joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b1780
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp byte [rcx + 0xf1e], 0
movsxd r10, r9d
je 0x1400b18a4
cmp r8d, 0xff
jne 0x1400b17e1
lea eax, [r10 - 0xec]
cmp eax, 0x13
ja 0x1400b17cb
lea r8, [0x140000000]
mov r9, qword [r8 + r10*8 + 0xd75a0]
mov r8, rdx
lea rdx, str._s_IAC__s_n
add rsp, 0x38
jmp fcn.14008dfc0
mov r8, rdx
mov r9d, r10d
lea rdx, str._s_IAC__d_n
add rsp, 0x38
jmp fcn.14008dfc0
cmp r8d, 0xfb
jne 0x1400b17f3
lea r9, str.WILL
jmp 0x1400b1831
cmp r8d, 0xfc
jne 0x1400b1805
lea r9, str.WONT
jmp 0x1400b1831
cmp r8d, 0xfd
jne 0x1400b1817
lea r9, [0x1400d7fc4]
jmp 0x1400b1831
xor r9d, r9d
lea rax, str.DONT
cmp r8d, 0xfe
cmove r9, rax
test r9, r9
je 0x1400b188d
cmp r10d, 0x27
jg 0x1400b1864
lea r8, [0x140000000]
mov r8, qword [r8 + r10*8 + 0xd7bc0]
test r8, r8
jne 0x1400b1874
mov r8, rdx
mov dword [rsp + 0x20], r10d
lea rdx, str._s__s__d_n
call fcn.14008dfc0
add rsp, 0x38
ret
cmp r10d, 0xff
jne 0x1400b184b
lea r8, str.EXOPL
mov qword [rsp + 0x20], r8
mov r8, rdx
lea rdx, str._s__s__s_n
call fcn.14008dfc0
add rsp, 0x38
ret
mov r9d, r8d
mov dword [rsp + 0x20], r10d
mov r8, rdx
lea rdx, str._s__d__d_n
call fcn.14008dfc0
add rsp, 0x38
ret

Function at 0x1400b1bf0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x10], 0xff
xor r9d, r9d
mov byte [rax + 0x11], sil
mov rbx, rcx
mov byte [rax + 0x12], dil
mov rcx, qword [rcx + 0x4c0]
lea rdx, [rax + 0x10]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400b1c4f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.14008de40
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.1400b1780
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b1e00
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x1400b1fa8
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x1400b1e65
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x1400b1e65
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1400b1e65
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x1400b1e9c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x1400b1ef2
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400b1ef2
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400b1ef2
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400b1ef2
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400b1ef2
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.1400b18b0
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x1400b1f54
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.14008de40
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.1400b1c80
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400b1fa0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.14008de40
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400b3710
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1400fd080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1400b37a5
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1400b3806
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.14008de40
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400c70a0
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1400b38c1
sub ecx, 1
je 0x1400b3934
sub ecx, 1
je 0x1400b3870
cmp ecx, 1
je 0x1400b3853
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x1400dfdac]
call fcn.14008de40
jmp 0x1400b3934
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.1400b3440
test eax, eax
je 0x1400b3934
jmp 0x1400b37da
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400b3934
sub rax, rsi
cmp rax, rbp
jae 0x1400b3934
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.14008dfc0
jmp 0x1400b3934
cmp r8d, 4
jle 0x1400b3934
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x1400b3934
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.14008dd60
mov esi, eax
test eax, eax
je 0x1400b3913
mov edx, 5
mov rcx, rbx
call fcn.1400b4400
mov eax, esi
jmp 0x1400b37da
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.14009c830
mov rcx, r14
call fcn.14009cb10
test eax, eax
je 0x1400b37d8
mov edx, 5
mov rcx, rbx
call fcn.1400b4400
mov eax, Ordinal_46
jmp 0x1400b37da
Function at 0x1400c66d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400c6712
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400c6759
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400c67b2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400c6770
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400c67f3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400db152]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400db153]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400c67c0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400c7764
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c77ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c77ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c77ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c77ae
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c77ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c77b0
xor al, al
add rsp, 0x28
ret
Function at 0x1400c79ec
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400c7a26
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400c7a2b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400c7a74
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400c7a74
dec r8
sub rdx, 1
jne 0x1400c7a5a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1800025c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe8
Function at 0x1801b00e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x180515a78]
xor eax, dword [0x180515a7c]
add eax, 0x5e03c8da
or eax, 0x4c120ff5
sub eax, 0x61e926e1
cmp eax, 0x9a81c330
jbe 0x1801b0201
mov eax, dword [0x180515a80]
or eax, dword [0x180515a84]
or eax, 0x1534f17b
or eax, 0xda9dd3b6
sub eax, 0xd166f51f
movabs r8, 0xe34cf3bae3d9be9e
mov r10, rdx
imul r10, r8
xor r10, 0xffffffffffffffff
mov r9, r10
rol r9, 2
xor r9, r10
cmp eax, 0x311c113c
ja 0x1801b0201
jmp 0x1801b014d
mov eax, dword [0x180515a88]
add eax, dword [0x180515a8c]
sub eax, 0x9583425
xor eax, 0xa5e03819
mov r8d, 0xaeabb595
xor edx, edx
div r8d
cmp eax, 0x40d12447
jae 0x1801b020e
jmp 0x1801b017b
mov eax, dword [0x180515a90]
xor eax, dword [0x180515a94]
xor eax, 0xba436c07
add eax, 0x550f0d04
sub eax, 0x893c3803
mov r8, r9
and r8, 0xffff
cmp eax, 0x4740dfa5
jbe 0x1801b017b
jmp 0x1801b01a9
mov eax, dword [0x180515a98]
xor edx, edx
div dword [0x180515a9c]
xor eax, 0xcdd0852a
sub eax, 0xf10b6a3e
sub eax, 0x5245227d
cmp eax, 0x4bc57e2b
je 0x1801b021b
jmp 0x1801b01cf
mov eax, dword [0x180515aa0]
or eax, dword [0x180515aa4]
and eax, 0x10d48dba
xor eax, 0x8fffd7c
mov r9d, 0x87edc68a
xor edx, edx
div r9d
mov edx, eax
mov rax, rcx
add rax, r8
cmp edx, 0x3850d588
ja 0x1801b01cf
ret
cmp al, 0xfa
in eax, 0xf3
loope 0x1801b0222
cmpsd dword [rsi], dword [rdi]
insb byte [rdi], dx
jmp 0x1801b0106
out 0xcf, eax
sbb dword [rsp + rdi*4], 0x4c
sbb eax, 0xff5ee935
invalid
or eax, 0xcccca8eb
int3

Function at 0x1801b04c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
add rdx, 0x637bc47c
mov rcx, rdx
rol rcx, 5
xor rdx, rcx
mov ecx, dword [0x180515ac8]
add ecx, dword [0x180515acc]
xor ecx, 0x57bb6b76
imul ecx, ecx, 0xfb033a17
and ecx, 0x9f5edadf
cmp ecx, 0x20a0975d
jae 0x1801b0549
jmp 0x1801b04fc
mov r8d, dword [0x180515ad0]
xor r8d, dword [0x180515ad4]
xor r8d, 0x5847e5e4
add r8d, 0xaaeac3a7
or r8d, 0x1503221d
mov r9, rdx
xor r9, 0xffffffff97d573e9
mov rcx, r9
rol rcx, 2
xor rcx, r9
and rcx, 0xffff
cmp r8d, 0x7f5bf318
jbe 0x1801b04fc
jmp 0x1801b0545
add rax, rcx
ret
mov dword [rbp - 0x30], esp
adc esp, 0xffffffd7
ror byte [rbx - 0x33335815], cl
int3

Function at 0x1801b1440
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
sub rax, rdx
mov rdx, rax
shr rdx, 9
xor rdx, rax
mov eax, 0xab051b0
sub rax, rdx
mov r8, rax
rol r8, 5
xor r8, rax
mov eax, dword [0x180515ba8]
and eax, dword [0x180515bac]
xor eax, 0xfe8e5d7c
sub eax, 0x28000344
or eax, 0xc49fca19
cmp eax, 0x8d18fd72
je 0x1801b14c1
jmp 0x1801b1485
mov eax, dword [0x180515bb0]
xor eax, dword [0x180515bb4]
imul eax, eax, 0xfd444e8b
mov r9d, 0x6725a245
xor edx, edx
div r9d
sub eax, 0xb415c783
mov rdx, r8
and rdx, 0xffff
cmp eax, 0x74f55892
ja 0x1801b1485
jmp 0x1801b14ba
add rcx, rdx
mov rax, rcx
ret
adc eax, 0x445629ca
movabs al, byte [0xccccccccb8eb615f]
int3
Function at 0x1801b1710
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor ecx, ecx
sub rcx, rdx
mov rdx, rcx
shr rdx, 4
xor rdx, rcx
mov rcx, 0xffffffff9bd486d2
sub rcx, rdx
mov rdx, rcx
shr rdx, 0xd
mov r8d, dword [0x180515bd8]
imul r8d, dword [0x180515bdc]
or r8d, 0xb1758474
sub r8d, 0xeb4abd0b
sub r8d, 0xed2c3c20
cmp r8d, 0xc4094dee
je 0x1801b17ab
jmp 0x1801b1762
mov r10d, dword [0x180515be0]
sub r10d, dword [0x180515be4]
add r10d, 0x1d222fbf
add r10d, 0xefa44666
xor r10d, 0xa0e49b8f
mov r9, rdx
xor r9, rcx
mov r8, r9
rol r8, 2
cmp r10d, 0xe2328e39
jae 0x1801b1762
jmp 0x1801b179d
xor r8, r9
and r8, 0xffff
add rax, r8
ret
lea esp, [rax]
test byte [rcx*4 - 0x14431a8c], ah
stosd dword [rdi], eax
int3

Function at 0x1801b23d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
movabs rax, 0xff70da331ff4c080
imul r8, rax
movabs rax, 0x26c51de97f8b28
add r8, rax
mov r9, r8
shr r9, 0x13
mov eax, dword [0x180515ca8]
xor eax, dword [0x180515cac]
mov r10d, 0xa54e86e8
xor edx, edx
div r10d
or eax, 0x7a21ae1f
sub eax, 0x7d6631be
cmp eax, 0xaf76039a
jb 0x1801b24bd
jmp 0x1801b2423
mov eax, dword [0x180515cb0]
imul eax, dword [0x180515cb4]
xor eax, 0x38990050
add eax, 0xf0e5e29
mov r10d, 0xb4cbd530
xor edx, edx
div r10d
mov rdx, r9
xor rdx, r8
mov r10, rdx
rol r10, 4
xor r10, rdx
cmp eax, 0x89010fa0
ja 0x1801b2423
jmp 0x1801b245e
mov eax, dword [0x180515cb8]
xor edx, edx
div dword [0x180515cbc]
sub eax, 0x48caae8d
sub eax, 0x96140faa
xor eax, 0xfb8a23f4
cmp eax, 0x8334a718
jb 0x1801b24ca
mov eax, dword [0x180515cc0]
xor edx, edx
div dword [0x180515cc4]
mov edx, eax
sub edx, 0x725c8033
sub edx, 0x4c6cd9ee
or edx, 0xe40b46a2
mov r8, r10
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0x32835bf0
je 0x1801b24ca
ret
pop rsi
and al, 0x69
sbb byte [rsi + rbx*8 - 0xa816dd], dl
invalid
sbb esp, dword [rsi + 0x554fb78]
mov ch, 0x3c
jmp 0x1801b2482

Function at 0x1801b4740
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
movabs rax, 0xff3571b7a670bdf0
imul r8, rax
mov eax, dword [0x180515e98]
and eax, dword [0x180515e9c]
or eax, 0xe56f4501
mov r9d, 0xd2d03c9
xor edx, edx
div r9d
xor eax, 0xfb6bc3d4
cmp eax, 0xf3a918a6
je 0x1801b47d3
jmp 0x1801b477b
mov eax, dword [0x180515ea0]
add eax, dword [0x180515ea4]
mov r9d, 0xc74a8d14
xor edx, edx
div r9d
add eax, 0xaa3f633c
mov r9d, 0xe99d1230
xor edx, edx
div r9d
movabs rdx, 0xfb65b8a5ee8f9131
mov r9, r8
add r9, rdx
mov rdx, r9
rol rdx, 7
xor rdx, r9
and rdx, 0xffff
cmp eax, 0x68c66a38
jae 0x1801b477b
jmp 0x1801b47cc
add rcx, rdx
mov rax, rcx
ret
movabs byte [0xcb289a11cc67eefa], al
xor eax, dword [rdx]
invalid
Function at 0x1801b5110
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x180515f38]
sub ecx, dword [0x180515f3c]
add ecx, 0xdeb919f4
sub ecx, 0xb928d929
imul ecx, ecx, 0xac85d3bc
cmp ecx, 0x1873095b
je 0x1801b519e
jmp 0x1801b513b
mov r8d, dword [0x180515f40]
add r8d, dword [0x180515f44]
xor r8d, 0x90c1e29c
and r8d, 0xae6c36a8
and r8d, 0x3edad055
mov rcx, rdx
rol rcx, 2
xor rcx, rdx
mov r9, rcx
rol r9, 1
xor r9, rcx
imul r9, r9, 0xffffffffff6727d3
add r9, 0xffffffff993d9625
mov rcx, r9
rol rcx, 1
xor rcx, r9
cmp r8d, 0x2029d378
je 0x1801b513b
jmp 0x1801b5193
and rcx, 0xffff
add rax, rcx
ret
invalid

Function at 0x1801b5460
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x180515f88]
imul ecx, dword [0x180515f8c]
and ecx, 0x92338b91
sub ecx, 0x2b713407
and ecx, 0x1a343d42
cmp ecx, 0xa8ff4f0a
je 0x1801b54ed
jmp 0x1801b548c
mov r8d, dword [0x180515f90]
imul r8d, dword [0x180515f94]
and r8d, 0xdd24a9a5
xor r8d, 0x6cf7686d
xor r8d, 0xd83fbcf6
xor ecx, ecx
sub rcx, rdx
xor rcx, 0x18795fc5
mov r9, rcx
rol r9, 7
xor r9, rcx
imul rcx, r9, 0xffffffffe1b7ecfe
cmp r8d, 0xafab7ba1
jae 0x1801b548c
jmp 0x1801b54d8
mov rdx, rcx
rol rdx, 3
xor rdx, rcx
and rdx, 0xffff
add rax, rdx
ret
xor r11d, eax
cmp dh, byte [rcx + riz*8]
call 0x14caf4053
int3

Function at 0x1801b6670
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
movabs rax, 0x2c86c342c1b82160
imul r8, rax
mov r9, r8
rol r9, 4
mov eax, dword [0x180516058]
xor edx, edx
div dword [0x18051605c]
or eax, 0x10e92d34
imul eax, eax, 0x89e43bea
and eax, 0xb0d0d92e
cmp eax, 0xb0a3d37
jb 0x1801b66fc
jmp 0x1801b66af
mov edx, dword [0x180516060]
and edx, dword [0x180516064]
xor edx, 0xfd84825f
and edx, 0xb4c9dd67
and edx, 0xa2954bf6
mov rax, r9
xor rax, r8
cmp edx, 0x2f4efe4e
jb 0x1801b66af
jmp 0x1801b66dd
imul rax, rax, 0x7c20d6ec
mov rdx, rax
rol rdx, 4
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
std
adc dword [rdi - 0x1f], eax
int 0x91
xlatb
fidiv word [rdi + 0x67]
pop rsp
jmp 0x1801b66ad
Function at 0x1801b6dd0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1805160d8]
and eax, dword [0x1805160dc]
and eax, 0x8825af3e
or eax, 0xb8772451
imul eax, eax, 0x4220b30a
cmp eax, 0x76347549
ja 0x1801b6eb5
jmp 0x1801b6dfc
mov eax, dword [0x1805160e0]
and eax, dword [0x1805160e4]
xor eax, 0x1167a11b
sub eax, 0xb7c4a613
mov r9d, 0x458b0eb6
xor edx, edx
div r9d
mov rdx, r8
xor rdx, 0xffffffffa0ec0509
imul rdx, rdx, 0xffffffffe301b7ce
movabs r9, 0xffffffff36aae2f8
add rdx, r9
mov r9, rdx
rol r9, 2
xor r9, rdx
cmp eax, 0x1b2f51f6
je 0x1801b6dfc
jmp 0x1801b6e4e
mov eax, dword [0x1805160e8]
sub eax, dword [0x1805160ec]
and eax, 0x786459be
mov r8d, 0xf6be6934
xor edx, edx
div r8d
or eax, 0xe77fec0a
cmp eax, 0xf9a67ab0
je 0x1801b6ec6
jmp 0x1801b6e78
mov eax, dword [0x1805160f0]
xor edx, edx
div dword [0x1805160f4]
mov edx, eax
or edx, 0x6eac85dc
sub edx, 0x7b7264d
xor edx, 0xb2165499
mov r8, r9
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0x6fbf487d
jbe 0x1801b6e78
cli
jge 0x1801b6ef6
mov edi, 0xebc6766f
add bl, al
jmp 0x1801b6eb4
ret
shl edx, 1
and eax, 0xff02f53e
js 0x1801b6eac
pushfq
push rbx
js 0x1801b6eab
xor al, 0xff
invalid
adc al, 0x95
cvtdq2ps xmm7, xmm12
mov esi, 0x48a6eba0
mov rax, rdx
invalid

Function at 0x1801b7440
Capabilities:
Encode data using xor

Disassembly:
mov r8d, 0x824b2472
sub r8, rdx
mov eax, dword [0x180516158]
and eax, dword [0x18051615c]
imul eax, eax, 0x4580f17a
xor eax, 0x70d896b5
sub eax, 0x178fb724
cmp eax, 0x6826e03d
jb 0x1801b74ba
jmp 0x1801b746e
mov eax, dword [0x180516160]
xor edx, edx
div dword [0x180516164]
sub eax, 0x24032c46
or eax, 0x428bfbe3
imul edx, eax, 0xbfec7277
imul r9, r8, 0xffffffff8758d530
xor r9, 0xffffffffac957dcd
mov rax, r9
rol rax, 1
xor rax, r9
and rax, 0xfff7
cmp edx, 0x7c59adc7
jb 0x1801b746e
add byte [rcx + 0x59adc7fa], al
jl 0x1801b7522
mov ebp, 0x14800eb
ror dword [rax - 0x77], 0xc8
jmp 0x1801b74b3
add rcx, rax
mov rax, rcx
ret
jne 0x1801b74a8
in eax, 0x72
imul esi, dword [rcx], 0x12
xchg ebx, ebp
test al, 0xcc
int3
retf 0xb70f

Function at 0x1801b8f70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
xor ecx, ecx
sub rcx, rdx
xor rcx, 0xffffffffc4a874a5
mov edx, dword [0x180516308]
or edx, dword [0x18051630c]
and edx, 0xafd71542
and edx, 0xc3a49231
sub edx, 0xafc0eae5
cmp edx, 0xfa5e7e52
jae 0x1801b8ff3
jmp 0x1801b8fa7
mov edx, dword [0x180516310]
xor edx, dword [0x180516314]
sub edx, 0x1a8a93dc
and edx, 0xf71c22e3
imul r8d, edx, 0x83216b56
imul r9, rcx, 0xffffffffeaea28e2
add r9, 0xfffffffff19ba3db
mov rdx, r9
rol rdx, 1
xor rdx, r9
and rdx, 0xffff
cmp r8d, 0xfdb0c50c
ja 0x1801b8fa7
jmp 0x1801b8fef
add rax, rdx
ret
invalid
Function at 0x1801b9b10
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x1805163a8]
sub ecx, dword [0x1805163ac]
imul ecx, ecx, 0xcd3223d4
imul ecx, ecx, 0x1f7aa775
imul ecx, ecx, 0x31d98a37
cmp ecx, 0xbff2f9e6
ja 0x1801b9b8a
jmp 0x1801b9b3b
mov ecx, dword [0x1805163b0]
or ecx, dword [0x1805163b4]
imul r8d, ecx, 0x70b206d0
sub r8d, 0x320956bf
or r8d, 0x26947b66
mov ecx, 0x410e2843
sub rcx, rdx
xor rcx, 0x90e1125
cmp r8d, 0xca747bfc
ja 0x1801b9b3b
jmp 0x1801b9b76
mov rdx, rcx
rol rdx, 1
xor rdx, rcx
and rdx, 0xffff
add rax, rdx
ret
push rbp
sal byte [r13 + rbx*4 - 0x1479652b], 1
movsd dword [rdi], dword [rsi]
int3

Function at 0x1801ba4c0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
add r8, 0x1ee7e950
rol r8, 6
mov r9, 0xffffffffe11816af
sub r9, rdx
mov eax, dword [0x180516448]
add eax, dword [0x18051644c]
xor eax, 0xb17f270c
sub eax, 0xb86091b
add eax, 0xe9892a54
cmp eax, 0x7c44308b
jae 0x1801ba550
jmp 0x1801ba4fc
mov eax, dword [0x180516450]
sub eax, dword [0x180516454]
sub eax, 0x18f60546
mov r10d, 0xea8d6126
xor edx, edx
div r10d
mov edx, eax
add edx, 0x99d7c20b
mov rax, r8
xor rax, r9
mov r10, rax
rol r10, 5
xor r10, rax
mov r11, r10
rol r11, 4
xor r11, r10
and r11, 0xffff
mov rax, rcx
add rax, r11
cmp edx, 0xac2356b5
jae 0x1801ba4fc
ret
xchg esi, eax
push rax
lea ebp, [0x135cfb5d6]
xor byte [rcx - 0x63146230], al
int3

Function at 0x1801ba720
Capabilities:
Encode data using xor

Disassembly:
imul r8, rdx, 0xfffffffff9c638de
add r8, 0xffffffffcb373fb9
mov eax, dword [0x180516468]
xor edx, edx
div dword [0x18051646c]
sub eax, 0xed6aa551
xor eax, 0x702fe015
sub eax, 0xe4fbfe06
cmp eax, 0x13508fcc
je 0x1801ba793
jmp 0x1801ba754
mov edx, dword [0x180516470]
sub edx, dword [0x180516474]
or edx, 0xc28ea20c
xor edx, 0x5fa010fe
and edx, 0x59df924d
mov rax, r8
rol rax, 3
cmp edx, 0x29bbfc0f
jae 0x1801ba754
jmp 0x1801ba783
xor rax, r8
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
jns 0x1801ba807
xor byte [rcx + 0x7459a194], ah
sal byte [rdx - 0x15], 0xb1
int3
jb 0x1801ba86b
mov ecx, dword [0x180516480]
sub ecx, dword [0x180516484]
and ecx, 0xab292
imul r9d, ecx, 0x62189e93
sub r9d, 0xa72767aa
imul rcx, rdx, 0x7f94371e
mov r8, rcx
shr r8, 1
xor r8, rcx
mov rcx, r8
rol rcx, 3
cmp r9d, 0x22c8a90c
je 0x1801ba86b
jmp 0x1801ba84b
xor rcx, r8
mov rdx, rcx
rol rdx, 1
xor rdx, rcx
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
ret
nop
invalid