joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802f3c10
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
add r8, 0xffffffffea5c405e
mov eax, dword [0x18077e430]
add eax, dword [0x18077e434]
or eax, 0x8b3bf8ef
mov r9d, 0xf01ea0fa
xor edx, edx
div r9d
or eax, 0xe8a21e4b
cmp eax, 0x591e05d8
je 0x1802f3c9a
jmp 0x1802f3c44
mov eax, dword [0x18077e438]
add eax, dword [0x18077e43c]
add eax, 0x267f1c
sub eax, 0xf4f06aaf
imul edx, eax, 0x8195a21b
mov r9, r8
rol r9, 2
xor r9, r8
mov rax, r9
rol rax, 5
xor rax, r9
cmp edx, 0xd1c8874
jb 0x1802f3c44
jmp 0x1802f3c7e
xor edx, edx
sub rdx, rax
mov rax, rdx
rol rax, 6
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
invalid

Function at 0x1802f3d70
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0xffffffff8d366a90
mov r9, r8
shr r9, 0x1a
mov eax, dword [0x18077e450]
xor edx, edx
div dword [0x18077e454]
add eax, 0x4eb543db
mov r10d, 0xe5b9445f
xor edx, edx
div r10d
xor eax, 0xad7a1045
cmp eax, 0x4483254c
je 0x1802f3e0c
jmp 0x1802f3dad
mov r10d, dword [0x18077e458]
and r10d, dword [0x18077e45c]
sub r10d, 0x46f4aae0
or r10d, 0xe3504821
sub r10d, 0xd731fc35
mov rdx, r9
xor rdx, r8
mov rax, rdx
shr rax, 4
cmp r10d, 0xc884c042
je 0x1802f3dad
jmp 0x1802f3de8
xor rax, rdx
mov rdx, rax
shr rdx, 0x1e
xor rdx, rax
mov rax, rdx
rol rax, 6
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
and ch, dl
iretd

Function at 0x1802f43f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0xffffffffeead1b99
add r8, 0x451d1bf8
mov eax, dword [0x18077e510]
or eax, dword [0x18077e514]
xor eax, 0xfa3a1662
or eax, 0x1696dc26
and eax, 0x7301685f
cmp eax, 0x1006b902
jbe 0x1802f4469
invalid
jmp 0x1802f4425
mov eax, dword [0x18077e518]
xor edx, edx
div dword [0x18077e51c]
mov r9d, 0x5f86c2b6
xor edx, edx
div r9d
sub eax, 0x86e894a0
or eax, 0x43e9ad20
mov rdx, r8
rol rdx, 7
xor rdx, r8
cmp eax, 0x8f6f54ff
ja 0x1802f4425
jmp 0x1802f445b
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
jbe 0x1802f44aa
jb 0x1802f4409
movabs byte [0xebedf8625e0080ca], al
lodsb al, byte [rsi]
int3
ret

Function at 0x1802f48f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 0x11
xor rax, rdx
mov rdx, 0xffffffffeee108e0
sub rdx, rax
mov eax, dword [0x18077e580]
add eax, dword [0x18077e584]
sub eax, 0x8554b8e9
or eax, 0xdb328d99
add eax, 0xd95b90d7
cmp eax, 0x4e0b503d
jbe 0x1802f497d
jmp 0x1802f4928
mov r8d, dword [0x18077e588]
xor r8d, dword [0x18077e58c]
or r8d, 0xf6ef1a1f
sub r8d, 0x2fdddcfa
xor r8d, 0xf8b4e191
mov rax, rdx
xor rax, 0x778a979f
add rax, 0x24177cee
mov r9, rax
rol r9, 5
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0x9d82c372
ja 0x1802f4928
jmp 0x1802f497c
ret
mov ch, 0x91
sub dword [rax], ebp
sbb al, byte [rcx + rdx*4 + 0x62]
invalid
Function at 0x1802f4c20
Capabilities:
Encode data using xor

Disassembly:
mov r8, 0xffffffffb05d002f
sub r8, rdx
mov rax, r8
shr rax, 0x15
xor rax, r8
mov edx, dword [0x18077e5e0]
imul edx, dword [0x18077e5e4]
xor edx, 0x6a6577af
imul edx, edx, 0xcd76fc9f
add edx, 0x552fbf20
cmp edx, 0xac7ac409
je 0x1802f4cf4
jmp 0x1802f4c61
mov r8d, dword [0x18077e5e8]
sub r8d, dword [0x18077e5ec]
or r8d, 0x1fa62c2c
xor r8d, 0x378578bb
xor r8d, 0x8b6f16b5
mov rdx, rax
rol rdx, 5
xor rdx, rax
cmp r8d, 0xed7bd0e9
outsd dx, dword [rsi]
mov ecx, dword [rax - 0x77]
ret 0xc148
jnp 0x1802f4c82
jae 0x1802f4c61
jmp 0x1802f4c99
mov eax, dword [0x18077e5f0]
and eax, dword [0x18077e5f4]
add eax, 0xd7b56170
or eax, 0xd9a87d2e
or eax, 0x93137122
cmp eax, 0x9c13e684
je 0x1802f4d01
jmp 0x1802f4cbd
mov eax, dword [0x18077e5f8]
or eax, dword [0x18077e5fc]
or eax, 0x7d4d4cb
xor eax, 0xb16349a7
imul r8d, eax, 0xfaadb767
mov r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0xef0cdd61
ja 0x1802f4cbd
ret
and byte [rax], dh
and al, 0xf3
invalid
sahf
test al, 0x6d
cmp bl, byte [rsi]
jbe 0x1802f4c93
lea edi, [rcx]
out 0, eax
jmp 0x1802f4cbb

Function at 0x1802f4d10
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077e600]
and eax, dword [0x18077e604]
mov r9d, 0x1b2007c1
xor edx, edx
div r9d
add eax, 0x87c8559c
xor eax, 0x7a03899e
cmp eax, 0x87e691d1
je 0x1802f4df4
mov eax, dword [0x18077e608]
imul eax, dword [0x18077e60c]
and eax, 0x31d99379
imul eax, eax, 0x70c5928d
mov r9d, 0xc35110aa
xor edx, edx
div r9d
movabs r9, 0xffffffff7b6094a1
mov rdx, r8
add rdx, r9
cmp eax, 0x1e4cc621
ja 0x1802f4df4
jmp 0x1802f4d7b
mov eax, dword [0x18077e610]
xor eax, dword [0x18077e614]
and eax, 0xca61c2a8
or eax, 0x9b6326cd
and eax, 0xfe03085a
cmp eax, 0x5f2ecc09
jb 0x1802f4e05
int3
jmp 0x1802f4d9f
mov eax, dword [0x18077e618]
sub eax, dword [0x18077e61c]
or eax, 0x97bac21f
imul r9d, eax, 0xb1d6d725
sub r9d, 0x799a0d55
mov rax, rdx
shr rax, 6
mov r10d, 0x849f6b5e
sub r10, r8
xor rax, r10
cmp r9d, 0x82aae23e
jbe 0x1802f4d9f
jmp 0x1802f4ddc
mov rdx, rax
rol rdx, 3
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
mov cl, 0xf3
xchg ebp, eax
loope 0x1802f4d98
invalid
div dword [rdx - 0x6f]
adc al, dh
int3

Function at 0x1802f5710
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 3
xor rax, rdx
mov r8, 0xffffffffcad404dd
sub r8, rax
mov eax, dword [0x18077e6f0]
xor eax, dword [0x18077e6f4]
mov r9d, 0x9f9892aa
xor edx, edx
div r9d
mov r9d, 0xa36b8178
xor edx, edx
div r9d
sub eax, 0x56b6e02c
cmp eax, 0x4c3cdbb1
je 0x1802f57a1
jmp 0x1802f5754
mov eax, dword [0x18077e6f8]
or eax, dword [0x18077e6fc]
xor eax, 0x214f723b
mov r9d, 0x3b4e114e
xor edx, edx
div r9d
mov edx, eax
and edx, 0x4868aecb
mov rax, r8
xor rax, 0xcb1432f
mov r9, rax
rol r9, 5
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xdf6017e
je 0x1802f5754
ret
invalid
Function at 0x1802f5a40
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, 0xffffffffbc8ca822
sub rcx, rdx
mov rdx, rcx
rol rdx, 5
mov r8d, dword [0x18077e740]
sub r8d, dword [0x18077e744]
xor r8d, 0x4682dfe7
xor r8d, 0xa06aff62
sub r8d, 0x53a7e778
cmp r8d, 0x68bb51c3
je 0x1802f5acb
jmp 0x1802f5a82
mov r8d, dword [0x18077e748]
and r8d, dword [0x18077e74c]
sub r8d, 0x6c7ffe38
imul r10d, r8d, 0x528a2b9a
and r10d, 0x89950b52
mov r9, rdx
xor r9, rcx
mov r8, r9
rol r8, 4
cmp r10d, 0x9f72319c
ja 0x1802f5a82
jmp 0x1802f5abd
xor r8, r9
and r8, 0xffff
add rax, r8
ret
jp 0x1802f5b39
or ah, byte [rcx - 0x60]
in al, 0xeb
stosd dword [rdi], eax
int3
mov r9d, dword [0x18077e758]
and r9d, dword [0x18077e75c]
or r9d, 0x2738f935
sub r9d, 0x10f85818
xor r9d, 0x57198665
mov rax, r8
add rax, 0x4aedb8d1
mov rdx, rax
shr rdx, 0x16
xor rdx, rax
imul rdx, rdx, 0x21ed7f6e
xor rdx, 0xffffffffd9efdf9d
mov rax, rdx
rol rax, 5
cmp r9d, 0x6b5f467e
je 0x1802f5b13
jmp 0x1802f5b69
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret

Function at 0x1802f5dc0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 0x18
xor rax, rdx
imul r8, rax, 0xffffffffb3f2ce81
mov rax, r8
shr rax, 0x14
xor r8, rax
xor r8, 0x76c5e484
mov eax, dword [0x18077e7a0]
and eax, dword [0x18077e7a4]
and eax, 0xb93b0384
add eax, 0x74eea7a8
sub eax, 0x9e138ab4
cmp eax, 0x5bd83333
jb 0x1802f5e49
jmp 0x1802f5e06
mov eax, dword [0x18077e7a8]
xor edx, edx
div dword [0x18077e7ac]
sub eax, 0x9d1149c2
mov r9d, 0x9cff178
xor edx, edx
div r9d
xor eax, 0x13a40251
mov rdx, r8
rol rdx, 1
xor rdx, r8
and rdx, 0xffff
cmp eax, 0x990c7529
je 0x1802f5e06
jmp 0x1802f5e42
add rcx, rdx
mov rax, rcx
ret
and esi, dword [rcx + rbp*4]
cwde
push rsp
out 0x12, al
jmp 0x1802f5e04

Function at 0x1802f6c00
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
rol rcx, 7
xor rcx, rdx
add rcx, 0x43c0d8de
mov edx, dword [0x18077e8f0]
add edx, dword [str._uCu]
and edx, 0xf4f19140
imul edx, edx, 0x201bf650
or edx, 0x2d19f8e8
cmp edx, 0x345f77d6
jbe 0x1802f6c85
jmp 0x1802f6c3c
mov edx, dword [0x18077e8f8]
add edx, dword [0x18077e8fc]
imul edx, edx, 0x7a801e4c
and edx, 0x3184707d
imul r8d, edx, 0xfb0040d5
mov rdx, rcx
rol rdx, 6
xor rdx, rcx
cmp r8d, 0x21bda7d8
jae 0x1802f6c3c
jmp 0x1802f6c70
mov rcx, rdx
rol rcx, 5
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
ret
mov bl, 0x90
retf

Function at 0x1802f76c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x18077ea10]
sub ecx, dword [0x18077ea14]
add ecx, 0xd4a922f3
xor ecx, 0x93c48599
Function at 0x1802f7920
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0x74910ccc
mov eax, dword [0x18077ea50]
xor edx, edx
div dword [0x18077ea54]
mov r9d, 0xae389625
xor edx, edx
div r9d
and eax, 0xaf86162d
mov r9d, 0xd742f42c
xor edx, edx
div r9d
cmp eax, 0x16c78e8a
jae 0x1802f79a4
jmp 0x1802f795c
mov eax, dword [0x18077ea58]
xor edx, edx
div dword [0x18077ea5c]
or eax, 0xd719035a
or eax, 0xbd67c33d
sub eax, 0x618eae17
mov r9, r8
add r9, 0x5ed4a974
mov rdx, r9
rol rdx, 7
xor rdx, r9
and rdx, 0xffff
cmp eax, 0x83695544
jb 0x1802f795c
jmp 0x1802f799d
add rcx, rdx
mov rax, rcx
ret
xor dword [rcx + 0x21], ebp
jne 0x1802f79c6
test byte [rcx], bl
rol byte [rbp - 0x14c0fcfe], 0xa8
int3
mov rax, rcx

Function at 0x1802f7cc0
Capabilities:
Encode data using xor

Disassembly:
imul rax, rdx, 0x3a664184
movabs rdx, 0x148eb9d71ac437ac
add rax, rdx
mov rdx, rax
rol rdx, 2
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov eax, dword [0x18077eaa0]
and eax, dword [0x18077eaa4]
mov r8d, 0x1faf9cba
xor edx, edx
div r8d
or eax, 0xa17a4af9
imul eax, eax, 0xadef22c3
cmp eax, 0x634bfb7
jb 0x1802f7d3b
jmp 0x1802f7d13
mov eax, dword [0x18077eaa8]
and eax, dword [0x18077eaac]
xor eax, 0xf58b0858
imul eax, eax, 0x219d1b66
imul eax, eax, 0x71f4df1a
cmp eax, 0xad81cc8e
jb 0x1802f7d13
mov rax, rcx
ret
adc bl, byte [rsi]
invalid

Function at 0x1802f81d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077eb10]
imul eax, dword [0x18077eb14]
sub eax, 0x425cb880
xor eax, 0xd85fc904
mov r9d, 0xd16c373c
xor edx, edx
div r9d
cmp eax, 0xde8d9d58
jae 0x1802f82b6
mov eax, dword [0x18077eb18]
add eax, dword [0x18077eb1c]
mov r9d, 0x6a85674c
xor edx, edx
div r9d
sub eax, 0x654e82bb
xor eax, 0xd2e8731c
mov r9d, 0x7de83528
sub r9, r8
movabs rdx, 0x11ffbba75b74282b
imul r9, rdx
mov rdx, r9
rol rdx, 4
xor rdx, r9
mov r9, rdx
rol r9, 5
cmp eax, 0x6ae12941
jae 0x1802f82b6
jmp 0x1802f8252
mov eax, dword [0x18077eb20]
xor eax, dword [0x18077eb24]
sub eax, 0x4e95bbd1
imul eax, eax, 0x1084fadf
xor eax, 0x385ff5d0
cmp eax, 0xfc3510a9
je 0x1802f82c3
jmp 0x1802f8277
mov eax, dword [0x18077eb28]
add eax, dword [0x18077eb2c]
imul r8d, eax, 0xeb52ac7f
or r8d, 0x45d7e552
xor r8d, 0x666c1856
mov rax, r9
xor rax, rdx
cmp r8d, 0x336b23da
jb 0x1802f8277
jg 0x1802f8234
push rdx
jmp 0x1802f82cc
jmp 0x1802f82a9
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
jrcxz 0x1802f8286
invalid
add byte [rax], bl
ret 0xaf7c
pop rax
invalid

Function at 0x1802f88b0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077ebb0]
imul eax, dword [0x18077ebb4]
xor eax, 0x6538f9ed
xor eax, 0xa31d7c6e
mov r9d, 0x80962dbd
xor edx, edx
div r9d
cmp eax, 0xfd31f324
ja 0x1802f893c
jmp 0x1802f88de
mov eax, dword [0x18077ebb8]
xor eax, dword [0x18077ebbc]
add eax, 0x83da51f4
and eax, 0x7cc1e786
mov r9d, 0x72d7e236
xor edx, edx
div r9d
imul rdx, r8, 0xffffffffe9217f9d
cmp eax, 0x436b4360
je 0x1802f88de
jmp 0x1802f890f
xor rdx, 0xffffffff870e69b6
mov rax, rdx
shr rax, 0x16
xor rax, rdx
xor edx, edx
sub rdx, rax
mov rax, rdx
rol rax, 5
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
add byte [rax], r10b
retf
Function at 0x1802f90c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
imul rax, rdx, 0xffffffffd4f00a60
add rax, 0xffffffffc7da330c
xor rax, 0x3e67a99
add rax, 0x4dcab51e
mov r8, rax
rol r8, 7
xor r8, rax
and r8, 0xffff
mov eax, dword [0x18077ec80]
imul eax, dword [0x18077ec84]
and eax, 0xecd86140
mov r9d, 0x5f000842
xor edx, edx
div r9d
and eax, 0x54603d1d
cmp eax, 0x88d8ee0f
jae 0x1802f9143
jmp 0x1802f9115
mov eax, dword [0x18077ec88]
sub eax, dword [0x18077ec8c]
or eax, 0x2e0cc8b6
imul edx, eax, 0x63030942
xor edx, 0x4292d88c
mov rax, rcx
add rax, r8
cmp edx, 0x2e5cca1b
ja 0x1802f9115
jmp 0x1802f9142
ret
outsd dx, dword [rsi]
out dx, al
nop
xchg esi, eax
fist word [rcx + 0x64]
mov byte [rsp + rcx*8], bl
stosb byte [rdi], al
pop rdx
jmp 0x1802f9113

Function at 0x1802f9bf0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077ed90]
sub eax, dword [0x18077ed94]
sub eax, 0x9ab6d213
imul eax, eax, 0x21d84d11
sub eax, 0xce7c4e8d
cmp eax, 0x90a32d76
je 0x1802f9ccb
mov eax, dword [0x18077ed98]
and eax, dword [0x18077ed9c]
mov r9d, 0x16e3f122
xor edx, edx
div r9d
xor eax, 0x922b36bc
or eax, 0x4bf24ef5
mov rdx, r8
add rdx, 0x3acbe837
xor rdx, 0x1d690430
imul rdx, rdx, 0xffffffffbc59bb62
add rdx, 0x352b6e28
cmp eax, 0x8d86f822
je 0x1802f9ccb
jmp 0x1802f9c63
mov r8, rdx
rol r8, 1
xor r8, rdx
mov eax, dword [0x18077eda0]
xor eax, dword [0x18077eda4]
add eax, 0x886cd221
and eax, 0xc90f0c99
and eax, 0x87c93462
cmp eax, 0xe2bd2215
ja 0x1802f9cd8
jmp 0x1802f9c90
mov eax, dword [0x18077eda8]
xor edx, edx
div dword [0x18077edac]
mov edx, eax
xor edx, 0x71c69c3c
or edx, 0xe663f4e7
and edx, 0xf7760697
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x649e31f5
jbe 0x1802f9c90
ret
sub byte [rax + rdx*8 - 0xd41cbce], ch
push 0xffffffffffffffe9
invalid
imul edi, dword [rcx], 0xeaa017a3
invalid

Function at 0x1802fa040
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
sub rax, rdx
xor rax, 0x64c74029
imul r8, rax, 0xffffffffa4f8230c
add r8, 0xffffffffc0c5cb95
mov eax, dword [0x18077ee10]
xor edx, edx
div dword [0x18077ee14]
sub eax, 0x89d59d62
add eax, 0x889af287
or eax, 0x924c8dbc
cmp eax, 0x5236c346
jbe 0x1802fa0bf
jmp 0x1802fa07f
mov eax, dword [0x18077ee18]
imul eax, dword [0x18077ee1c]
add eax, 0xe029d5f
imul edx, eax, 0xad04c5b7
add edx, 0x770ef5ff
mov r9, r8
rol r9, 3
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xb45638a9
ja 0x1802fa07f
jmp 0x1802fa0be
ret
std
invalid
Function at 0x1802fb170
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x3a07c0dd
sub rax, rdx
mov rdx, rax
shr rdx, 0x1b
mov r8d, dword [0x18077efc0]
sub r8d, dword [0x18077efc4]
and r8d, 0x64d0cbee
sub r8d, 0x1e6137a5
imul r8d, r8d, 0x4e30cad8
cmp r8d, 0x2f884b9d
jbe 0x1802fb257
mov r10d, dword [0x18077efc8]
xor r10d, dword [0x18077efcc]
sub r10d, 0x41fefd55
or r10d, 0x8ac6e1da
or r10d, 0x12e26e21
mov r9, rdx
xor r9, rax
mov r8, r9
shr r8, 0x1c
xor r8, r9
mov r9, r8
rol r9, 4
cmp r10d, 0xf1053d80
jae 0x1802fb257
jmp 0x1802fb1f4
mov eax, dword [0x18077efd0]
add eax, dword [0x18077efd4]
mov r10d, 0xe5d3e322
xor edx, edx
div r10d
imul eax, eax, 0xd561f99
sub eax, 0xbe342e56
cmp eax, 0xbbe44962
jae 0x1802fb264
jmp 0x1802fb21f
mov eax, dword [0x18077efd8]
sub eax, dword [0x18077efdc]
and eax, 0x3c265e07
xor eax, 0xa3ef0b0b
imul edx, eax, 0xfaaeed97
mov r10, r9
xor r10, r8
and r10, 0xffff
mov rax, rcx
mov eax, ecx
add rax, r10
cmp edx, 0x515e43a
jbe 0x1802fb21f
ret
sub eax, 0x201b26db
jrcxz 0x1802fb2cc
jmp 0x1802fb249
or eax, 0x16fb1539
sub dword [rsi], ecx
retfq 0xffffffffffff82df
scasb al, byte [rdi]
mov r9, rdx
add r9, 0x33d31f01
mov rcx, r9
rol rcx, 1
xor rcx, r9
cmp r8d, 0x3f542022
jb 0x1802fb311
jmp 0x1802fb2eb
imul rdx, rcx, 0xffffffffaa8519ec
mov rcx, rdx
shr rcx, 6
xor rcx, rdx
mov rdx, rcx
rol rdx, 2
xor rdx, rcx
and rdx, 0xffff
add rax, rdx
ret
mov bl, 0xf6
mov fs, word [rbp + 0x77]
jmp 0x1802fb342
enter 0xffffffffffffccc3, 0xffffffffffffffcc
int3

Function at 0x1802fbdb0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x18077f100]
imul ecx, dword [0x18077f104]
and ecx, 0x2e879ecc
xor ecx, 0xc4c9739f
and ecx, 0x5533952e
cmp ecx, 0xb6630c2f
je 0x1802fbe35
jmp 0x1802fbddc
mov ecx, dword [0x18077f108]
sub ecx, dword [0x18077f10c]
imul ecx, ecx, 0xf6836459
and ecx, 0xda5cb970
imul r8d, ecx, 0x66d32c4e
mov rcx, rdx
xor rcx, 0xffffffff8d1af865
cmp r8d, 0x50b2bef5
ja 0x1802fbddc
jmp 0x1802fbe10
add rcx, 0x43f57ddf
mov rdx, rcx
rol rdx, 6
xor rdx, rcx
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
ret
xor ch, dh
shl dword [rbp + rbx*2 - 0x14ce6a73], 0x9b
int3

Function at 0x1802fc0f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077f160]
or eax, dword [0x18077f164]
imul eax, eax, 0xd3c8492d
add eax, 0xd938fc31
sub eax, 0xa9f223db
cmp eax, 0xe2d7ad99
je 0x1802fc17c
jmp 0x1802fc118
mov eax, dword [0x18077f168]
sub eax, dword [0x18077f16c]
mov r9d, 0xa51f7a14
xor edx, edx
div r9d
or eax, 0x701c8e52
or eax, 0x796af6d3
mov r9d, 0x60a74507
sub r9, r8
rol r9, 3
mov rdx, r8
add rdx, 0xffffffff9f58baf8
xor r9, rdx
mov rdx, r9
rol rdx, 1
xor rdx, r9
cmp eax, 0xe205fb37
ja 0x1802fc118
jmp 0x1802fc165
mov rax, rdx
rol rax, 2
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
ret
Function at 0x1802fc190
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077f170]
imul eax, dword [0x18077f174]
and eax, 0x34d6c8d1
imul eax, eax, 0x28d23b70
sub eax, 0xc1d5ca76
cmp eax, 0x23983caa
je 0x1802fc215
jmp 0x1802fc1b9
mov eax, dword [0x18077f178]
xor eax, dword [0x18077f17c]
xor eax, 0x12f335e0
mov r9d, 0xb4ce5731
xor edx, edx
div r9d
and eax, 0x2354a881
mov rdx, 0xffffffff909c7fd8
sub rdx, r8
cmp eax, 0x4442d517
jae 0x1802fc1b9
jmp 0x1802fc1ed
mov rax, rdx
shr rax, 3
xor rax, rdx
imul rax, rax, 0xffffffffd66065a0
mov rdx, rax
rol rdx, 1
xor rdx, rax
and rdx, 0xffe1
add rcx, rdx
mov rax, rcx
ret
cmp bl, al
push rsi
lahf
pop rbx
jle 0x1802fc26f
xchg eax, ebx
sti
invalid
mov eax, dword [0x18077f188]
add eax, dword [0x18077f18c]
mov r9d, 0x85fb5a21
xor edx, edx
div r9d
imul edx, eax, 0x588d0f46
add edx, 0x74440634
mov rax, 0xffffffff945ea2cf
sub rax, r8
cmp edx, 0x7501e6c2
ja 0x1802fc2b2
jmp 0x1802fc292
mov rdx, rax
shr rdx, 0x1a
xor rdx, rax
mov rax, rdx
rol rax, 1
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
neg byte [rbp + rbx + 0xe31e692]
xchg esp, eax
jmp 0x1802fc25b

Function at 0x1802fc2c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor rdx, 0xffffffffffffffff
mov rax, rdx
rol rax, 2
xor rax, rdx
mov rdx, rax
rol rdx, 2
xor rdx, rax
add rdx, 0x4e8e9ca8
mov r8, rdx
rol r8, 3
xor r8, rdx
mov eax, dword [0x18077f190]
xor edx, edx
div dword [0x18077f194]
sub eax, 0xe64bc844
imul eax, eax, 0x1d599f3d
sub eax, 0x68ba2cd
cmp eax, 0x47db9d40
jbe 0x1802fc34f
jmp 0x1802fc310
mov eax, dword [0x18077f198]
sub eax, dword [0x18077f19c]
xor eax, 0xdad4c0f4
mov r9d, 0x4f15ef54
xor edx, edx
div r9d
mov edx, eax
xor edx, 0x8cc92504
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xa77d5e9d
je 0x1802fc310
jmp 0x1802fc34e
ret
lodsd eax, dword [rsi]
xor byte [rsi + 0x23], dl
or al, 0x7e
push rdx
in al, dx
jmp 0x1802fc30e

Function at 0x1802fc360
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x18077f1a0]
imul ecx, dword [0x18077f1a4]
and ecx, 0xb4ee6744
imul ecx, ecx, 0x76a690e6
add ecx, 0xce451e61
cmp ecx, 0x87926abf
je 0x1802fc3de
jmp 0x1802fc38c
mov r8d, dword [0x18077f1a8]
xor r8d, dword [0x18077f1ac]
or r8d, 0x48034d95
xor r8d, 0xc0024df6
or r8d, 0x98a5dbc3
mov ecx, 0x642c68c6
sub rcx, rdx
cmp r8d, 0xbf24e8a9
je 0x1802fc38c
jmp 0x1802fc3c2
imul rdx, rcx, 0x5e49b4fe
mov rcx, rdx
rol rcx, 7
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
ret
invalid

Function at 0x1802fc3f0
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xb94ba63
imul r8, rdx, 0x249a49f4
mov eax, dword [0x18077f1b0]
and eax, dword [0x18077f1b4]
and eax, 0x462934dd
or eax, 0xb04d33b9
add eax, 0x713ed9ec
cmp eax, 0x4ee47e8c
jb 0x1802fc46e
jmp 0x1802fc422
mov eax, dword [0x18077f1b8]
or eax, dword [0x18077f1bc]
sub eax, 0xd7b210a9
mov r9d, 0xe60004b5
xor edx, edx
div r9d
and eax, 0x15f2bc53
mov r9, r8
xor r9, 0xffffffffa1b33fbe
mov rdx, r9
rol rdx, 4
rol edx, 4
xor rdx, r9
cmp eax, 0x33101c70
jae 0x1802fc422
jmp 0x1802fc460
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
jo 0x1802fc451
int3
Function at 0x1802fc870
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x18077f220]
and ecx, dword [0x18077f224]
sub ecx, 0xef6b6e61
or ecx, 0x3f5913cd
sub ecx, 0xd10ed418
cmp ecx, 0x9f22adab
ja 0x1802fc8eb
jmp 0x1802fc89b
mov ecx, dword [0x18077f228]
xor ecx, dword [0x18077f22c]
or ecx, 0x7bb85a2f
imul r8d, ecx, 0x621061d2
xor r8d, 0xa09a97e4
mov rcx, rdx
xor rcx, 0x7be8199
add rcx, 0xfffffffffa8faaa1
cmp r8d, 0x1bf8c4ef
je 0x1802fc89b
jmp 0x1802fc8d7
mov rdx, rcx
rol rdx, 1
xor rdx, rcx
and rdx, 0xffff
add rax, rdx
ret
movsd dword [rdi], dword [rsi]
sub eax, 0x5d09325
movsb byte [rdi], byte [rsi]
mov esp, 0xf42d22fd
jmp 0x1802fc899

Function at 0x1802fcb00
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077f260]
and eax, dword [0x18077f264]
imul eax, eax, 0x325152cb
mov r9d, 0x51bc5ff5
xor edx, edx
div r9d
or eax, 0x376431d9
cmp eax, 0xb8617e83
je 0x1802fcbd9
jmp 0x1802fcb32
mov eax, dword [0x18077f268]
or eax, dword [0x18077f26c]
xor eax, 0xfefc8433
or eax, 0xfdfe34f1
imul eax, eax, 0x34111f06
mov rdx, r8
add rdx, 0x4dcac2f6
mov r10, rdx
rol r10, 6
xor r10, rdx
xor r9d, r9d
sub r9, r10
cmp eax, 0x1dd6ef8c
jae 0x1802fcb32
jmp 0x1802fcb71
mov eax, dword [0x18077f270]
imul eax, dword [0x18077f274]
mov r8d, 0x18896963
xor edx, edx
div r8d
and eax, 0xab4bebff
xor eax, 0xf5a9acf5
cmp eax, 0x6acd075c
jbe 0x1802fcbea
mov edx, dword [0x18077f278]
or edx, dword [0x18077f27c]
xor edx, 0x2f8492d6
or edx, 0xac8fcec7
add edx, 0x2629be75
mov r8, r9
rol r8, 1
xor r8, r9
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0x4a217e1c
jb 0x1802fcbea
jmp 0x1802fcbd8
ret
jo 0x1802fcbe0
lodsd eax, dword [rsi]
invalid
and al, 0xf9
invalid
scasd eax, dword [rdi]
or al, 0xd9
mov word [rax + 0xd], cs
int 0xeb
cmpsb byte [rsi], byte [rdi]
int3

Function at 0x1802fd3b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xffffffffd77fb191
sub rax, rdx
imul r8, rax, 0xffffffff8904bc73
xor r8, 0x6a0fc2bd
mov eax, dword [0x18077f340]
xor edx, edx
div dword [0x18077f344]
and eax, 0xd87bf0af
mov r9d, 0xe978d18a
xor edx, edx
div r9d
add eax, 0x4f450272
cmp eax, 0x45d058f8
jb 0x1802fd447
jmp 0x1802fd3f4
mov eax, dword [0x18077f348]
xor eax, dword [0x18077f34c]
mov r9d, 0x203261ab
xor edx, edx
div r9d
mov r9d, 0xb7cab3fd
xor edx, edx
div r9d
mov edx, eax
sub edx, 0xf692e6
mov rax, r8
add rax, 0x4a8126ce
mov r9, rax
rol r9, 3
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x6cf8344a
jb 0x1802fd3f4
ret
xchg esp, eax
stc
invalid

Function at 0x1802fd720
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0xffffffffa761d3f4
xor rdx, 0x5fe732fc
mov r8, rdx
rol r8, 4
xor r8, rdx
add r8, 0x28ef13f4
mov eax, dword [0x18077f3a0]
or eax, dword [0x18077f3a4]
and eax, 0xfaac1aa7
add eax, 0x3d0c8c0
add eax, 0x5d49c06f
cmp eax, 0xad40f27e
jb 0x1802fd79f
jmp 0x1802fd763
mov eax, dword [0x18077f3a8]
imul eax, dword [0x18077f3ac]
xor eax, 0x6da00d67
xor eax, 0xe7fd4ae7
imul edx, eax, 0xf6e1eb88
mov r9, r8
rol r9, 1
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xab8d2fb3
je 0x1802fd763
ret
or al, 0x55
pop rdi
mov cl, 0x96
imul esi, esp, 0xccb8ebf0
int3