joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801f2920
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x180519bb8]
xor ecx, dword [0x180519bbc]
sub ecx, 0xc1167f96
and ecx, 0x50a8782b
sub ecx, 0x37d31798
cmp ecx, 0xdb13c18f
ja 0x1801f29aa
jmp 0x1801f294b
mov r8d, dword [0x180519bc0]
sub r8d, dword [0x180519bc4]
sub r8d, 0x4419a302
xor r8d, 0xf892ecd
or r8d, 0x3a8540fd
mov r9, rdx
add r9, 0xffffffffd677c8aa
mov rcx, r9
shr rcx, 0x1c
xor rcx, r9
cmp r8d, 0x8da0ba67
je 0x1801f294b
jmp 0x1801f298d
mov edx, 0x3c88de0
sub rdx, rcx
mov rcx, rdx
rol rcx, 2
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
ret
sar esp, 1
test eax, 0xc6c5fad
jmp 0x1801f2949

Function at 0x1801f5060
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 4
xor rax, rdx
mov r8, rax
rol r8, 6
xor r8, rax
add r8, 0xffffffffeaca0981
mov eax, dword [0x180519de8]
imul eax, dword [0x180519dec]
and eax, 0xf2f87a95
add eax, 0x3a8443a0
and eax, 0xe21fedd5
cmp eax, 0xce104377
jae 0x1801f50ec
jmp 0x1801f50a0
mov eax, dword [0x180519df0]
xor edx, edx
div dword [0x180519df4]
mov edx, eax
xor edx, 0x9ed4ce7
add edx, 0x20d02114
sub edx, 0xa36589c6
mov rax, r8
rol rax, 3
xor rax, r8
mov r9, rax
rol r9, 6
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x9cac753d
jae 0x1801f50a0
ret
and al, 0xcd
invalid

Function at 0x1801f59b0
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffffffffffff
imul r8, rdx, 0xffffffff9c1c445a
mov eax, dword [0x180519e78]
xor eax, dword [0x180519e7c]
and eax, 0xd6bdc89d
xor eax, 0xb3ac7e1
xor eax, 0x4b2a8092
cmp eax, 0xa7b56ee1
jae 0x1801f5a34
jmp 0x1801f59df
mov eax, dword [0x180519e80]
and eax, dword [0x180519e84]
sub eax, 0x7a7b3bd0
mov r9d, 0x6fcc0f89
xor edx, edx
div r9d
xor eax, 0xd41eab14
mov r9, r8
xor r9, 0xffffffff9ef3179e
mov rdx, r9
shr rdx, 5
cmp eax, 0x2cba98ad
je 0x1801f59df
jmp 0x1801f5a1a
xor rdx, r9
mov rax, rdx
rol rax, 2
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
invalid

Function at 0x1801f5a50
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180519e88]
or eax, dword [0x180519e8c]
add eax, 0x34d2a39a
add eax, 0x3e1663c4
mov r9d, 0xd5d2d3e1
xor edx, edx
div r9d
cmp eax, 0x3e7a7ab2
ja 0x1801f5ad7
jmp 0x1801f5a7d
mov eax, dword [0x180519e90]
xor edx, edx
div dword [0x180519e94]
or eax, 0x20b059d
xor eax, 0x55470e1b
and eax, 0x2f22b896
mov rdx, r8
shr rdx, 0x11
cmp eax, 0x187b7ff5
je 0x1801f5a7d
jmp 0x1801f5aaa
xor rdx, r8
xor rdx, 0xffffffffffffffff
mov rax, rdx
shr rax, 0x12
xor rax, rdx
xor edx, edx
sub rdx, rax
mov rax, rdx
rol rax, 6
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
invalid
Function at 0x1801f7660
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18051a058]
sub eax, dword [0x18051a05c]
sub eax, 0x292931d
add eax, 0xb191826a
or eax, 0xce3d45c7
cmp eax, 0xd7fe2042
jb 0x1801f774a
mov eax, dword [0x18051a060]
imul eax, dword [0x18051a064]
mov r9d, 0xa4205454
xor edx, edx
div r9d
imul eax, eax, 0xea74b0e8
sub eax, 0xaa19033d
mov rdx, r8
rol rdx, 4
xor rdx, r8
mov r9, 0xffffffff8cbbe322
sub r9, rdx
mov r10, r9
shr r10, 4
cmp eax, 0x4d8c7498
je 0x1801f774a
jmp 0x1801f76d0
mov eax, dword [0x18051a068]
imul eax, dword [0x18051a06c]
mov r8d, 0xd76ce269
xor edx, edx
div r8d
add eax, 0xe24b54a9
and eax, 0x8328d3fb
cmp eax, 0x217421a6
jb 0x1801f775b
jmp 0x1801f76fb
mov edx, dword [0x18051a070]
and edx, dword [0x18051a074]
or edx, 0xfafff294
or edx, 0x5bf88436
add edx, 0x3c47a6f
mov rax, r10
xor rax, r9
mov r8, rax
rol r8, 4
xor r8, rax
mov rax, r8
rol rax, 4
xor rax, r8
cmp edx, 0x126d4bca
jae 0x1801f76fb
jmp 0x1801f773d
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
lodsd eax, dword [rsi]
ror dword [rax], 0x94
cmp dword [rdi], esp
and esp, dword [rsi]
or dword [rsp + riz*2 - 6], 0xffffffe9
invalid
out dx, eax
cmp al, 0xc1
mov edi, 0xeb929c10
xchg esp, eax
int3

Function at 0x1801f86a0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov r9, r8
rol r9, 7
mov eax, dword [0x18051a168]
or eax, dword [0x18051a16c]
and eax, 0xb5b9bd65
imul eax, eax, 0x6762d85
xor eax, 0x4f16eac5
cmp eax, 0xc74b7274
ja 0x1801f8727
jmp 0x1801f86cf
mov eax, dword [0x18051a170]
or eax, dword [0x18051a174]
mov r10d, 0xacad4767
xor edx, edx
div r10d
and eax, 0x91223142
and eax, 0xd6307307
mov rdx, r9
xor rdx, r8
mov r10d, 0xe98fac75
sub r10, rdx
imul r10, r10, 0xa892030
mov rdx, r10
rol rdx, 4
cmp eax, 0x6156a8d0
ja 0x1801f86cf
jmp 0x1801f8716
xor rdx, r10
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
invalid

Function at 0x1801f9110
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18051a208]
or eax, dword [0x18051a20c]
imul eax, eax, 0xac0dccb0
xor eax, 0x5275cc89
mov r9d, 0x76ae56ad
xor edx, edx
div r9d
cmp eax, 0x4927341e
ja 0x1801f91a9
jmp 0x1801f913e
mov eax, dword [0x18051a210]
and eax, dword [0x18051a214]
add eax, 0xee0eca68
mov r9d, 0xa8ff7d04
xor edx, edx
div r9d
imul edx, eax, 0xac3bd76a
mov rax, r8
shr rax, 7
xor rax, r8
imul rax, rax, 0xffffffffd39cbc8a
cmp edx, 0xc3d271f4
je 0x1801f913e
jmp 0x1801f917b
movabs rdx, 0x8438ec39c82ecce
add rax, rdx
mov rdx, rax
rol rdx, 3
xor rdx, rax
mov rax, rdx
rol rax, 4
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
cdq
sbb ah, dh
push 0xffffffffaf2e1776
jmp 0x1801f913c
Function at 0x1801f9f40
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18051a2c8]
xor eax, dword [0x18051a2cc]
sub eax, 0x68c0b156
imul eax, eax, 0x78dacd8b
or eax, 0x98b73845
cmp eax, 0x537a706f
jbe 0x1801fa029
jmp 0x1801f9f6c
mov eax, dword [0x18051a2d0]
xor eax, dword [0x18051a2d4]
xor eax, 0x16d6a98
xor eax, 0x39d2a865
mov r9d, 0x26d66cbe
xor edx, edx
div r9d
mov r9, 0xffffffffe8d82730
sub r9, r8
mov rdx, r9
shr rdx, 0x1e
xor rdx, r9
cmp eax, 0xb76aca4a
ja 0x1801f9f6c
jmp 0x1801f9faa
mov r8, 0xffffffffb123b4ad
sub r8, rdx
mov eax, dword [0x18051a2d8]
sub eax, dword [0x18051a2dc]
mov r9d, 0x2072a2f5
xor edx, edx
div r9d
add eax, 0x3e19f534
add eax, 0x4bbdbd61
cmp eax, 0x84e27de7
jb 0x1801fa036
jmp 0x1801f9fde
mov eax, dword [0x18051a2e0]
xor edx, edx
div dword [0x18051a2e4]
mov edx, eax
and edx, 0x6d48e10e
sub edx, 0x35e26954
sub edx, 0xb1d939
mov rax, r8
xor rax, 0xffffffffd19e4661
mov r9, rax
rol r9, 4
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x2b723c02
jb 0x1801f9fde
ret
movabs al, byte fs:[0x34e97c697ea4704f]
invalid
xchg ebp, eax
add bp, word [0x1a719c430]
mov al, 0x56
or al, ch
jmp 0x1801f9fdc

Function at 0x1801fa130
Capabilities:
Encode data using xor

Disassembly:
mov r8d, 0x3477af99
sub r8, rdx
movabs rax, 0x242bfb2e4c13dd2
imul r8, rax
mov eax, dword [0x18051a2e8]
imul eax, dword [0x18051a2ec]
or eax, 0x8f1a9f68
or eax, 0xfb245126
imul eax, eax, 0x34f74c4c
cmp eax, 0x5d27d798
jae 0x1801fa1ab
jmp 0x1801fa16d
mov edx, dword [str._a_t_b]
add edx, dword [0x18051a2f4]
and edx, 0x70ce964c
sub edx, 0x8ca3c2f0
or edx, 0xf8bdfd42
mov r9, r8
rol r9, 4
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xfb1b2aa1
je 0x1801fa16d
ret
or bh, 0xf5
or esi, dword [rsi + 0x21c315c8]
loop 0x1801fa232
mov ecx, 0xccccb2eb
int3
xor al, byte [rax]

Function at 0x1801fa220
Capabilities:
Encode data using xor

Disassembly:
imul r8, rdx, 0x38864fb0
add r8, 0xffffffffce26fc7c
mov eax, dword [0x18051a2f8]
sub eax, dword [0x18051a2fc]
or eax, 0x52abbed7
add eax, 0xf7294bbf
and eax, 0x4000846b
cmp eax, 0xe4bf8798
jae 0x1801fa294
jmp 0x1801fa252
mov eax, dword [0x18051a300]
and eax, dword [0x18051a304]
sub eax, 0x13fa02ab
mov r9d, 0xc40e75c3
xor edx, edx
div r9d
and eax, 0x6112983e
mov rdx, r8
rol rdx, 6
xor rdx, r8
and rdx, 0xffff
cmp eax, 0xb0a8b96
je 0x1801fa252
jmp 0x1801fa28d
add rcx, rdx
mov rax, rcx
ret
sub esi, dword [rsi + 0x20d50195]
imul byte [rbp + rbx*8 - 0x146afe83]
scasb al, byte [rdi]
int3

Function at 0x1801fa5b0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18051a338]
sub eax, dword [0x18051a33c]
add eax, 0xc32ad7b3
add eax, 0x466ba40b
or eax, 0x4cb2f80c
cmp eax, 0xdf696794
ja 0x1801fa63a
jmp 0x1801fa5d7
mov eax, dword [0x18051a340]
xor edx, edx
div dword [0x18051a344]
mov r9d, 0xfc7af764
xor edx, edx
div r9d
imul edx, eax, 0xc8260fb1
sub edx, 0xe40e6c6e
mov rax, r8
add rax, 0xfffffffffc0c0e25
xor rax, 0xffffffffd07cd4ac
add rax, 1
cmp edx, 0xe05a4aa
jbe 0x1801fa5d7
jmp 0x1801fa619
mov rdx, rax
shr rdx, 0x19
xor rdx, rax
mov rax, rdx
rol rax, 2
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
invalid
Function at 0x1801fb4c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x18051a3f8]
xor eax, dword [0x18051a3fc]
or eax, 0x72547f18
and eax, 0x4a806b09
add eax, 0x41e2b34a
cmp eax, 0x230727ee
je 0x1801fb5f3
mov eax, dword [0x18051a400]
or eax, dword [0x18051a404]
imul r9d, eax, 0x7d9fd482
and r9d, 0xcc30d422
or r9d, 0x977787cf
mov r8, rdx
add r8, 0x7c83878c
mov rax, r8
rol rax, 5
xor rax, r8
mov r8, rax
shr r8, 0xd
cmp r9d, 0x836f651e
jb 0x1801fb5f3
jmp 0x1801fb531
mov edx, dword [0x18051a408]
or edx, dword [0x18051a40c]
and edx, 0x65d00f2d
or edx, 0x1af2df1f
xor edx, 0xa9f8f92d
cmp edx, 0x42b0acd
je 0x1801fb604
mov r9d, dword [0x18051a410]
and r9d, dword [0x18051a414]
and r9d, 0x8fa62c79
and r9d, 0x57682f68
add r9d, 0xa61a4a9d
mov rdx, r8
xor rdx, rax
cmp r9d, 0xec77f0e6
ja 0x1801fb604
jmp 0x1801fb58f
mov eax, dword [0x18051a418]
or eax, dword [0x18051a41c]
xor eax, 0xcf0d9299
add eax, 0xe9667d22
imul eax, eax, 0xdb94cfa8
cmp eax, 0x811c7f78
je 0x1801fb615
jmp 0x1801fb5b4
mov eax, dword [0x18051a420]
add eax, dword [0x18051a424]
imul eax, eax, 0x3e770bfe
or eax, 0x1b5e60eb
imul r8d, eax, 0x6c8935f1
mov r9, rdx
rol r9, 3
xor r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0xd7d5e45d
jae 0x1801fb5b4
ret
or byte [rbx - 0x3671bdd2], 0x51
invalid
in al, dx
in al, 0x57
push rdi
jo 0x1801fb606
invalid
mov ebx, 0xc1202445
mov ebx, 0x93eb309c
int3

Function at 0x1801fc600
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
sub rax, rdx
mov r9, rax
shr r9, 6
xor r9, rax
xor r9, 0xffffffffcf169077
add r9, 0x72fbf520
mov r10, r9
rol r10, 7
mov eax, dword [0x18051a558]
add eax, dword [0x18051a55c]
and eax, 0xf1cb75e3
and eax, 0xd7fbbcb7
add eax, 0x4db2f297
cmp eax, 0xf5cc0c27
ja 0x1801fc6e3
jmp 0x1801fc64c
mov eax, dword [0x18051a560]
add eax, dword [0x18051a564]
imul eax, eax, 0x5e2a019c
mov r8d, 0x7037b27b
xor edx, edx
div r8d
mov r8d, 0x8a277eb1
xor edx, edx
div r8d
mov rdx, r10
xor rdx, r9
and rdx, 0xffff
mov r8, rcx
add r8, rdx
cmp eax, 0x61161af6
je 0x1801fc64c
jmp 0x1801fc690
mov eax, dword [0x18051a568]
sub eax, dword [0x18051a56c]
or eax, 0xf82d482e
sub eax, 0x2b69caf0
imul eax, eax, 0x1a704c8a
cmp eax, 0xbe25a178
jb 0x1801fc6f4
jmp 0x1801fc6b5
mov eax, dword [0x18051a570]
or eax, dword [0x18051a574]
mov ecx, 0xe008f639
xor edx, edx
div ecx
mov ecx, 0x1366156c
xor edx, edx
div ecx
xor eax, 0x887b82f6
cmp eax, 0x24b3d5c8
jb 0x1801fc6b5
mov rax, r8
ret
fisttp word [rbx - 0x2a5975cd]
mov edi, 0xcbac3782
jmp 0x1801fc64a
add dword [rcx], edx
adc eax, 0x1e04f52c
sub bl, 0xb5
int3
Function at 0x1801ffac0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov r8, rcx
add r8, 0x38
mov eax, dword [0x18051a9d8]
add eax, dword [0x18051a9dc]
imul eax, eax, 0xb97c86e4
add eax, 0x75ca4ef0
add eax, 0xaa993b64
cmp eax, 0x9086485c
jb 0x1801ffbf0
mov eax, dword [0x18051a9e0]
imul eax, dword [0x18051a9e4]

Function at 0x1801ffc10
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rax, rsi
add rax, 0x18
mov cl, byte [rax]
movzx eax, cl
test cl, cl
je 0x1801ffc48
jmp 0x1801ffc2c
mov ecx, eax
sub ecx, 3
je 0x1801ffc6c
jmp 0x1801ffc35
sub eax, 4
je 0x1801ffd49
jmp 0x1801ffc40
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rdx, qword [rsi]
cmp rdx, 0
sete al
test al, 1
jne 0x1801ffc40
jmp 0x1801ffc58
add rsi, 8
mov rcx, qword [rsi]
mov r8d, 1
call fcn.1802cbf20
jmp 0x1801ffc40
mov ax, word [rsi + 0x20]
cmp ax, 3
sete al
mov ecx, dword [0x18051a9f8]
or ecx, dword [0x18051a9fc]
imul ecx, ecx, 0x8106dcd5
and ecx, 0x95e5463a
add ecx, 0x25404bd1
cmp ecx, 0xd6b029d0
je 0x1801ffec5
jmp 0x1801ffca3
mov ecx, dword [0x18051aa00]
add ecx, dword [0x18051aa04]
or ecx, 0x2dc0d020
xor ecx, 0xb1dfab96
add ecx, 0xb48fe96d
cmp ecx, 0x39611a4c
jbe 0x1801ffca3
test al, 1
jne 0x1801ffcd2
jmp 0x1801ffc40
add rsi, 0x28
mov eax, dword [0x18051aa08]
or eax, dword [0x18051aa0c]
xor eax, 0xbeb7344b
or eax, 0x8c43b4b9
and eax, 0xad466793
cmp eax, 0xffa8aaf6
jae 0x1801ffed2
mov ebx, dword [0x18051aa10]
add ebx, dword [0x18051aa14]
sub ebx, 0xda7c66f0
and ebx, 0x2a165341
and ebx, 0xba36770c
mov rdi, qword [rsi]
mov rcx, rdi
call fcn.180405e10
cmp ebx, 0x636c8054
je 0x1801ffed2
jmp 0x1801ffd33
test al, 1
jne 0x1801ffd3c
jmp 0x1801ffc40
mov rcx, rdi
call fcn.180407050
jmp 0x1801ffc40
mov rax, rsi
add rax, 0xb8
mov al, byte [rax]
cmp al, 3
jne 0x1801ffd66
mov rcx, rsi
add rcx, 0x70
call fcn.180203d90
jmp 0x1801ffd66
mov eax, dword [rsi + 0x28]
cmp eax, 0
sete al
test al, 1
jne 0x1801ffd9a
jmp 0x1801ffd75
mov rax, rsi
add rax, 0x40
mov rdx, qword [rax]
cmp rdx, 0
je 0x1801ffd9a
mov rcx, qword [rsi + 0x30]
shl rdx, 5
mov r8d, 4
call fcn.1802cbf20
jmp 0x1801ffd9a
mov rcx, qword [rsi + 0x20]
cmp rcx, 0
sete al
test al, 1
jne 0x1801ffc40
jmp 0x1801ffdaf
mov r8, rcx
and r8, 3
mov eax, dword [0x18051aa18]
or eax, dword [0x18051aa1c]
xor eax, 0x63775700
imul eax, eax, 0xc2b9edb7
or eax, 0x1146e802
cmp eax, 0xb460c8af
jbe 0x1801ffeeb
jmp 0x1801ffddf
mov eax, dword [0x18051aa20]
xor edx, edx
div dword [0x18051aa24]
imul eax, eax, 0x5b79937e
or eax, 0x240365b1
or eax, 0x33a5383f
cmp eax, 0xc6440410
ja 0x1801ffddf
lea rax, [0x180485634]
movsxd rdx, dword [rax + r8*4]
add rdx, rax
jmp rdx
invalid
in eax, dx
xchg ebx, eax
invalid
cli
neg dword [rdx + 0x34eb8a18]
mov edx, 0xdf8c4a2e
jmp 0x1801ffddd

Function at 0x1802001c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [rsi]
mov rcx, rax
Function at 0x18021abf0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
Function at 0x18021dda0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rdi, rdx
Function at 0x180220280
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x18051cc88]
sub eax, dword [0x18051cc8c]
or eax, 0x4dff6fff
add eax, 0x33bad945
and eax, 0x64187dbe
cmp eax, 0xd7691641
ja 0x180220836
mov eax, dword [0x18051cc90]
xor edx, edx
div dword [str.yNr]
or eax, 0x72b1508e
sub eax, 0xe212d2c6
sub eax, 0xe78833e6
mov r9, qword [rsi]
cmp eax, 0x9ed0a207
je 0x180220836
jmp 0x1802202e1
mov eax, dword [0x18051cc98]
or eax, dword [0x18051cc9c]
add eax, 0x476b7295
add eax, 0xfaff8110
or eax, 0x406aae63
cmp eax, 0x38914e9c
jb 0x180220843
jmp 0x180220309
mov eax, dword [0x18051cca0]
and eax, dword [0x18051cca4]
imul eax, eax, 0x6d2e33bf
and eax, 0x656ef96
mov ecx, 0xdc5ae901
xor edx, edx
div ecx
mov rcx, r9
add rcx, 0xfffffffffffffffd
cmp rcx, 0xc
setb r8b
cmp eax, 0x37bbc689
jae 0x180220309
jmp 0x180220341
mov eax, dword [0x18051cca8]
xor edx, edx
div dword [0x18051ccac]
and eax, 0x2927f24c
or eax, 0xde641240
mov r9d, 0xa8641dee
xor edx, edx
div r9d
cmp eax, 0xcacd353a
jae 0x180220854
jmp 0x180220371
mov edx, dword [0x18051ccb0]
or edx, dword [0x18051ccb4]
xor edx, 0x916fd844
sub edx, 0x6ade9f49
or edx, 0x780ec478
mov eax, 0xa
test r8b, 1
cmovne rax, rcx
cmp edx, 0x7306c148
je 0x180220371
add rax, 0xfffffffffffffffe
mov rcx, rax
sub rcx, 8
ja 0x1802203c1
lea rcx, [0x180485ed0]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov eax, dword [0x18051ccb8]
add eax, dword [0x18051ccbc]
mov ecx, 0x49ac77f5
xor edx, edx
div ecx
or eax, 0x7c352994
and eax, 0x7416148f
cmp eax, 0x8aca896f
je 0x180220861
mov eax, dword [0x18051ccc0]
xor eax, dword [0x18051ccc4]
and eax, 0x77d2b575
mov ecx, 0xaf3fbd79
xor edx, edx
div ecx
sub eax, 0x16ec4dc6
cmp eax, 0x810ac61e
jb 0x180220861
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
test dword [rcx + 0x4a8862f7], eax
invalid
jmp qword [rdx - 7]
invalid
jnp 0x180220818
sub esp, esp
movabs byte [0xe990a05764deb0f3], al
mov bl, 0xfa
invalid
js 0x180220828
invalid
out 0xe, al
invalid
Function at 0x180220cb0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, rsi
call fcn.1802b7070
mov r14, rsi
add r14, 0x18
mov rbx, qword [r14]
cmp rbx, 0xffffffffffffffff
sete al
test al, 1
jne 0x180220df9
jmp 0x180220ce1
mov r15, rsi
add r15, 0x20
mov rdi, qword [r15]
cmp rdi, 0
je 0x180220d9e
mov rcx, rdi
call fcn.18041b8c0
mov rax, qword [rdi]
lock dec qword [rax]
sete al
jmp 0x180220d09
test al, 1
jne 0x180220d0f
jmp 0x180220d6a
mov eax, dword [0x18051cd88]
and eax, dword [0x18051cd8c]
and eax, 0x1ffe1147
imul eax, eax, 0xffe51b5b
or eax, 0xd2a5fb2b
cmp eax, 0x540a2422
jbe 0x180220f11
jmp 0x180220d38
mov eax, dword [0x18051cd90]
mov ecx, dword [0x18051cd94]
imul eax, ecx
imul rax, rax, 0x546336ad
shr rax, 0x34
xor eax, 0xbb2b6523
cmp eax, 0xd3c74139
jae 0x180220d38
jmp 0x180220d60
mov rcx, rdi
call fcn.180279160
jmp 0x180220d6a
add rdi, 8
mov rax, qword [rdi]
lock dec qword [rax]
sete al
test al, 1
jne 0x180220d7e
jmp 0x180220d88
mov rcx, rdi
call fcn.180272d20
jmp 0x180220d88
mov rcx, qword [r15]
mov edx, 0x20
mov r8d, 8
call fcn.1802cbf20
mov rbx, qword [r14]
mov eax, dword [0x18051cd98]
sub eax, dword [0x18051cd9c]
and eax, 0x9485e2a3
xor eax, 0x3af3afbf
xor eax, 0x3f146f5b
cmp eax, 0x64eafbf3
je 0x180220f22
mov edi, dword [0x18051cda0]
add edi, dword [0x18051cda4]
xor edi, 0xe9c5aeed
xor edi, 0xbdfa6642
or edi, 0x212a9f74
mov rcx, rbx
call qword [sym.imp.ws2_32.dll_closesocket]
cmp edi, 0x77a2f5c5
jae 0x180220f22
jmp 0x180220df9
mov rcx, rsi
call fcn.180405bd0
mov rax, qword [rsi]
cmp rax, 0
sete al
mov rcx, rsi
add rcx, 8
test al, 1
jne 0x180220e1b
jmp 0x180220ed4
mov eax, dword [0x18051cda8]
and eax, dword [0x18051cdac]
xor eax, 0x922d16f6
mov r8d, 0xc8a9b199
xor edx, edx
div r8d
and eax, 0xa6e93caf
cmp eax, 0x6ef2eff9
jae 0x180220f3c
jmp 0x180220e49
mov edx, dword [0x18051cdb0]
xor edx, dword [str.___eC]
or edx, 0x158432ef
add edx, 0xc5e5a03b
xor edx, 0xbf6efd8
mov rax, qword [rcx]
lock dec qword [rax]
sete al
cmp edx, 0xaaa1976e
jb 0x180220e49
jmp 0x180220e7b
test al, 1
jne 0x180220e81
jmp 0x180220ee9
mov eax, dword [0x18051cdb8]
xor edx, edx
div dword [0x18051cdbc]
add eax, 0xe375f4c6
or eax, 0x970e668f
imul eax, eax, 0x9762878c
cmp eax, 0x86bdd8de
jae 0x180220f50
jmp 0x180220eac
mov eax, dword [0x18051cdc0]
mov edx, dword [0x18051cdc4]
and eax, edx
or eax, 0xc115c9c7
add eax, 0x450d6a7f
cmp eax, 0x6e009e32
jae 0x180220eac
jmp 0x180220ecd
call fcn.180275eb0
jmp 0x180220ee9
mov rax, qword [rcx]
lock dec qword [rax]
sete al
test al, 1
je 0x180220ee9
call fcn.180279770
jmp 0x180220ee9
add rsi, 0x10
mov rax, qword [rsi]
lock dec qword [rax]
sete al
test al, 1
je 0x180220f05
mov rcx, rsi
call fcn.180274de0
jmp 0x180220f05
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
add edi, dword [rdx]
invalid
jmp 0x180220d36
invalid
sub al, 0x4d
cwde
cmp dword [rbx], ebx
xchg ebx, eax
add al, 0xb8
mov rax, qword [rcx]
lock dec qword [rax]
jmp 0x180220e47
nop
js 0x180220f1d
invalid
Function at 0x180223900
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
mov r12, r8
mov rdi, rdx
mov rsi, rcx
mov eax, dword [0x18051d1b8]
xor eax, dword [0x18051d1bc]
imul eax, eax, 0xa9c2a071
sub eax, 0x3651a71d
or eax, 0x4023423a
cmp eax, 0x7eef7ed4
jb 0x1802244c8
mov ecx, dword [0x18051d1c0]
mov eax, dword [0x18051d1c4]
add ecx, eax
and ecx, 0x20da10
add ecx, 0x241a39dc
mov eax, 0x20
call fcn.18045a590
sub rsp, rax
mov r14, rsp
mov r13, rdi
add r13, 0x10
mov al, byte [rdi + 0x10]
cmp ecx, 0x521eb0f1
ja 0x1802244c8
jmp 0x18022398d
movzx ecx, al
sub al, 4
ja 0x1802239a4
lea rax, [0x180485f40]
movsxd rcx, dword [rax + rcx*4]
add rcx, rax
jmp rcx
mov eax, dword [0x18051d1c8]
add eax, dword [0x18051d1cc]
or eax, 0x6bd1351b
imul eax, eax, 0xb5d3292d
imul eax, eax, 0x6e06f93d
cmp eax, 0x65aed68b
jae 0x1802244d9
jmp 0x1802239ce
mov eax, dword [0x18051d1d0]
xor eax, dword [0x18051d1d4]
and eax, 0xeb029e2
xor eax, 0x230d3203
add eax, 0xb33b27eb
cmp eax, 0x2e36dd4c
je 0x1802239ce
ud2
push rax
invalid
xchg esi, eax
and bl, byte ds:[rcx]
stosd dword [rdi], eax
and ebx, eax
invalid
test r11d, r14d
out dx, al
mov ah, bl
xchg esi, eax
jne 0x1802244b4
int 0xcb
jmp 0x1802239cc
Function at 0x1802337b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdx, qword [rsi + 0x50]
cmp rdx, 0
sete al
test al, 1
jne 0x1802337e6
jmp 0x1802337d1
mov rcx, qword [rsi + 0x48]
shl rdx, 2
mov r8d, 2
call fcn.1802cbf20
jmp 0x1802337e6
mov rbx, rsi
add rbx, 0x18
mov rax, rsi
add rax, 0x20
mov rdi, qword [rax]
mov eax, dword [0x18051df78]
xor eax, dword [0x18051df7c]
or eax, 0x86540511
mov ecx, 0x351320de
xor edx, edx
div ecx
or eax, 0x594fb1e9
cmp eax, 0x42067eb3
jbe 0x180233a1f
jmp 0x180233823
mov ecx, dword [0x18051df80]
xor ecx, dword [0x18051df84]
sub ecx, 0x86c18213
or ecx, 0x34a8cbaf
sub ecx, 0xe24e860a
mov r14, qword [rsi + 0x28]
cmp r14, 0
sete al
cmp ecx, 0xdc4540d4
jbe 0x180233823
test al, 1
jne 0x1802338ba
jmp 0x18023385a
xor r15d, r15d
jmp 0x18023385f
imul rax, r15, 0x68
mov r12, rdi
add r12, rax
add r15, 1
mov rax, qword [r12 + 0x40]
cmp rax, 0
je 0x18023388f
mov rax, qword [rax + 0x20]
mov rcx, r12
add rcx, 0x58
mov rdx, qword [r12 + 0x48]
mov r8, qword [r12 + 0x50]
call rax
mov rax, qword [r12 + 0x18]
mov rax, qword [rax + 0x20]
mov rcx, r12
add rcx, 0x30
mov rdx, r12
add rdx, 0x20
mov rdx, qword [rdx]
add r12, 0x28
mov r8, qword [r12]
call rax
cmp r15, r14
jne 0x18023385f
jmp 0x1802338ba
mov rax, qword [rbx]
cmp rax, 0
je 0x1802338d7
imul rdx, rax, 0x68
mov rcx, rdi
mov r8d, 8
call fcn.1802cbf20
jmp 0x1802338d7
mov rbx, rsi
add rbx, 0x30
mov rdi, qword [rsi + 0x38]
mov r14, qword [rsi + 0x40]
cmp r14, 0
sete al
test al, 1
jne 0x180233926
jmp 0x1802338f3
xor r15d, r15d
jmp 0x1802338f8
imul rax, r15, 0x48
mov r8, rdi
add r8, rax
add r15, 1
mov rax, qword [r8 + 0x20]
mov rax, qword [rax + 0x20]
mov rcx, r8
add rcx, 0x38
mov rdx, qword [r8 + 0x28]
mov r8, qword [r8 + 0x30]
call rax
cmp r15, r14
jne 0x1802338f8
jmp 0x180233926
mov rax, qword [rbx]
cmp rax, 0
sete cl
test cl, 1
jne 0x18023394b
jmp 0x180233937
imul rdx, rax, 0x48
mov rcx, rdi
mov r8d, 8
call fcn.1802cbf20
jmp 0x18023394b
mov rdi, qword [rsi + 0x60]
cmp rdi, 0
sete al
test al, 1
jne 0x180233979
jmp 0x18023395c
mov rcx, rdi
call fcn.1802695e0
mov rcx, rdi
mov edx, 0x20
mov r8d, 8
call fcn.1802cbf20
jmp 0x180233979
mov rax, rsi
add rax, 0x70
mov r8, qword [rax]
movabs rax, 0x8000000000000000
cmp r8, rax
sete al
test al, 1
jne 0x180233a11
jmp 0x180233999
cmp r8, 0
sete cl
mov eax, dword [0x18051df88]
sub eax, dword [0x18051df8c]
add eax, 0x8ee99b00
sub eax, 0xfac4727c
mov r9d, 0xe6287b85
xor edx, edx
div r9d
cmp eax, 0x41cccd26
jae 0x180233a2c
mov eax, dword [0x18051df90]
or eax, dword [0x18051df94]
mov r9d, 0x10d1eb67
xor edx, edx
div r9d
mov r9d, 0x257ab3df
xor edx, edx
div r9d
xor eax, 0xb2ced600
cmp eax, 0x33476d21
jb 0x180233a2c
test cl, 1
jne 0x180233a11
jmp 0x1802339fd
mov rcx, qword [rsi + 0x78]
mov rdx, r8
mov r8d, 1
call fcn.1802cbf20
jmp 0x180233a11
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
invalid
push rdx
invalid