0x180783664]
add eax, 0x836c84b8
mov r9d, 0xcb1f3aca
xor edx, edx
div r9d
add eax, 0xe05c52f2
cmp eax, 0xd0998e40
je 0x1803263db
jmp 0x1803262e1
mov eax, dword [0x180783668]
or eax, dword [0x18078366c]
imul eax, eax, 0x6fcbf5d
mov r9d, 0x73d8816c
xor edx, edx
div r9d
and eax, 0x98bfe878
movabs rdx, 0x6304d9f0d3d601b4
mov r9, r8
imul r9, rdx
cmp eax, 0xfaa39d30
je 0x1803262e1
jmp 0x18032631d
mov eax, dword [0x180783670]
xor edx, edx
div dword [0x180783674]
and eax, 0x3ff077da
xor eax, 0xdd529b48
and eax, 0x5fa2c671
cmp eax, 0x5ceceb80
jbe 0x1803263e8
jmp 0x180326347
mov eax, dword [0x180783678]
imul eax, dword [0x18078367c]
add eax, 0x5d315a81
imul eax, eax, 0x3779c9a3
mov r8d, 0x3fdaf8fd
xor edx, edx
div r8d
mov rdx, r9
rol rdx, 4
xor rdx, r9
and rdx, 0xffff
mov r8, rcx
add r8, rdx
cmp eax, 0x90cbc38c
jae 0x180326347
jmp 0x18032638a
mov eax, dword [0x180783680]
xor eax, dword [0x180783684]
imul eax, eax, 0xe10d5c00
sub eax, 0x6421025b
mov ecx, 0x1316c8e7
xor edx, edx
div ecx
cmp eax, 0x2c1be0d8
ja 0x1803263f9
jmp 0x1803263b3
mov eax, dword [0x180783688]
xor edx, edx
div dword [0x18078368c]
add eax, 0x3063c142
or eax, 0xf0d31dad
and eax, 0xbebdf4ec
cmp eax, 0x140f77d0
je 0x1803263b3
mov rax, r8
ret
loope 0x18032642a
and al, 0xf1
pop rax
movabs eax, dword [0xacfffffef7e90281]
lodsb al, byte [rsi]
movabs al, byte [0x23952fe41d3190a7]
retf 0xe9e4
and ecx, edx
in al, 0xe9
invalid
movsd dword [rdi], dword [rsi]
out dx, eax
push si
test dword [rax - 0x596a5e6f], esi
pop rax
ja 0x1803263f1
stosb byte [rdi], al
int3
xor dword [0x134186ec2], esi
cmp eax, 0x8d295a31
jb 0x1803264e8
mov eax, dword [0x180783698]
xor edx, edx
div dword [0x18078369c]
imul eax, eax, 0x23e260ca
add eax, 0x260dd688
or eax, 0xac175380
mov rdx, r8
rol rdx, 4
xor rdx, r8
xor rdx, 0xffffffffee897096
mov r9, rdx
shr r9, 0x19
xor r9, rdx
cmp eax, 0xab83d5f9
je 0x1803264e8
jmp 0x18032647d
add r9, 0xffffffffd1dce198
mov eax, dword [0x1807836a0]
and eax, dword [0x1807836a4]
xor eax, 0x68233187
and eax, 0x61b8c05b
mov r8d, 0xa4df5ed8
xor edx, edx
div r8d
cmp eax, 0x3619b80b
ja 0x1803264f5
mov eax, dword [0x1807836a8]
and eax, dword [0x1807836ac]
xor eax, 0xfa40ac49
xor eax, 0x9603bf4
imul edx, eax, 0xd5df4aac
mov r8, r9
rol r8, 7
xor r8, r9
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0xb30d459d
je 0x1803264f5
ret
xor ebp, dword ss:[rcx]
clc
jmp 0x169c08064
sbb dl, byte gs:[rcx + 0x65]
mov esp, 0x731438ee
push 0x2f
invalid
Function at 0x180327780
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180783870]
or eax, dword [0x180783874]
and eax, 0x4f9d86a3
xor eax, 0x58f45eb8
mov r9d, 0x9517b77
xor edx, edx
div r9d
cmp eax, 0x6249c690
jae 0x180327868
mov eax, dword [0x180783878]
xor edx, edx
div dword [0x18078387c]
mov r9d, 0xbf890b15
xor edx, edx
div r9d
xor eax, 0x577a2e93
xor eax, 0x27314400
mov rdx, r8
rol rdx, 1
cmp eax, 0x8a951144
jae 0x180327868
jmp 0x1803277e5
xor rdx, r8
xor rdx, 0xffffffffffffffff
mov r8, rdx
rol r8, 1
xor r8, rdx
mov eax, dword [0x180783880]
xor eax, dword [0x180783884]
sub eax, 0x819c2b27
mov r9d, 0x24e1f39e
xor edx, edx
div r9d
mov r9d, 0x920434d3
xor edx, edx
div r9d
cmp eax, 0x6a3b9bcf
je 0x180327879
jmp 0x180327825
mov eax, dword [0x180783888]
imul eax, dword [0x18078388c]
or eax, 0xb325e76
imul edx, eax, 0x8d11be7
and edx, 0xc2bb90f8
xor eax, eax
sub rax, r8
mov r9, rax
rol r9, 7
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x78df333c
je 0x180327825
ret
mov ecx, esp
xor eax, 0x487a2ed3
mov edx, 0x5bc12523
jmp 0x1803277af
add dword [rdi - 0x753c41d1], eax
or eax, 0xcca0ebc2
int3

Function at 0x180327c30
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1807838f0]
sub eax, dword [0x1807838f4]
mov r9d, 0x2cf4c81c
xor edx, edx
div r9d
xor eax, 0xb09b64d2
and eax, 0xaf23a52f
cmp eax, 0xad600a94
jae 0x180327ca9
jmp 0x180327c5d
mov eax, dword [0x1807838f8]
sub eax, dword [0x1807838fc]
or eax, 0xd7d6f431
or eax, 0x1f4e37c1
imul edx, eax, 0x30f63919
mov rax, r8
xor rax, 0x2a2efdae
cmp edx, 0x3ac03885
je 0x180327c5d
jmp 0x180327c8c
add rax, 0x3375f5dd
mov rdx, rax
rol rdx, 1
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
jg 0x180327cfc
invalid
sbb dword [rcx - 0x78bf1b36], eax
movsb byte [rdi], byte [rsi]

Function at 0x180327cc0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180783900]
xor edx, edx
div dword [0x180783904]
xor eax, 0x46746a6d
imul eax, eax, 0xf7b84d72
imul eax, eax, 0xe11bc6f7
cmp eax, 0x80977d9b
jb 0x180327d4a
jmp 0x180327ceb
mov edx, dword [0x180783908]
and edx, dword [0x18078390c]
xor edx, 0x19940273
or edx, 0xa48740e4
add edx, 0x49e5014f
mov rax, r8
shr rax, 6
xor rax, r8
xor r9d, r9d
sub r9, rax
mov rax, r9
shr rax, 1
xor rax, r9
cmp edx, 0xd9b07682
je 0x180327ceb
jmp 0x180327d2c
add rax, 0x85b9a29
mov rdx, rax
rol rdx, 3
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
test byte [rax], cl
ret
Function at 0x180327d60
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180783910]
imul eax, dword [0x180783914]
imul eax, eax, 0xe761b141
or eax, 0xa9970de0
xor eax, 0x172a9543
cmp eax, 0xe1570c89
jbe 0x180327e29
mov eax, dword [0x180783918]
xor edx, edx
div dword [0x18078391c]
sub eax, 0x3f28141
imul eax, eax, 0x1dcab620
mov r9d, 0x939df148
xor edx, edx
div r9d
imul r9, r8, 0xffffffff97806b90
xor r9, 0xffffffffe1a40284
mov rdx, r9
rol rdx, 4
cmp eax, 0xf7c0352c
ja 0x180327e29
jmp 0x180327dcd
xor rdx, r9
and rdx, 0xffff
add rcx, rdx
mov eax, dword [0x180783920]
add eax, dword [0x180783924]
imul eax, eax, 0x166d407e
imul eax, eax, 0xf72c374e
imul eax, eax, 0xb52a29c8
cmp eax, 0xea7f5ff4
ja 0x180327e36
jmp 0x180327e01
mov eax, dword [0x180783928]
imul eax, dword [0x18078392c]
imul eax, eax, 0xcb24903d
xor eax, 0x211105da
xor eax, 0x3b093d9a
cmp eax, 0xce2afdf6
je 0x180327e01
mov rax, rcx
ret
sub eax, 0xbcae46c2
int1
push rsp
shr cl, cl
push rbp
invalid
test eax, 0x59b3ffb9
invalid

Function at 0x1803280d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0x535e4856
mov eax, dword [0x180783960]
or eax, dword [0x180783964]
sub eax, 0x30fe8c79
or eax, 0x5e0234f7
mov r9d, 0x3560b8b4
xor edx, edx
div r9d
cmp eax, 0xf2f39d6c
jae 0x1803281a0
jmp 0x180328108
mov eax, dword [0x180783968]
xor edx, edx
div dword [0x18078396c]
mov r9d, 0xd5602d56
xor edx, edx
div r9d
and eax, 0xc105db60
add eax, 0x98033b35
mov r9, r8
add r9, 0xffffffffc4d207ba
cmp eax, 0x7b45bcd9
jb 0x180328108
jmp 0x18032813e
mov eax, dword [0x180783970]
xor edx, edx
div dword [0x180783974]
add eax, 0x827161a2
xor eax, 0x20c35e79
xor eax, 0xac14bb4
cmp eax, 0x9d3fc42a
jb 0x1803281b1
jmp 0x180328164
mov eax, dword [0x180783978]
xor eax, dword [0x18078397c]
imul eax, eax, 0x1aa1ec92
or eax, 0xe2406cb8
imul edx, eax, 0xa73c6482
mov r8, r9
rol r8, 1
xor r8, r9
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0xa80a7d38
ja 0x180328164
ret
xchg ebx, eax
invalid
loopne 0x18032821c
xchg dword [rdi], esp
test byte [r9 - 0x7a], bl
adc ch, byte [rax - 0x70]
retf
xor ecx, 0xaf798716
mov r10, r9
rol r10, 5
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xf0624e94
ja 0x180328242
ret
invalid
Function at 0x180328540
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1807839e0]
xor eax, dword [0x1807839e4]
add eax, 0x8dd0b982
add eax, 0x123c0204
sub eax, 0x33ebebee
cmp eax, 0xf1a1ca5b
jae 0x180328615
jmp 0x18032856b
mov eax, dword [0x1807839e8]
and eax, dword [0x1807839ec]
add eax, 0xa0a368a3
imul eax, eax, 0xf43c3288
mov r9d, 0xb9cefb95
xor edx, edx
div r9d
mov rdx, r8
add rdx, 0xfffffffff657d863
mov r9, rdx
shr r9, 0x18
xor r9, rdx
cmp eax, 0xffd97992
je 0x18032856b
jmp 0x1803285aa
mov r8, r9
rol r8, 6
mov eax, dword [0x1807839f0]
xor eax, dword [0x1807839f4]
or eax, 0x70870992
add eax, 0xbc2aa4db
and eax, 0x3e314611
cmp eax, 0x6eff5b10
je 0x180328622
mov eax, dword [0x1807839f8]
imul eax, dword [0x1807839fc]
mov r10d, 0x621dd01
xor edx, edx
div r10d
mov edx, eax
or edx, 0xbaff85f1
and edx, 0xa6614e06
mov r10, r8
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xcbe2afab
je 0x180328622
ret
mov cs, word [rcx]
lodsb al, byte [rsi]
invalid
invalid

Function at 0x1803286d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x180783a10]
imul eax, dword [0x180783a14]
xor eax, 0xd7145374
imul eax, eax, 0x3e0b53f3
or eax, 0x49146584
cmp eax, 0x68ad32a1
jbe 0x1803287f2
jmp 0x1803286fa
mov eax, dword [0x180783a18]
imul eax, dword [0x180783a1c]
or eax, 0xd639afb7
xor eax, 0xbe41b98
imul eax, eax, 0x72fe54cf
imul r9, rdx, 0xffffffffcf1da594
mov r8, r9
rol r8, 4
xor r9, r8
xor r9, 0xffffffff92b94b99
mov r10, r9
rol r10, 6
cmp eax, 0xf212e488
jae 0x1803286fa
jmp 0x18032873f
mov eax, dword [0x180783a20]
or eax, dword [0x180783a24]
add eax, 0xd4ffceaa
xor eax, 0x55b048f7
add eax, 0xe408b675
cmp eax, 0x1b206381
je 0x1803287ff
jmp 0x180328767
mov eax, dword [0x180783a28]
xor eax, dword [0x180783a2c]
add eax, 0x539fdc97
and eax, 0x5b2104d2
mov r8d, 0x52bb560e
xor edx, edx
div r8d
mov rdx, r10
xor rdx, r9
and rdx, 0xffff
mov r8, rcx
add r8, rdx
cmp eax, 0x3d38aecc
jae 0x180328767
jmp 0x1803287a4
mov eax, dword [0x180783a30]
xor edx, edx
div dword [0x180783a34]
xor eax, 0xad89e65a
or eax, 0x272497cc
add eax, 0xa0cba363
cmp eax, 0x16bf7434
jbe 0x18032880c
mov eax, dword [0x180783a38]
add eax, dword [0x180783a3c]
and eax, 0x9f206503
mov ecx, 0x2fa644b0
xor edx, edx
div ecx
or eax, 0x2caec17d
cmp eax, 0x6ee79fac
ja 0x18032880c
mov rax, r8
ret
mov esp, 0xfa51ec50
xor eax, 0xf9e9f97a
invalid
invalid
cmp esi, dword [rbx]
xor dword [rdx + 0x13cf7e24], 0xffffffa9
invalid

Function at 0x180328ba0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
rol r8, 2
xor r8, rdx
mov eax, dword [0x180783a90]
add eax, dword [0x180783a94]
or eax, 0x1ade093a
add eax, 0xb671fae9
and eax, 0x54a4e5bf
cmp eax, 0x1d58890a
je 0x180328c21
jmp 0x180328bce
mov edx, dword [0x180783a98]
or edx, dword [0x180783a9c]
and edx, 0xfbc0e5aa
xor edx, 0x5489e90e
or edx, 0x1b59a558
mov rax, r8
rol rax, 1
xor rax, r8
imul rax, rax, 0xffffffffff6727d3
add rax, 0xffffffff993d9625
mov r9, rax
rol r9, 1
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x477bb504
je 0x180328bce
ret
invalid