joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802d1650
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x18077aac0]
or eax, dword [0x18077aac4]
and eax, 0x89c3bb7c
and eax, 0xd15722ea
imul eax, eax, 0x3d646bcf
cmp eax, 0xacbd1c85
ja 0x1802d1624
jmp 0x1802d1539
mov eax, dword [0x18077aac8]
xor eax, dword [0x18077aacc]
sub eax, 0x2e45435b
or eax, 0x7c8f7719
imul eax, eax, 0x4e73da93
mov r8, rdx
xor r8, 0x5a209ac5
cmp eax, 0x5879586b
je 0x1802d1539
jmp 0x1802d1568
mov eax, dword [0x18077aad0]
xor edx, edx
div dword [0x18077aad4]
and eax, 0x81e9b862
or eax, 0x24a9de5b
mov r9d, 0x1772e0ed
xor edx, edx
div r9d
cmp eax, 0xf3c91ac3
jae 0x1802d1635
jmp 0x1802d1598
mov edx, dword [0x18077aad8]
or edx, dword [0x18077aadc]
or edx, 0x9aef7aae
and edx, 0xef913c21
sub edx, 0xa816c13f
mov r9, r8
rol r9, 4
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xc0f34f48
jae 0x1802d1598
jmp 0x1802d15d7
mov ecx, dword [0x18077aae0]
xor ecx, dword [0x18077aae4]
sub ecx, 0x15b149e2
add ecx, 0x22056530
xor ecx, 0x630eaaad
cmp ecx, 0x2f2c4e40
je 0x1802d1646
mov ecx, dword [0x18077aae8]
or ecx, dword [0x18077aaec]
add ecx, 0xb7904d99
imul ecx, ecx, 0x240758cd
imul ecx, ecx, 0xf48e0684
cmp ecx, 0x7bac8ae4
je 0x1802d1646
ret
mov esp, 0x2543c7db
rol dword [rdi + rbp + 0x38], 1
mov byte [rcx], dl
adc eax, 0xffff02e9
jmp [rsp + rdi + 0x3e88aa0]
lodsb al, byte [rsi]
cmp al, 0xa0
mov ch, al
add esp, dword [rbx - 0x6a9ba82a]
pop rdi
jmp 0x1802d1596
loope 0x1802d1647
call qword [rax - 0x6e556160]
mov al, 0xeb
lodsd eax, dword [rsi]
nop
movabs al, byte [0x8949adebb091aa9e]
mov r8, rdx
mov eax, dword [0x18077aaf0]
imul eax, dword [0x18077aaf4]

Function at 0x1802d1860
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
mov r8, rdx
rol r8, 3
xor r8, rdx
xor ecx, ecx
sub rcx, r8
mov edx, dword [0x18077ab30]
or edx, dword [0x18077ab34]
or edx, 0xdf5e268c
and edx, 0xeac13704
xor edx, 0xb9bc679c
cmp edx, 0xd53c036d
ja 0x1802d18ee
jmp 0x1802d189a
mov r9d, dword [0x18077ab38]
imul r9d, dword [0x18077ab3c]
add r9d, 0x16e92be1
sub r9d, 0x38ad9ad5
xor r9d, 0xf6905d07
mov rdx, rcx
shr rdx, 0xf
xor rdx, rcx
imul r8, rdx, 0x3d3fcfce
mov rdx, r8
rol rdx, 1
cmp r9d, 0x4f68270a
je 0x1802d189a
jmp 0x1802d18e0
xor rdx, r8
and rdx, 0xffff
add rax, rdx
ret
in al, dx
idiv edx
adc eax, 0x215c6e98
jmp 0x1802d1898

Function at 0x1802d1980
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x18077ab40]
and ecx, dword [0x18077ab44]
or ecx, 0x168f3bfb
add ecx, 0xde6af14b
imul ecx, ecx, 0x824a5a0f
cmp ecx, 0xea02d539
jae 0x1802d1a03
jmp 0x1802d19ab
mov ecx, dword [0x18077ab48]
sub ecx, dword [0x18077ab4c]
imul ecx, ecx, 0x7d5dabba
imul r8d, ecx, 0x157b5fd8
xor r8d, 0x26f008d1
mov rcx, rdx
add rcx, 0xffffffffd9e2e32b
xor rcx, 0xffffffffbe41cabb
cmp r8d, 0xb06109d8
ja 0x1802d19ab
jmp 0x1802d19e7
add rcx, 0x64abcdbc
mov rdx, rcx
rol rdx, 7
xor rdx, rcx
and rdx, 0xffff
add rax, rdx
ret
adc al, dh
movabs al, byte [0x46fe92d57abcb6f2]
fldpi
cwde
int3
Function at 0x1802d24b5
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x18077ac50]
add ecx, dword [0x18077ac54]
add ecx, 0xc18176d8
or ecx, 0x5bb54d6c
or ecx, 0x5ca707a0
cmp ecx, 0x6c613663
insb byte [rdi], dx
je 0x1802d2511
jmp 0x1802d24bb
mov ecx, dword [0x18077ac58]
add ecx, dword [0x18077ac5c]
add ecx, 0x9fc06324
xor ecx, 0x6a631234
imul r8d, ecx, 0x6c6f6b22
imul rcx, rdx, 0xffffffffc0d5a3a3
mov r9, rcx
rol r9, 7
xor rcx, r9
cmp r8d, 0x2362d569
jb 0x1802d24bb
jmp 0x1802d24f6
xor rcx, 0xffffffffce8162ce
mov rdx, rcx
rol rdx, 1
xor rdx, rcx
and rdx, 0xffff
add rax, rdx
ret
adc edx, eax
lodsd eax, dword [rsi]
lodsb al, byte [rsi]
xchg cl, cl
jl 0x1802d2549
test byte [rbx + rax*4 + 0x48cc9aeb], 0x89
enter 0xffffffffffffc748, 0xffffffffffffffc1
cmpsd dword [rsi], dword [rdi]
add esi, r8d
add eax, ecx

Function at 0x1802d2550
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 2
xor rax, rdx
mov rdx, rax
rol rdx, 7
xor rax, rdx
xor rax, 0xffffffffffffffff
imul r8, rax, 0xffffffffabb13b2f
mov r9, r8
rol r9, 4
mov eax, dword [0x18077ac60]
imul eax, dword [0x18077ac64]
or eax, 0xb30a6279
add eax, 0x6c4b641a
add eax, 0xc0133e04
cmp eax, 0x93d15942
je 0x1802d25dc
jmp 0x1802d259b
mov eax, dword [0x18077ac68]
xor eax, dword [0x18077ac6c]
add byte [rbx], sil
add eax, 0x4a86c5
mov r10d, 0x2a21587b
xor edx, edx
div r10d
mov edx, eax
or edx, 0x25fae046
sub edx, 0xff51721
mov r10, r9
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xa9f50e1a
jae 0x1802d259b
ret
sbb al, 0x86
jbe 0x1802d2612
cmpsb byte [rsi], byte [rdi]
push rbx
jns 0x1802d259f
jmp 0x1802d2599
adc al, 0x54
mov bl, 0x38
imul edx, edx, 0x2d97fc7e
imul edx, edx, 0xeb2aa2c5
cmp edx, 0xbc8f71d1
ja 0x1802d267c
jmp 0x1802d262c
mov edx, dword [0x18077ac78]
sub edx, dword [0x18077ac7c]
and edx, 0xd769e2fe
imul edx, edx, 0xbb4b828
imul r8d, edx, 0xb0d6c699
mov r9, rcx
shr r9, 3
xor r9, rcx
add r9, 0x2262dd03
mov rdx, r9
rol rdx, 4
xor rdx, r9
and rdx, 0xffff
cmp r8d, 0x56bb66a5
jbe 0x1802d262c
jmp 0x1802d2678
add rax, rdx
ret
out 0x9f, al
invalid

Function at 0x1802d2990
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077acd0]
add eax, dword [0x18077acd4]
mov r9d, 0xcac7bb12
xor edx, edx
div r9d
sub eax, 0xb7ec2b14
imul eax, eax, 0x6b24373d
cmp eax, 0xc1c392cb
ja 0x1802d2a13
jmp 0x1802d29be
mov eax, dword [0x18077acd8]
add eax, dword [0x18077acdc]
mov r9d, 0x675ea1cd
xor edx, edx
div r9d
sub eax, 0x97cb4aaa
sub eax, 0xd3d8bdcc
mov r9, r8
add r9, 0x32d52929
mov rdx, r9
rol rdx, 6
xor rdx, r9
cmp eax, 0x22e23db6
jb 0x1802d29be
jmp 0x1802d29fc
mov rax, rdx
rol rax, 5
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
mov ebx, 0x844c566c
mov dh, 0xf8
jmp 0x1802d29bc
Function at 0x1802d2ec0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x18077ad50]
sub eax, dword [0x18077ad54]
and eax, 0x63cf3ee7
sub eax, 0x703aa3c2
xor eax, 0x121629ec
cmp eax, 0xcc498f47
ja 0x1802d2fac
jmp 0x1802d2ee8
mov r8d, dword [0x18077ad58]
sub r8d, dword [0x18077ad5c]
and r8d, 0xc1c22db7
sub r8d, 0x6ae00a9f
sub r8d, 0x51627c64
mov rax, rdx
rol rax, 6
xor rax, rdx
xor rax, 0x7023096d
cmp r8d, 0xf3f2060a
ja 0x1802d2ee8
jmp 0x1802d2f26
add rax, 0xffffffff9705e329
mov rdx, rax
shr rdx, 8
xor rdx, rax
mov r8, rdx
rol r8, 2
xor r8, rdx
mov eax, dword [0x18077ad60]
imul eax, dword [0x18077ad64]
mov r9d, 0x5ea14c1e
xor edx, edx
div r9d
xor eax, 0x94ef1c5e
and eax, 0xbfd01736
cmp eax, 0x973f3954
ja 0x1802d2fb9
jmp 0x1802d2f6b
mov eax, dword [0x18077ad68]
and eax, dword [0x18077ad6c]
mov r9d, 0x7a98c6ab
xor edx, edx
div r9d
mov r9d, 0xeaee19f7
xor edx, edx
div r9d
imul edx, eax, 0x48b5efff
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x2d11a55f
je 0x1802d2f6b
ret
lodsb al, byte [rsi]
and esp, ecx
invalid
invalid

Function at 0x1802d3160
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077ad90]
add eax, dword [0x18077ad94]
add eax, 0x24fb4b3a
mov r9d, 0x92f80bdb
xor edx, edx
div r9d
mov r9d, 0xcf277659
xor edx, edx
div r9d
cmp eax, 0x1dd7743
jae 0x1802d31f0
jmp 0x1802d3193
mov eax, dword [0x18077ad98]
add eax, dword [0x18077ad9c]
or eax, 0xdf919e98
mov r9d, 0x8fd9ec11
xor edx, edx
div r9d
xor eax, 0xe152e582
imul r9, r8, 0xfffffffffcc2d403
add r9, 0xffffffffdbdc5891
xor r9, 0x5e5434c
add r9, 0xffffffffbee2229e
mov rdx, r9
rol rdx, 1
xor rdx, r9
cmp eax, 0x93e706d
jbe 0x1802d3193
jmp 0x1802d31e2
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
add edx, dword [rdi - 0x681e10d0]
outsb dx, byte [rsi]
sahf
fst qword [rcx - 0x6c14cd6e]
int3

Function at 0x1802d33e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
shr r8, 0x11
xor r8, rdx
mov eax, dword [0x18077add0]
or eax, dword [0x18077add4]
and eax, 0x9b7fdb46
or eax, 0xcb2fc6b4
xor eax, 0xc53a4a19
cmp eax, 0x333e8544
ja 0x1802d346a
jmp 0x1802d340e
mov eax, dword [0x18077add8]
add eax, dword [0x18077addc]
xor eax, 0xa61b071f
and eax, 0x9d653c62
mov r9d, 0xcebce1f9
xor edx, edx
div r9d
mov r9, 0xffffffffa8d1ec5a
sub r9, r8
mov rdx, r9
shr rdx, 0x12
xor r9, rdx
xor r9, 0x49e26eae
mov rdx, r9
rol rdx, 1
xor rdx, r9
and rdx, 0xffff
cmp eax, 0xaae93bc
je 0x1802d340e
jmp 0x1802d3463
add rcx, rdx
mov rax, rcx
ret
popfq
int 0xab
invalid

Function at 0x1802d35a0
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x5228371b
add rdx, 0xffffffffde157d3b
mov r8, rdx
rol r8, 7
xor r8, rdx
and r8, 0xffff
mov eax, dword [0x18077ae00]
add eax, dword [0x18077ae04]
add eax, 0xf7f7ca66
or eax, 0xce934c1
mov r9d, 0xfce9067e
xor edx, edx
div r9d
cmp eax, 0x3b5ebac9
je 0x1802d3618
jmp 0x1802d35e9
mov eax, dword [0x18077ae08]
or eax, dword [0x18077ae0c]
imul edx, eax, 0xbecf136d
and edx, 0xf0e85731
xor edx, 0xef5bae6e
mov rax, rcx
add rax, r8
cmp edx, 0xde59dfb9
ja 0x1802d35e9
jmp 0x1802d3617
ret
mov ah, 0x43
cmp al, 6
leave
movabs byte [0xc1eb0de1168c93bc], al
int3
Function at 0x1802d41f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077af40]
imul eax, dword [0x18077af44]
add eax, 0xfad5e86c
imul eax, eax, 0xab3cb4e8
mov r9d, 0x2ce23b09
xor edx, edx
div r9d
cmp eax, 0x31c1c12d
ja 0x1802d42db
jmp 0x1802d4223
mov eax, dword [0x18077af48]
sub eax, dword [0x18077af4c]
add eax, 0x60bf3565
xor eax, 0x7c266661
mov r9d, 0x8fa9510a
xor edx, edx
div r9d
movabs rdx, 0x1518610d9015c79
mov r9, r8
imul r9, rdx
cmp eax, 0xe068fa53
ja 0x1802d4223
jmp 0x1802d425e
mov eax, dword [0x18077af50]
xor edx, edx
div dword [0x18077af54]
imul eax, eax, 0xc92cc776
mov r8d, 0x64912c97
xor edx, edx
div r8d
mov r8d, 0x59423846
xor edx, edx
div r8d
cmp eax, 0xe972efc9
je 0x1802d42ec
mov eax, dword [0x18077af58]
xor edx, edx
div dword [0x18077af5c]
mov edx, eax
sub edx, 0x7befe3d8
or edx, 0x4c7e0a6
or edx, 0xa381e2d6
mov rax, r9
xor rax, 0x3e0221ea
mov r8, rax
rol r8, 1
xor r8, rax
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0x66f4eddd
jb 0x1802d42ec
jmp 0x1802d42da
ret
mov al, 0x5e
test byte [rdx], bh
lodsb al, byte [rsi]
sbb eax, dword [rax + rdi*2 - 0x17]
adc dword [rdi - 0xd], esi
jmp 0x1802d4221
cmp byte [rcx + 0x3f], dl
fld st(0)
inc dword [rsi - 0x336614ac]
int3

Function at 0x1802d4ae0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 4
xor rax, rdx
mov r8, rax
shr r8, 6
xor r8, rax
mov rax, r8
rol rax, 2
xor r8, rax
xor r8, 0xffffffffffffffff
mov rdx, r8
rol rdx, 7
xor rdx, r8
mov eax, dword [0x18077b030]
xor eax, dword [0x18077b034]
sub eax, 0xc4ac904a
or eax, 0x36b31cc4
imul eax, eax, 0x428c396
cmp eax, 0x5f254bab
ja 0x1802d4b6c
jmp 0x1802d4b31
mov eax, dword [0x18077b038]
xor eax, dword [0x18077b03c]
imul r8d, eax, 0x62ab81a4
or r8d, 0x14ecfda7
xor r8d, 0x8465a08e
mov r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0x1ba1c72b
jbe 0x1802d4b31
ret
test al, 0xac
invalid

Function at 0x1802d4b80
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077b040]
add eax, dword [0x18077b044]
mov r9d, 0x67009779
xor edx, edx
div r9d
add eax, 0x36411f6a
or eax, 0x41eea3e9
cmp eax, 0x2fd4fceb
je 0x1802d4c6b
jmp 0x1802d4bb1
mov edx, dword [0x18077b048]
xor edx, dword [0x18077b04c]
and edx, 0xa035f8c2
sub edx, 0xd67529ff
sub edx, 0x2bbcaac8
mov rax, r8
shr rax, 7
xor rax, r8
movabs r9, 0x4b8a6f1fa793072
imul rax, r9
cmp edx, 0xf2e1dd12
ja 0x1802d4bb1
jmp 0x1802d4bf1
mov rdx, rax
rol rdx, 5
xor rdx, rax
mov r8, rdx
rol r8, 2
xor r8, rdx
mov eax, dword [0x18077b050]
sub eax, dword [0x18077b054]
sub eax, 0x10d20bef
mov r9d, 0xfa93cd1a
xor edx, edx
div r9d
add eax, 0x8807ca14
cmp eax, 0x4f1cfdd
jbe 0x1802d4c7c
jmp 0x1802d4c2f
mov eax, dword [0x18077b058]
sub eax, dword [0x18077b05c]
or eax, 0xc6b36d85
or eax, 0x43f800b1
mov r9d, 0xbb5b56bc
xor edx, edx
div r9d
mov edx, eax
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x78ca17a2
jae 0x1802d4c2f
ret
out 0x53, al
cqo
adc al, 0x29
pop rsi
push rsp
movsd dword [rdi], dword [rsi]
invalid
invalid
Function at 0x1802d5380
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 3
mov r8d, dword [0x18077b130]
sub r8d, dword [0x18077b134]
imul r8d, r8d, 0x90ca0f89
and r8d, 0x23d78eb7
sub r8d, 0xdebd5581
cmp r8d, 0x47ccb575
ja 0x1802d5463
mov r10d, dword [0x18077b138]
add r10d, dword [0x18077b13c]
add r10d, 0xf6e23dc8
add r10d, 0x4a1e8668
sub r10d, 0x49c98a21
mov r9, rax
xor r9, rdx
mov r8, 0xffffffff9cdd17d6
sub r8, r9
xor r8, 0x5c6f7cdc
mov r9, r8
rol r9, 7
cmp r10d, 0x4149da88
jb 0x1802d5463
jmp 0x1802d5403
mov eax, dword [0x18077b140]
xor eax, dword [0x18077b144]
add eax, 0x244c0d32
imul eax, eax, 0x78896350
and eax, 0x7d191120
cmp eax, 0x445a655e
jae 0x1802d5474
jmp 0x1802d5428
mov edx, dword [0x18077b148]
imul edx, dword [0x18077b14c]
xor edx, 0x9f86b40
or edx, 0x4cd0529f
add edx, 0x59b3188c
mov r10, r9
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x5c6265c
jb 0x1802d5428
ret
cmp edi, dword [rbx + 0x6a5b2c8d]
invalid
and eax, 0x8ab3f05e
insb byte [rdi], dx
invalid

Function at 0x1802d5530
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffffffffffff
imul rdx, rdx, 0xffffffffd07ad451
mov rax, rdx
rol rax, 1
xor rax, rdx
add rax, 0xffffffffb8e06722
mov rdx, rax
rol rdx, 5
xor rdx, rax
and rdx, 0xffff
mov eax, dword [0x18077b160]
add eax, dword [0x18077b164]
and eax, 0x5c02a652
imul eax, eax, 0x2710cf2d
add eax, 0x54ac6641
cmp eax, 0xd0d126b0
jbe 0x1802d55b3
jmp 0x1802d5580
mov r8d, dword [0x18077b168]
sub r8d, dword [0x18077b16c]
xor r8d, 0x6f5113a1
xor r8d, 0x191559d6
add r8d, 0xd77ef871
mov rax, rcx
add rax, rdx
cmp r8d, 0x5f02f07b
ja 0x1802d5580
ret
shr dword [rax], 0x95
invalid

Function at 0x1802d5d40
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x25bb9965
add rdx, 0xffffffffa6f6c59b
mov rax, rdx
rol rax, 1
xor rax, rdx
xor r8d, r8d
sub r8, rax
mov rdx, r8
rol rdx, 5
xor rdx, r8
mov eax, dword [0x18077b230]
sub eax, dword [0x18077b234]
and eax, 0x424584e
add eax, 0x87b9b0ef
add eax, 0x70bf2525
cmp eax, 0x339e0ccd
jbe 0x1802d5dc6
mov r8d, dword [0x18077b238]
and r8d, dword [0x18077b23c]
or r8d, 0x289fa4c3
xor r8d, 0xddb70b8b
sub r8d, 0x7dcd072b
mov r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0x79caa253
jb 0x1802d5dc6
ret
movabs al, byte [0xebca71c72a7c991e]
mov ecx, 0x8bd08949
mov r8, rdx
mov eax, dword [0x18077b240]

Function at 0x1802d6100
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077b290]
xor eax, dword [0x18077b294]
mov r9d, 0x3f0cea97
xor edx, edx
div r9d
xor eax, 0xaf3bb216
imul eax, eax, 0xd7b7ef32
cmp eax, 0x27ce1b2
jbe 0x1802d618a
jmp 0x1802d612e
mov eax, dword [0x18077b298]
xor eax, dword [0x18077b29c]
mov r9d, 0xb5f7dfbe
xor edx, edx
div r9d
or eax, 0xfdc292fe
and eax, 0xf3e586bc
mov rdx, r8
add rdx, 0xffffffff8a63bb33
mov r9, rdx
shr r9, 0x1f
xor rdx, r9
xor rdx, 0x1d83a7d7
mov r9, rdx
rol r9, 1
cmp eax, 0xa5eb1c70
jb 0x1802d612e
jmp 0x1802d6179
xor r9, rdx
and r9, 0xffff
add rcx, r9
mov rax, rcx
ret
faddp st(6)
mov bh, 0x83
cmp ecx, dword [rdi]
mov edx, 0x7d5d2991
jmp 0x1802d612c
Function at 0x1802d6280
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x18077b2a0]
add eax, dword [0x18077b2a4]
and eax, 0x2b2f10a8
sub eax, 0xe4cdac54
sub eax, 0xb3d49265
cmp eax, 0x1521f27f
je 0x1802d6260
mov eax, dword [0x18077b2a8]
or eax, dword [0x18077b2ac]
and eax, 0xfea5f457
add eax, 0x6d430547
or eax, 0x162bf5a2
mov r9, 0xffffffffb97adf29
sub r9, rdx
mov r8, r9
rol r8, 5
xor r8, r9
cmp eax, 0xe4dc1792
jae 0x1802d6260
jmp 0x1802d61fe
mov eax, dword [0x18077b2b0]
xor eax, dword [0x18077b2b4]
imul eax, eax, 0xdd5db671
imul eax, eax, 0x134beac9
xor eax, 0x99c993fe
cmp eax, 0x534624d0
je 0x1802d6271
jmp 0x1802d6224
mov eax, dword [0x18077b2b8]
add eax, dword [0x18077b2bc]
imul eax, eax, 0x52d44c46
and eax, 0xff27f4d6
mov r9d, 0x78ac09d4
xor edx, edx
div r9d
mov rdx, r8
and rdx, 0xffff
cmp eax, 0xaa8ac2a3
ja 0x1802d6224
jmp 0x1802d6259
add rcx, rdx
mov rax, rcx
ret
cli
mov al, 0xe2
invalid
jno 0x1802d627e
rcl byte [rdx + 0x17], cl
invalid
movabs dword [0x5037058bd08949cc], eax
add byte [rbx], sil
add eax, 0x4a5035
and eax, 0x78a48dca
mov r9d, 0x116fb88a
xor edx, edx
div r9d
add eax, 0x11e5cfcb
cmp eax, 0x7d84b06a
je 0x1802d636c
mov eax, dword [0x18077b2c8]
sub eax, dword [0x18077b2cc]
mov r9d, 0x7185aa50
xor edx, edx
div r9d
mov r9d, 0x27a2e61c
xor edx, edx
div r9d
mov r9d, 0x6701d1ad
xor edx, edx
div r9d
mov rdx, r8
add rdx, 0xffffffffa3a6e72a
mov r9, rdx
rol r9, 1
xor r9, rdx
imul r9, r9, 0xfffffffff0816cf1
cmp eax, 0x8ac379f1
ja 0x1802d636c
jmp 0x1802d62ff
mov r8, r9
rol r8, 3
mov eax, dword [0x18077b2d0]
xor edx, edx
div dword [0x18077b2d4]
mov r10d, 0xd48a7bc7
xor edx, edx
div r10d
sub eax, 0xf5ea906b
and eax, 0x9c7fca10
cmp eax, 0x38a29f18
ja 0x1802d637d
jmp 0x1802d6332
mov edx, dword [0x18077b2d8]
sub edx, dword [0x18077b2dc]
or edx, 0x30bfcd13
or edx, 0xf38d99ee
or edx, 0x252f5941
mov r10, r8
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x70353a21
je 0x1802d6332
ret
mov al, 0x3c
and al, 0x65
scasb al, byte [rdi]
mov al, 0xa7
add ebp, 0xe9df9ccc
xor bh, bh
invalid
sub al, byte [rbp + 0x2998501d]
mov dh, 0xce
movabs al, byte [0xcccccca5ebb61f3b]
int3

Function at 0x1802d67b0
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0xfffffffff9b6bd15
mov rax, rdx
rol rax, 6
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov eax, dword [0x18077b360]
or eax, dword [0x18077b364]
or eax, 0xb38e4101
imul eax, eax, 0xbfd5108d
and eax, 0x9aa163e
cmp eax, 0x30d94d74
ja 0x1802d6819
mov eax, dword [0x18077b368]
add eax, dword [0x18077b36c]
add eax, 0x6f9376db
mov r8d, 0xcf897774
xor edx, edx
div r8d
or eax, 0x8c46ed1a
cmp eax, 0x9686e7e0
jae 0x1802d6819
invalid
mov rax, rcx
ret
xchg esp, eax
xor al, 0xdb
jo 0x1802d680d
mov cl, 5
scasb al, byte [rdi]
jo 0x1802d6837
invalid
ror byte [rcx - 0x2f], 0xc0
Function at 0x1802d73f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077b4a0]
imul eax, dword [0x18077b4a4]
add eax, 0x3a9c30c6
xor eax, 0x7877ae3c
mov r9d, 0xf7bb3fa0
xor edx, edx
div r9d
cmp eax, 0x621fcc11
je 0x1802d74d0
jmp 0x1802d7422
mov eax, dword [str.LN_f_U]
xor edx, edx
div dword [0x18077b4ac]
xor eax, 0x92a1152a
xor eax, 0xa93b52e3
xor eax, 0x9f50cbe
mov r9, r8
xor r9, 0xfffffffff2df3119
cmp eax, 0xb5ac38b6
jae 0x1802d7422
jmp 0x1802d7452
mov eax, dword [0x18077b4b0]
sub eax, dword [0x18077b4b4]
xor eax, 0x343bba65
mov r8d, 0xdd4b6247
xor edx, edx
div r8d
mov r8d, 0x4f5eba34
xor edx, edx
div r8d
cmp eax, 0x55993a82
jae 0x1802d74dd
mov r8d, dword [0x18077b4b8]
xor r8d, dword [0x18077b4bc]
xor r8d, 0x4187984d
and r8d, 0x9fad9026
and r8d, 0x735b23a5
mov rax, r9
shr rax, 7
xor rax, r9
mov rdx, rax
rol rdx, 2
cmp r8d, 0xa2875fdb
je 0x1802d74dd
jmp 0x1802d74bf
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
xlatb
div dword [rax + 0x15]
jo 0x1802d74d1
invalid
mov ebx, 0xd71e7e3
lea edi, [rsi + 0x25]
jmp 0x1802d7480

Function at 0x1802d75d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
add r8, 0x1457fcb
mov r10, r8
rol r10, 4
mov eax, dword [0x18077b4c0]
xor eax, dword [0x18077b4c4]
add eax, 0x71add823
and eax, 0x37443561
and eax, 0x982a4d1
cmp eax, 0x2f0a2a8a
je 0x1802d76ad
mov eax, dword [0x18077b4c8]
or eax, dword [0x18077b4cc]
xor eax, 0xb78182ea
and eax, 0xf18fdcf0
mov r9d, 0x900667cc
xor edx, edx
div r9d
mov r9, r10
xor r9, r8
add r9, 0x29888e99
cmp eax, 0x433a4451
jae 0x1802d76ad
jmp 0x1802d763e
mov eax, dword [0x18077b4d0]
sub eax, dword [0x18077b4d4]
sub eax, 0x8efe4a52
mov r8d, 0x4908c342
xor edx, edx
div r8d
add eax, 0xabff9751
cmp eax, 0xaf3dd3ba
ja 0x1802d76ba
jmp 0x1802d7668
mov eax, dword [0x18077b4d8]
imul eax, dword [0x18077b4dc]
add eax, 0xa8f43269
mov r8d, 0x8af017f0
xor edx, edx
div r8d
mov edx, eax
xor edx, 0x24b11fcb
mov r8, r9
rol r8, 5
xor r8, r9
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0x20b359dd
jbe 0x1802d7668
ret
imul ebp, dword [rdi], 0xdbae4af5
invalid
ret
Function at 0x1802d7cf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x18077b590]
and eax, dword [0x18077b594]
and eax, 0x6b665209
sub eax, 0x5514568d
add eax, 0x399bebfe
cmp eax, 0xc1b5d1e0
jb 0x1802d7dc5
mov eax, dword [0x18077b598]
or eax, dword [0x18077b59c]
xor eax, 0xf90d38ea
and eax, 0x99c1a874
add eax, 0xb0571ae5
mov r8, rdx
shr r8, 5
xor r8, rdx
mov r9, r8
shr r9, 0xd
xor r9, r8
imul r8, r9, 0x59919334
xor r8, 0x22f36880
mov r9, r8
rol r9, 3
cmp eax, 0x631710dd
jbe 0x1802d7dc5
jmp 0x1802d7d63
mov eax, dword [0x18077b5a0]
xor eax, dword [0x18077b5a4]
or eax, 0x7267ad96
imul eax, eax, 0xf9fb07b1
imul eax, eax, 0xa707cb2
cmp eax, 0xfacb3f93
je 0x1802d7dd2
jmp 0x1802d7d89
mov edx, dword [0x18077b5a8]
or edx, dword [0x18077b5ac]
and edx, 0x641193df
add edx, 0x4640e145
and edx, 0xc92aa7ef
mov r10, r9
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x6f6f3bdd
jb 0x1802d7d89
jmp 0x1802d7dc4
ret
jmp 0x1c9100124
out dx, al
fld xword [rbp + 0x7e]
movsb byte [rdi], byte [rsi]
out 0x57, eax
in eax, dx
jg 0x1802d7de2
shr ebx, cl
cmpsd dword [rsi], dword [rdi]
ror byte [rbx + 0x4a37c705], 1
add byte [rcx], dh
sal bh, cl
xor eax, 0x4a37c3

Function at 0x1802d8090
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 3
xor rax, rdx
mov r8, rax
rol r8, 4
xor r8, rax
mov eax, dword [0x18077b600]
imul eax, dword [0x18077b604]
mov r9d, 0x23bbb7cc
xor edx, edx
div r9d
add eax, 0xfc808c47
imul eax, eax, 0x999610e4
cmp eax, 0x8bb1b4b0
jbe 0x1802d811e
jmp 0x1802d80d0
mov edx, dword [0x18077b608]
or edx, dword [0x18077b60c]
or edx, 0x5b70339
xor edx, 0xa720ff2f
sub edx, 0x9232d28b
mov rax, r8
shr rax, 1
xor rax, r8
xor r9d, r9d
sub r9, rax
mov r10, r9
rol r10, 1
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x9662aa6c
je 0x1802d80d0
jmp 0x1802d811d
ret
xor eax, 0x1f8b83d8
xchg edi, eax
adc dword [rbx + 0x30], 0xeba063ef
invalid
int3
int3
int3
int3

Function at 0x1802d8420
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x18077b650]
imul ecx, dword [0x18077b654]
add ecx, 0xb85c1435
add ecx, 0x93d6673
imul ecx, ecx, 0xa8ebc1f5
cmp ecx, 0xd68fcabe
je 0x1802d84a4
jmp 0x1802d844c
mov ecx, dword [0x18077b658]
xor ecx, dword [0x18077b65c]
or ecx, 0x2632604d
imul r9d, ecx, 0xe0e22425
sub r9d, 0x844ebf9a
mov rcx, 0xffffffff93783f7d
sub rcx, rdx
xor rcx, 0xffffffff83a7eab5
add rcx, 0x3f32b8ad
mov r8, rcx
rol r8, 4
cmp r9d, 0xaae5754f
jae 0x1802d844c
jmp 0x1802d8496
xor r8, rcx
and r8, 0xffff
add rax, r8
ret
sbb dword [rbp - 0x77], esi
mov bl, byte [0x1fe75ad9f]
invalid