joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180328cd0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [str._bO]
add eax, dword [0x180783ab4]
xor eax, 0x6d03ae3c
add eax, 0xdf49a64
imul eax, eax, 0xcf66f505
cmp eax, 0x279c5ae4
jb 0x180328e04
jmp 0x180328cfc
mov eax, dword [0x180783ab8]
add eax, dword [0x180783abc]
mov r9d, 0x9d13efec
xor edx, edx
div r9d
and eax, 0xbcab134d
or eax, 0x5ad6365f
mov r9, r8
xor r9, 0xffffffff899bebf1
cmp eax, 0x41b5ea3
jb 0x180328cfc
jmp 0x180328d30
mov eax, dword [0x180783ac0]
xor edx, edx
div dword [0x180783ac4]
imul eax, eax, 0xb7b7d289
add eax, 0x2743ce07
xor eax, 0xac96132c
cmp eax, 0x17521c52
jbe 0x180328e15
jmp 0x180328d5b
mov eax, dword [0x180783ac8]
or eax, dword [0x180783acc]
sub eax, 0xd163f56a
imul eax, eax, 0x1b2262ef
imul eax, eax, 0x9fbd6c0
mov rdx, r9
add rdx, 0x1c70fc54
mov r8, rdx
rol r8, 2
cmp eax, 0x21e9fb84
jb 0x180328d5b
jmp 0x180328d92
mov eax, dword [0x180783ad0]
add eax, dword [0x180783ad4]
xor eax, 0x1d40ddf7
and eax, 0xa310fc1c
or eax, 0xf439b6c4
cmp eax, 0x8c5ca174
jb 0x180328e22
mov eax, dword [0x180783ad8]
add eax, dword [str..__f1]
xor eax, 0x47b3c2cb
imul r9d, eax, 0x3571e0a4
and r9d, 0x834517
mov rax, r8
xor rax, rdx
mov r10, 0xfffffffff125c748
sub r10, rax
mov r11, r10
rol r11, 2
xor r11, r10
and r11, 0xffff
mov rax, rcx
add rax, r11
cmp r9d, 0x5e7a05c1
ja 0x180328e22
ret
mov ebp, 0xf7af2cc9
xchg r11b, spl
xor al, 0xf7
push 0xfffffffffee5e938
invalid
cmp eax, 0xd49fcce2
xchg esi, eax
add cl, byte [rcx]
jmp 0x180328d59
sub al, 0xd7
iretq

Function at 0x1803295f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
movabs rax, 0x1e6bd8d79bfd80
imul r8, rax
add r8, 0x4df14e19
mov r9, r8
rol r9, 1
mov eax, dword [0x180783bc0]
or eax, dword [0x180783bc4]
xor eax, 0x2f3ced1e
add eax, 0x5892d0a4
and eax, 0x1fe8678d
cmp eax, 0x1b714c6e
je 0x18032967c
jmp 0x180329632
mov eax, dword [0x180783bc8]
xor edx, edx
div dword [0x180783bcc]
xor eax, 0x75a14880
mov r10d, 0x6bb3f846
xor edx, edx
div r10d
xor eax, 0xf949eeac
mov r10, r9
xor r10, r8
mov rdx, r10
rol rdx, 6
xor rdx, r10
cmp eax, 0x84824e66
je 0x180329632
jmp 0x18032966e
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
or al, 0xae
or esi, esp
pop rcx
invalid
Function at 0x180329820
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x180783c00]
and eax, dword [0x180783c04]
or eax, 0xce8876f5
or eax, 0xf323aa8a
add eax, 0x932b15c2
cmp eax, 0xef519712
ja 0x1803298ec
jmp 0x180329848
mov eax, dword [0x180783c08]
sub eax, dword [0x180783c0c]
sub eax, 0x41bba172
sub eax, 0x416a18af
or eax, 0x5cccf798
mov r8, rdx
shr r8, 0xc
xor r8, rdx
mov r9d, 0x1c11161e
sub r9, r8
mov r8, r9
rol r8, 1
xor r8, r9
cmp eax, 0x1a6cb5d8
jbe 0x180329848
jmp 0x180329888
and r8, 0xffff
mov eax, dword [0x180783c10]
add eax, dword [0x180783c14]
mov r9d, 0x897eaaca
xor edx, edx
div r9d
imul eax, eax, 0xc5c88ca5
add eax, 0x5ae95558
cmp eax, 0x116f768c
jb 0x1803298fd
jmp 0x1803298ba
mov eax, dword [0x180783c18]
or eax, dword [0x180783c1c]
xor eax, 0x76226300
or eax, 0x6d743302
mov r9d, 0xa4ab91c9
xor edx, edx
div r9d
mov edx, eax
mov rax, rcx
add rax, r8
cmp edx, 0x9cf6ae97
ja 0x1803298ba
ret
xchg edx, eax
cmpsb byte [rsi], byte [rdi]
outsd dx, dword [rsi]
stosb byte [rdi], al
cmp byte [rsp + rbx*2 + 0x1d], dh
xchg esi, eax
xchg esi, eax
cdq
wait
jmp 0x180329846
adc bl, ah
mov ebp, 0x2db865e
movabs dword [0xccccccccccccb1eb], eax
int3

Function at 0x180329c70
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x180783c70]
sub eax, dword [0x180783c74]
sub eax, 0x1b17a36b
or eax, 0x2c2d88
xor eax, 0x63af96d8
cmp eax, 0x201acf7a
jb 0x180329daa
mov r8d, dword [0x180783c78]
imul r8d, dword [0x180783c7c]
sub r8d, 0xfa1965e3
and r8d, 0xae9bcec8
or r8d, 0x4031bca2
mov rax, rdx
shr rax, 0x14
cmp r8d, 0xdf1b67ed
jae 0x180329daa
jmp 0x180329cd0
mov r8d, dword [str.tI]
add r8d, dword [0x180783c84]
and r8d, 0x2095b26b
sub r8d, 0x8f52806a
xor r8d, 0x9d66631c
cmp r8d, 0xf062e629
je 0x180329db7
mov r8d, dword [0x180783c88]
xor r8d, dword [0x180783c8c]
xor r8d, 0xa5752a84
and r8d, 0xae23c54d
imul r9d, r8d, 0xa2f42d40
mov r8, rax
xor r8, rdx
xor r8, 0x76fa8630
mov r10, r8
shr r10, 1
xor r10, r8
mov r8, r10
rol r8, 1
xor r8, r10
cmp r9d, 0x88a9029f
jae 0x180329db7
jmp 0x180329d4d
mov eax, dword [0x180783c90]
or eax, dword [0x180783c94]
imul eax, eax, 0x8dc9ff1a
and eax, 0x813aaadf
imul eax, eax, 0xa7a7c7a5
cmp eax, 0x706b561b
je 0x180329dc4
jmp 0x180329d73
mov edx, dword [0x180783c98]
or edx, dword [0x180783c9c]
and edx, 0xbb77feb7
and edx, 0xabdfd70d
xor edx, 0xc7076227
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xdde5bf5d
je 0x180329d73
ret
pop rdi
cld
cmc
mov cl, byte [0x1697fbaff]
invalid
ja 0x180329e1c
jl 0x180329e13
push 0x55
jmp 0x180329d00
wait
xlatb
out 0xcd, eax
or byte [rbp + 0x4a], bl
pop rdi
invalid
mov dl, 0x4e
and eax, 0x7d1e558e
cmp eax, 0x29a5d789
ja 0x180329e53
xlatb
movsd dword [rdi], dword [rsi]
sub dword [rdi + 0x32], esi
mov eax, dword [0x180783ca8]
or eax, dword [0x180783cac]
mov r9d, 0x40c04ac0
xor edx, edx
div r9d
imul edx, eax, 0x4f213cca
and edx, 0xe6f1351a
mov rax, rcx
add rax, r8
cmp edx, 0xe0470379
ja 0x180329e53
ret
jmp 0x19bcd8f22
Function at 0x18032a6e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x180783da0]
and eax, dword [0x180783da4]
and eax, 0x3093d2ce
sub eax, 0x37c7b80d
xor eax, 0x4aca02ce
cmp eax, 0xda6fcd62
je 0x18032a811
jmp 0x18032a708
mov r8d, dword [0x180783da8]
add r8d, dword [0x180783dac]
and r8d, 0xb0d9f40e
add r8d, 0xe8cc2da
and r8d, 0x2989ebe1
mov r9, rdx
shr r9, 3
xor r9, rdx
xor r9, 0xffffffffa553b147
mov rax, r9
rol rax, 3
xor rax, r9
cmp r8d, 0x1f545dfe
jbe 0x18032a708
jmp 0x18032a751
mov edx, dword [0x180783db0]
sub edx, dword [0x180783db4]
imul edx, edx, 0x9412c9f
sub edx, 0x7271d288
imul edx, edx, 0x604165f8
cmp edx, 0x5d09637a
jb 0x18032a822
jmp 0x18032a77d
mov edx, dword [0x180783db8]
or edx, dword [0x180783dbc]
xor edx, 0x18dc845d
and edx, 0x81e5f998
xor edx, 0x958e97e8
xor r8d, r8d
sub r8, rax
cmp edx, 0x528c916
je 0x18032a77d
jmp 0x18032a7ab
mov eax, dword [0x180783dc0]
and eax, dword [0x180783dc4]
or eax, 0x552f15d0
or eax, 0xe6044eef
and eax, 0x6652541c
cmp eax, 0xc7596d4e
je 0x18032a82f
mov eax, dword [0x180783dc8]
sub eax, dword [0x180783dcc]
add eax, 0x96b34187
mov r9d, 0x34ea7a41
xor edx, edx
div r9d
mov edx, eax
xor edx, 0x441c11c0
mov r9, r8
rol r9, 2
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x84934900
je 0x18032a82f
ret
mov edx, 0x72c9fad7
fnsave dword [rsi - 0x54]
jg 0x18032a823
mov sil, 0xe9
in al, 0xfe
invalid
mov edx, 0x933956d7
test byte [rdi], bl
mov cl, ch
xlatb
push rsi
cmp dword [rbx - 0x1677e07c], edx
invalid
loopne 0x18032a898
sub dword [rax], ebx
cld
push rsi
imul esp, dword [rbx], 0xffffffeb
xchg esp, eax
int3
ror byte [rax + 0x25], 0xff
inc dword [rax]
add byte [rcx + 0x30fc8ffa], al
xor dh, byte [rdx - 0x2f]

Function at 0x18032a9e0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, 0x7c145e2a
sub r8, rdx
xor r8, 0xd6c5c74
mov eax, dword [0x180783e00]
imul eax, dword [0x180783e04]
mov r9d, 0xe7de734e
xor edx, edx
div r9d
or eax, 0x750d341b
mov r9d, 0xe4286433
xor edx, edx
div r9d
cmp eax, 0xc83e68ed
je 0x18032aac6
mov eax, dword [0x180783e08]
imul eax, dword [0x180783e0c]
sub eax, 0x3dcee1c5
xor eax, 0x575677d0
mov r9d, 0x7eb72d6f
xor edx, edx
div r9d
mov rdx, r8
add rdx, 0xffffffffc748d282
mov r9, rdx
rol r9, 1
xor r9, rdx
cmp eax, 0x3ff6f586
ja 0x18032aac6
jmp 0x18032aa61
mov eax, dword [0x180783e10]
xor edx, edx
div dword [0x180783e14]
and eax, 0x7960250c
imul eax, eax, 0x3a181d7e
and eax, 0x110732ec
cmp eax, 0x2cf63538
ja 0x18032aad7
jmp 0x18032aa88
mov eax, dword [0x180783e18]
or eax, dword [0x180783e1c]
mov r8d, 0xd465c161
xor edx, edx
div r8d
mov edx, eax
add edx, 0xf28cc720
xor edx, 0xb5b39b8
mov r8, r9
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0xcdaa761a
jb 0x18032aa88
ret
invalid
and bl, byte [rdx + 0x89423ef]
invalid
Function at 0x18032abe0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0x260b075f
mov eax, dword [0x180783e30]
xor edx, edx
div dword [0x180783e34]
xor eax, 0x8038122f
sub eax, 0x3a7c4619
or eax, 0x820c2c07
cmp eax, 0x8eef3798
jb 0x18032ac68
jmp 0x18032ac10
mov eax, dword [0x180783e38]
xor edx, edx
div dword [0x180783e3c]
imul eax, eax, 0xe806c0f9
imul eax, eax, 0x876cfac9
mov r9d, 0xd7f2a89a
xor edx, edx
div r9d
mov rdx, r8
shr rdx, 1
xor rdx, r8
cmp eax, 0x4e0ff94
je 0x18032ac10
jmp 0x18032ac47
mov rax, rdx
shr rax, 9
xor rax, rdx
mov rdx, rax
rol rdx, 1
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
adc ah, byte [rax]
sal byte [rcx - 0x31], cl
or dl, byte [rbx + 0x6aa57a6f]
out dx, al
jmp 0x18032ac0e

Function at 0x18032adc0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180783e60]
add eax, dword [0x180783e64]
add eax, 0x893c9110
mov r9d, 0xc7a38c0a
xor edx, edx
div r9d
add eax, 0xc207ecc8
cmp eax, 0xe4219d4c
ja 0x18032ae44
jmp 0x18032aded
mov edx, dword [0x180783e68]
add edx, dword [0x180783e6c]
or edx, 0x88ec87b7
xor edx, 0x26d3c3ca
xor edx, 0xdbe3d0b
mov rax, 0xffffffffaf55c777
sub rax, r8
xor rax, 0xffffffffc757101f
cmp edx, 0xd3fcb10a
ja 0x18032aded
jmp 0x18032ae25
imul rax, rax, 0xfffffffff9717dce
mov rdx, rax
rol rdx, 6
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
cmp edx, eax
mov dword [rdx + 0x28], esi
fcomi st(4)
adc eax, 0x17e755da
jmp 0x18032adeb

Function at 0x18032ae60
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0xfffffffff3350477
mov r9, rdx
rol r9, 6
xor r9, rdx
mov eax, dword [0x180783e70]
xor eax, dword [0x180783e74]
or eax, 0x42607dd6
mov r8d, 0x6735170f
xor edx, edx
div r8d
add eax, 0xd91a6914
cmp eax, 0x62153e44
jb 0x18032af23
jmp 0x18032ae9f
mov eax, dword [0x180783e78]
sub eax, dword [0x180783e7c]
or eax, 0x18944735
imul eax, eax, 0xc74b48cc
xor eax, 0x6f3ec717
mov rdx, r9
and rdx, 0xffff
mov r8, rcx
add r8, rdx
cmp eax, 0xa60faa5e
je 0x18032ae9f
jmp 0x18032aed4
mov eax, dword [0x180783e80]
add eax, dword [0x180783e84]
mov ecx, 0xc922ff23
xor edx, edx
div ecx
xor eax, 0xd15e70b1
xor eax, 0x32188a3e
cmp eax, 0x2d7314fa
jbe 0x18032af30
jmp 0x18032aefc
mov eax, dword [0x180783e88]
or eax, dword [0x180783e8c]
imul eax, eax, 0x1e9e1054
or eax, 0xbd0c1343
or eax, 0xe8e01977
cmp eax, 0x55210bef
jb 0x18032aefc
mov rax, r8
ret
popfq
invalid
insd dword [rdi], dx
push 0xebecd76
xor byte [rbx + rbp*8 - 0x33333340], bl
int3
Function at 0x18032b110
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180783eb0]
sub eax, dword [0x180783eb4]
imul eax, eax, 0xd0ef5c2d
xor eax, 0xe3fdf052
xor eax, 0x256ee18
cmp eax, 0x1a45844
je 0x18032b244
mov eax, dword [0x180783eb8]
or eax, dword [0x180783ebc]
xor eax, 0x90b7bfd3
xor eax, 0xf1cc2c4f
mov r9d, 0x97196859
xor edx, edx
div r9d
movabs rdx, 0xecfb49c22cacf94d
mov r9, r8
imul r9, rdx
movabs rdx, 0xe6bcfb367b2cdc7e
add r9, rdx
mov r10, r9
rol r10, 5
cmp eax, 0x235cafe2
ja 0x18032b244
jmp 0x18032b18d
mov eax, dword [0x180783ec0]
imul eax, dword [0x180783ec4]
and eax, 0x41dc423
mov r8d, 0x45d67874
xor edx, edx
div r8d
and eax, 0xcfb989c
cmp eax, 0x9c538010
jae 0x18032b251
jmp 0x18032b1bc
mov eax, dword [0x180783ec8]
sub eax, dword [0x180783ecc]
imul eax, eax, 0x59b29c67
imul edx, eax, 0x6743db46
and edx, 0xf7d030f7
mov r8, r10
xor r8, r9
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0x85f680c6
ja 0x18032b1bc
jmp 0x18032b1f7
mov ecx, dword [str.0JY_]
or ecx, dword [0x180783ed4]
sub ecx, 0x35abc7d4
imul ecx, ecx, 0x5466f8b8
and ecx, 0xb8c4045a
cmp ecx, 0x78fb6116
jb 0x18032b262
mov ecx, dword [0x180783ed8]
add ecx, dword [0x180783edc]
xor ecx, 0x7e6d1c13
xor ecx, 0xfc716a98
or ecx, 0xa0c06cd6
cmp ecx, 0x380d025e
jbe 0x18032b262
leave
invalid
ret
cmp dword [0x19a7898d9], 0xffffffdb
out 0x45, al
sbb bl, bl
jae 0x18032b236
jmp 0x14232b250
sal ecx, 0xe6
fist word [rcx - 0x10cf9d69]
jb 0x18032b247
pop rax
invalid
xor dword [rbx - 0x3d], r15d
cmpsb byte [rsi], byte [rdi]
popfq
rcr byte [rbx + rbp*8 - 0x3333334f], 1
int3

Function at 0x18032b560
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180783f30]
xor eax, dword [0x180783f34]
and eax, 0x86a0c1b7
mov r9d, 0xcf13d8ce
xor edx, edx
div r9d
and eax, 0x34992a2
cmp eax, 0xe1df433a
ja 0x18032b5e5
jmp 0x18032b58d
mov eax, dword [0x180783f38]
imul eax, dword [0x180783f3c]
imul eax, eax, 0xcb0fadeb
xor eax, 0xe8b9bec5
mov r9d, 0x470d4066
xor edx, edx
div r9d
imul rdx, r8, 0x24d62b1e
add rdx, 0x24d62b1e
cmp eax, 0x31ca14f
jae 0x18032b58d
jmp 0x18032b5c7
xor rdx, 0x33f9235c
mov rax, rdx
rol rax, 4
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
fnsave dword [rbx]
xor ah, dh
fcomp dword [rsi]
invalid

Function at 0x18032b840
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0xffffffffb75bb301
mov eax, dword [0x180783f80]
add eax, dword [0x180783f84]
sub eax, 0x2c18c0d
or eax, 0xde044827
mov r9d, 0x6fca904a
xor edx, edx
div r9d
cmp eax, 0x4dd8f770
jae 0x18032b8c1
jmp 0x18032b874
mov eax, dword [0x180783f88]
xor edx, edx
div dword [0x180783f8c]
xor eax, 0xb98467ca
xor eax, 0xd95fdc9f
or eax, 0xe637f295
mov r9, r8
out 0x4d, al
mov ecx, eax
rol r9, 5
xor r9, r8
xor edx, edx
sub rdx, r9
mov r9, rdx
rol r9, 2
cmp eax, 0x1d015cc3
je 0x18032b874
jmp 0x18032b8b0
xor r9, rdx
and r9, 0xffff
add rcx, r9
mov rax, rcx
ret
jne 0x18032b8cc
xchg dword [rcx + rcx*4], edi
ja 0x18032b890
retf
hlt
Function at 0x18032c270
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xfffffffff0b5d095
sub rax, rdx
xor rax, 0xffffffffa3e4b339
mov r8, rax
rol r8, 2
xor r8, rax
add r8, 0xffffffff8577eb69
mov rdx, r8
rol rdx, 6
xor rdx, r8
and rdx, 0xffff
mov eax, dword [0x180784080]
xor eax, dword [0x180784084]
imul eax, eax, 0x53d1002b
add eax, 0x660a3efa
or eax, 0x805bba2e
cmp eax, 0x6ac07450
jb 0x18032c2fa
jmp 0x18032c2c7
mov r8d, dword [0x180784088]
add r8d, dword [0x18078408c]
add r8d, 0x76e2d2a0
xor r8d, 0xd22f7132
and r8d, 0x6284f77d
mov rax, rcx
add rax, rdx
cmp r8d, 0x66dfea1b
je 0x18032c2c7
ret
out 0xfb, al
invalid

Function at 0x18032c310
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x180784090]
and eax, dword [0x180784094]
imul eax, eax, 0x4514bd0a
or eax, 0xbb2108f9
xor eax, 0xb0aee05d
cmp eax, 0x2e5ddb5c
jbe 0x18032c3d0
mov r9d, dword [0x180784098]
imul r9d, dword [0x18078409c]
add r9d, 0x66868b2a
xor r9d, 0xda7a3009
add r9d, 0xe48d83ea
imul rax, rdx, 0x4aef6eb0
mov r8, rax
rol r8, 4
cmp r9d, 0x2fc833b3
jb 0x18032c3d0
jmp 0x18032c374
xor r8, rax
and r8, 0xffff
mov eax, dword [0x1807840a0]
or eax, dword [0x1807840a4]
sub eax, 0x21516d5
imul eax, eax, 0x197593fe
and eax, 0xc19b8ca8
cmp eax, 0xfffacf9d
je 0x18032c3e1
jmp 0x18032c3a3
mov edx, dword [0x1807840a8]
or edx, dword [0x1807840ac]
sub edx, 0x2e0fd6be
xor edx, 0x574d4fa8
add edx, 0xf5543fac
mov rax, rcx
add rax, r8
cmp edx, 0x37cc8551
jbe 0x18032c3a3
ret
mov edx, 0x6d7e694c
pop rsp
nop
adc eax, 0x48d7f321
jmp 0x18032c337
mov ebp, 0x9b8b60d2
retf

Function at 0x18032caf0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
mov rdx, rcx
shr rdx, 0x1a
xor rcx, rdx
xor rcx, 0xfffffffffd9fedc4
mov rdx, rcx
shr rdx, 7
xor rdx, rcx
mov rcx, rdx
rol rcx, 7
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
mov ecx, dword [0x180784160]
xor ecx, dword [0x180784164]
add ecx, 0xad09b82e
add ecx, 0x86d629cd
or ecx, 0xd3ad971f
cmp ecx, 0x676468f1
je 0x18032cb7a
jmp 0x18032cb53
mov ecx, dword [0x180784168]
or ecx, dword [0x18078416c]
imul ecx, ecx, 0x6c0dffa0
xor ecx, 0x456ae998
sub ecx, 0xc15be22
cmp ecx, 0x3140c371
jb 0x18032cb53
ret
hlt

Function at 0x18032d670
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0xffffffffe899113e
mov ecx, dword [0x1807842b0]
add ecx, dword [0x1807842b4]
or ecx, 0x15e6f80d
xor ecx, 0xf91d35e
add ecx, 0x2d2ddda7
cmp ecx, 0xdaad71d6
jae 0x18032d700
jmp 0x18032d6a2
mov ecx, dword [0x1807842b8]
and ecx, dword [0x1807842bc]
add ecx, 0xf73f431
imul r8d, ecx, 0xa134a6f7
xor r8d, 0x70dc5277
imul rcx, rdx, 0x6fe5e633
movabs r9, 0xff7a579dd4f6af07
add rcx, r9
mov r9, rcx
shr r9, 0x1a
xor r9, rcx
mov rcx, r9
rol rcx, 4
xor rcx, r9
and rcx, 0xffff
cmp r8d, 0x707dc11c
jb 0x18032d6a2
jmp 0x18032d6fc
add rax, rcx
ret
invalid
Function at 0x18032dda0
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xffffffffa89bb0ea
sub rax, rdx
mov rdx, rax
rol rdx, 6
xor rdx, rax
add rdx, 0xffffffff98eb5677
mov eax, dword [0x180784320]
xor eax, dword [0x180784324]
imul eax, eax, 0x4aaf64c2
and eax, 0x575c2ea8
add eax, 0x6eb89455
cmp eax, 0x8ce0447c
jb 0x18032de25
jmp 0x18032dde0
mov r8d, dword [0x180784328]
imul r8d, dword [0x18078432c]
xor r8d, 0xd7d7e267
add r8d, 0x85ed634f
sub r8d, 0xaa676f49
mov r9, rdx
rol r9, 5
xor r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0x642c81b6
ja 0x18032dde0
ret
or eax, 0x488708b0
retf

Function at 0x18032e3f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1807843c0]
or eax, dword [0x1807843c4]
add eax, 0xd515c562
mov r9d, 0x7fd0240f
xor edx, edx
div r9d
imul eax, eax, 0xc4f1bf2a
cmp eax, 0xef4818c4
jae 0x18032e478
jmp 0x18032e41e
mov eax, dword [0x1807843c8]
add eax, dword [0x1807843cc]
or eax, 0x7e786557
sub eax, 0xa2cd906b
mov r9d, 0x8f1f4634
xor edx, edx
div r9d
imul rdx, r8, 0x57790701
add rdx, 0xfffffffff7ca9008
mov r9, rdx
shr r9, 0x1a
xor r9, rdx
mov rdx, r9
rol rdx, 6
xor rdx, r9
cmp eax, 0x905c2ae8
jae 0x18032e41e
jmp 0x18032e46a
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
retf

Function at 0x18032e820
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
add r8, 0x44d75723
mov eax, dword [0x180784420]
sub eax, dword [0x180784424]
add eax, 0xa9115fff
xor eax, 0x9ad30ce4
or eax, 0xc09cbe98
cmp eax, 0x1b8f71a6
je 0x18032e8af
jmp 0x18032e84e
mov eax, dword [0x180784428]
add eax, dword [0x18078442c]
mov r9d, 0x56879530
xor edx, edx
div r9d
mov r9d, 0xc31af05a
xor edx, edx
div r9d
sub eax, 0xb86a075b
mov rdx, r8
xor rdx, 0x5088a235
mov r9, rdx
shr r9, 0x14
xor r9, rdx
xor r10d, r10d
sub r10, r9
mov rdx, r10
rol rdx, 1
xor rdx, r10
cmp eax, 0xeab2c141
ja 0x18032e84e
jmp 0x18032e8a1
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
pop rsp
sbb ecx, dword [rbp + 0x52]
in eax, 0xaa
jns 0x18032e92b
jmp 0x18032e84c
jmp fcn.18032e8ae

Function at 0x18032f020
Capabilities:
Encode data using xor

Disassembly:
imul rax, rdx, 0x495ff818
movabs rdx, 0x1246914d93062c58
add rax, rdx
mov rdx, rax
rol rdx, 1
xor rdx, rax
mov r8, 0xffffffff93d91a89
sub r8, rdx
mov r9, r8
rol r9, 7
mov eax, dword [0x1807844d0]
sub eax, dword [0x1807844d4]
xor eax, 0x96ff9ba0
or eax, 0xc0414cd1
add eax, 0x4620c328
cmp eax, 0x8e101397
jae 0x18032f0b0
jmp 0x18032f072
mov eax, dword [0x1807844d8]
or eax, dword [0x1807844dc]
add eax, 0xa649b2fb
mov r10d, 0x73bcf7da
xor edx, edx
div r10d
or eax, 0xb1bbc1aa
mov rdx, r9
xor rdx, r8
cmp eax, 0x63cd12e6
jb 0x18032f072
jmp 0x18032f0a2
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
xchg ebx, eax
and dword [rax + rbx*8], esi
mov sp, word [rax - 0x33334915]
int3
Function at 0x18032f1f0
Capabilities:
Encode data using xor

Disassembly:
movabs rax, 0x8f0bb144
add rdx, rax
mov r8, rdx
rol r8, 6
xor r8, rdx
mov eax, dword [0x180784500]
xor edx, edx
div dword [0x180784504]
sub eax, 0xbf40f0e5
and eax, 0x6153cb1e
imul eax, eax, 0x83f6ce69
cmp eax, 0xbf60ed1
je 0x18032f265
jmp 0x18032f22e
mov edx, dword [0x180784508]
xor edx, dword [0x18078450c]
or edx, 0x413305ce
or edx, 0x1d88f48e
xor edx, 0x1b660da7
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x50c1dc1e
jbe 0x18032f22e
ret
movabs dword [0xf8da8b986b19e06f], eax
sar ecx, 1
enter 0xffffffffffffb9eb, 0xffffffffffffffcc
int3

Function at 0x18032fb40
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180784600]
xor eax, dword [0x180784604]
sub eax, 0x26657475
xor eax, 0x2670058b
mov r9d, 0x972dfd32
xor edx, edx
div r9d
cmp eax, 0xcec65e5c
jae 0x18032fc23
jmp 0x18032fb71
mov eax, dword [0x180784608]
xor eax, dword [0x18078460c]
imul eax, eax, 0xc4111a1e
mov r9d, 0xf1d1966b
xor edx, edx
div r9d
add eax, 0x61104aa5
mov r9, r8
xor r9, 0xffffffffffffffff
rol r9, 6
cmp eax, 0x6a77cfe5
jae 0x18032fb71
jmp 0x18032fba7
xor r9, r8
xor r9, 0x2ad612c5
mov eax, dword [0x180784610]
imul eax, dword [0x180784614]
and eax, 0xd76e5743
mov r8d, 0x494cfb26
xor edx, edx
div r8d
or eax, 0xe12845f5
cmp eax, 0xd1d2ad8b
jbe 0x18032fc34
jmp 0x18032fbdc
mov edx, dword [0x180784618]
imul edx, dword [0x18078461c]
and edx, 0x337d3e0b
or edx, 0x577c1802
or edx, 0x1676e372
mov rax, r9
add rax, 0x51023715
mov r8, rax
rol r8, 1
xor r8, rax
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0x83681487
je 0x18032fbdc
ret
invalid
xchg esi, eax
sbb dh, 0x62
sbb al, 0x5a
je 0x18032fc44
mov al, 0xd2
iretd
int3

Function at 0x180330370
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
rol r8, 1
xor r8, rdx
mov eax, dword [0x1807846e0]
imul eax, dword [0x1807846e4]
imul eax, eax, 0x3ff56158
xor eax, 0x3795dc34
mov r9d, 0x97db5f2c
xor edx, edx
div r9d
cmp eax, 0xc5aa6a8e
je 0x1803303f5
jmp 0x1803303a5
mov eax, dword [0x1807846e8]
or eax, dword [0x1807846ec]
or eax, 0x67872db5
add eax, 0xd2deff50
imul edx, eax, 0x95b5c827
mov rax, r8
rol rax, 7
xor rax, r8
mov r9d, 0x6e97b378
sub r9, rax
mov rax, r9
rol rax, 4
xor rax, r9
cmp edx, 0xd131de12
jae 0x1803303a5
jmp 0x1803303e8
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
test al, 0x59
invalid
Function at 0x180330650
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffff87da61b7
imul rax, rdx, 0x1baf450e
mov edx, dword [0x180784710]
and edx, dword [0x180784714]
imul edx, edx, 0xccccb402
sub edx, 0xfb2fce99
xor edx, 0xddeaf902
cmp edx, 0x7e2c5dcf
jae 0x180330725
jmp 0x18033068a
mov edx, dword [0x180784718]
add edx, dword [0x18078471c]
xor edx, 0x2c3c5b08
xor edx, 0xd2243956
or edx, 0x1be5d6f
mov r8, rax
xor r8, 0x7fc62d15
mov r9, r8
rol r9, 3
xor r9, r8
and r9, 0xffff
mov r8, rcx
add r8, r9
cmp edx, 0xe96910d5
jae 0x18033068a
jmp 0x1803306d3
mov eax, dword [0x180784720]
xor eax, dword [0x180784724]
and eax, 0xea4f419d
mov ecx, 0xb040bff2
xor edx, edx
div ecx
add eax, 0x9fbc39f3
cmp eax, 0x17c9f3f3
je 0x180330736
jmp 0x1803306fb
mov eax, dword [0x180784728]
xor edx, edx
div dword [0x18078472c]
and eax, 0x71bf090d
imul eax, eax, 0xea68498b
imul eax, eax, 0x7739e71d
cmp eax, 0x88b9cda9
je 0x1803306fb
mov rax, r8
ret
adc dl, byte [rax + riz*4]
invalid
mov al, 0x51
pop rcx
lodsd eax, dword [rsi]
or eax, 0xebfc6885
mov ecx, 0x8bd08949
mov r8, rdx
mov eax, dword [0x180784730]
add eax, dword [0x180784734]
or eax, 0x457302df
add eax, 0x16cd8b79
xor eax, 0xab97d709
cmp eax, 0x60b71b88
ja 0x1803307c7
mov eax, dword [0x180784738]
xor edx, edx
div dword [0x18078473c]
imul edx, eax, 0xf8e5496b
or edx, 0x78a03f3
sub edx, 0xc147acd2
mov rax, r8
add rax, 0xffffffffa46ecbfb
mov r9, rax
shr r9, 0x1a
xor rax, r9
movabs r9, 0x3ff1a4834c
xor rax, r9
cmp edx, 0xa95c7055
je 0x1803307c7
jmp 0x1803307af
mov rdx, rax
rol rdx, 4
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
adc edx, edi
out 2, al
push rsp
stosd dword [rdi], eax
mov ecx, 0xcc94ebb7
int3

Function at 0x180330810
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0x1c3e213f
mov rcx, rdx
rol rcx, 3
xor rcx, rdx
imul rcx, rcx, 0x14936136
mov edx, dword [0x180784740]
imul edx, dword [0x180784744]
imul edx, edx, 0x988a460b
or edx, 0x9b1d6bc9
sub edx, 0xd45d8711
cmp edx, 0x488641ef
jae 0x18033089d
jmp 0x180330854
mov edx, dword [0x180784748]
and edx, dword [0x18078474c]
imul edx, edx, 0x7b935c1f
xor edx, 0xf20bf43f
imul r9d, edx, 0xeda04708
mov r8, rcx
add r8, 0x1a3c2509
mov rdx, r8
rol rdx, 4
cmp r9d, 0xd4fe697f
jae 0x180330854
jmp 0x18033088f
xor rdx, r8
and rdx, 0xffff
add rax, rdx
ret
imul ebp, dword [rbp - 0x223cf009], 0xabeb1256
int3