joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801cc3f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
imul rdx, rdx, 0xffffffffdfea96e8
movabs rcx, 0x826ffb92
add rdx, rcx
mov rcx, rdx
shr rcx, 0x18
xor rcx, rdx
mov rdx, rcx
rol rdx, 6
mov r8d, dword [0x1805175d8]
or r8d, dword [0x1805175dc]
add r8d, 0x1f1111b
sub r8d, 0xf6f59836
and r8d, 0xd20da6c7
cmp r8d, 0x1f22d843
jbe 0x1801cc485
jmp 0x1801cc446
mov r9d, dword [0x1805175e0]
and r9d, dword [0x1805175e4]
sub r9d, 0x696897fc
and r9d, 0x22e50f76
and r9d, 0x9d72207c
mov r8, rdx
xor r8, rcx
cmp r9d, 0xa1da048b
ja 0x1801cc446
jmp 0x1801cc47a
and r8, 0xffff
add rax, r8
ret
std
invalid

Function at 0x1801cd3d0
Capabilities:
Check for software breakpoints
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movabs rax, 0xca836d73
add rdx, rax
xor rdx, 0x4012c039
mov r8, rdx
rol r8, 5
mov eax, dword [0x1805176f8]
sub eax, dword [0x1805176fc]
xor eax, 0xc03401b0
imul eax, eax, 0x614a772a
or eax, 0xa5ec5f15
cmp eax, 0x63c85d19
jbe 0x1801cd453
jmp 0x1801cd410
mov r9d, dword [0x180517700]
imul r9d, dword [0x180517704]
xor r9d, 0x3042e4b1
sub r9d, 0x90946566
or r9d, 0xa57d8166
mov r10, r8
xor r10, rdx
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r9d, 0xd373278
jb 0x1801cd410
jmp 0x1801cd452
ret
invalid

Function at 0x1801cd9a0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov r9, r8
shr r9, 0x17
mov eax, dword [0x180517758]
sub eax, dword [0x18051775c]
add eax, 0xccffb6ec
and eax, 0x72d962cf
sub eax, 0x3e3170b9
cmp eax, 0xc8434a71
je 0x1801cda1f
jmp 0x1801cd9ce
mov eax, dword [0x180517760]
or eax, dword [0x180517764]
xor eax, 0x34485c2d
or eax, 0xb9b6004a
mov r10d, 0x400c5733
xor edx, edx
div r10d
mov rdx, r9
xor rdx, r8
mov r10, 0xffffffffa7e39926
sub r10, rdx
mov rdx, r10
rol rdx, 1
xor rdx, r10
and rdx, 0xffff
cmp eax, 0x73cd5900
je 0x1801cd9ce
jmp 0x1801cda18
add rcx, rdx
mov rax, rcx
ret
idiv byte [rbp + 0x3a]
stosd dword [rdi], eax
cwde
movabs dword [0x9febcd6907e6fa00], eax
int3

Function at 0x1801ceea0
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xffffffff9d4927ba
sub rax, rdx
mov r8, rax
rol r8, 7
xor r8, rax
mov eax, dword [0x1805178a8]
or eax, dword [0x1805178ac]
xor eax, 0x82642f77
or eax, 0xd206d24a
mov r9d, 0x57eeb6c1

Function at 0x1801cfb10
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
movabs rcx, 0xfffffffee53cc68b
add rdx, rcx
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
mov ecx, dword [0x180517958]
or ecx, dword [0x18051795c]
or ecx, 0x691e7cb4
add ecx, 0xe09dea7
or ecx, 0x6180d649
cmp ecx, 0x3954baca
jb 0x1801cfb82
jmp 0x1801cfb5b
mov ecx, dword [str.p_O]
xor ecx, dword [0x180517964]
or ecx, 0x603305f2
and ecx, 0xd6df397e
xor ecx, 0x9a210f2
cmp ecx, 0xe4119519
je 0x1801cfb5b
ret
jmp fcn.1801cfba7
Function at 0x1801cff90
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180517988]
imul eax, dword [0x18051798c]
mov r9d, 0x59251ba1
xor edx, edx
div r9d
add eax, 0x75e8ceb1
and eax, 0xb465576d
cmp eax, 0x3033c095
jb 0x1801d0022
jmp 0x1801cffbe
mov eax, dword [0x180517990]
add eax, dword [0x180517994]
sub eax, 0x30584ecb
mov r9d, 0x7d16096
xor edx, edx
div r9d
and eax, 0x277f34b7
mov r9, r8
xor r9, 0xffffffffa33afb34
add r9, 0x37ed60a8
mov rdx, r9
shr rdx, 4
xor rdx, r9
add rdx, 0x301f2b0f
mov r9, rdx
rol r9, 5
cmp eax, 0xc082a38c
ja 0x1801cffbe
jmp 0x1801d0011
xor r9, rdx
and r9, 0xffff
add rcx, r9
mov rax, rcx
ret
adc al, 0x43
jge 0x1801d0037
xchg esp, esi
iretd
xor al, 0
and eax, dword [0x18051799c]
sub eax, 0x220a3576
and eax, 0xb22e17c7
or eax, 0xe2793144
cmp eax, 0x9fe97e23
je 0x1801d0102
jmp 0x1801d005b
mov eax, dword [0x1805179a0]
and eax, dword [0x1805179a4]
mov r9d, 0x4efd9a4d
xor edx, edx
div r9d
xor eax, 0xd96e603e
add eax, 0x787f58f9
mov rdx, r8
add rdx, 0xfffffffff3a2c3aa
mov r9, rdx
shr r9, 0xa
cmp eax, 0x5ae567b9
jae 0x1801d005b
jmp 0x1801d0096
xor r9, rdx
mov rdx, r9
rol rdx, 1
xor rdx, r9
mov eax, dword [0x1805179a8]
add eax, dword [0x1805179ac]
xor eax, 0x75023b01
imul eax, eax, 0x6b169bd3
sub eax, 0x357f8cd3
cmp eax, 0x49027abc
jb 0x1801d0113
mov r8d, dword [0x1805179b0]
and r8d, dword [str.4FR]
and r8d, 0xc373685c
and r8d, 0x50893129
or r8d, 0xf917e8c6
mov r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0xaac917d8
jbe 0x1801d0113
ret
cmpsb byte [rsi], byte [rdi]
invalid
insd dword [rdi], dx
push rcx
pop rbx
fstp qword [rdi + 0x476cac61]
cmpsd dword [rsi], dword [rdi]
xor byte [rbx + rbp*8 - 0x3333335c], dh
int3

Function at 0x1801d0030
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180517998]

Function at 0x1801d0130
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
sub rax, rdx
mov r8, rax
shr r8, 1
xor r8, rax
mov rax, r8
shr rax, 0x18
xor r8, rax
mov eax, dword [0x1805179b8]
xor eax, dword [0x1805179bc]
sub eax, 0x2074436b
add eax, 0xfe37c1a5
imul eax, eax, 0x2513cd97
cmp eax, 0x60d8177e
je 0x1801d01b4
jmp 0x1801d016d
mov eax, dword [0x1805179c0]
xor edx, edx
div dword [0x1805179c4]
or eax, 0xedfe3786
and eax, 0xdbd3d9b4
imul edx, eax, 0xb7bda4c9
mov rax, r8
xor rax, 0xffffffff9ff5a719
mov r9, rax
rol r9, 4
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xc9f85053
jae 0x1801d016d
ret
invalid

Function at 0x1801d01d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x300a25b3
sub rax, rdx
mov rdx, rax
rol rdx, 5
xor rax, rdx
xor rax, 0xffffffff9cc86673
mov r8, rax
rol r8, 1
xor r8, rax
mov eax, dword [0x1805179c8]
xor edx, edx
div dword [0x1805179cc]
or eax, 0x67942035
mov r9d, 0xdf015b9e
xor edx, edx
div r9d
xor eax, 0x4cb5f001
cmp eax, 0x1180699f
jb 0x1801d0258
jmp 0x1801d021d
mov eax, dword [0x1805179d0]
and eax, dword [0x1805179d4]
xor eax, 0xb285de21
mov r9d, 0xc20f3a73
xor edx, edx
div r9d
and eax, 0x360f4ef1
mov rdx, r8
and rdx, 0xffff
cmp eax, 0xbcbf9a9
ja 0x1801d021d
jmp 0x1801d0251
add rcx, rdx
mov rax, rcx
ret
add spl, byte [rbp + riz*2 - 0x2bdcca3e]
jmp 0x1801d021b
Function at 0x1801d0370
Capabilities:
Encode data using xor

Disassembly:
imul rax, rdx, 0x65feabbc
mov rdx, rax
shr rdx, 0xb
xor rdx, rax
mov rax, rdx
rol rax, 6
xor rax, rdx
xor r9d, r9d
sub r9, rax
mov eax, dword [0x1805179d8]
imul eax, dword [0x1805179dc]
imul eax, eax, 0x3f44a0c3
xor eax, 0x509cef5
mov r8d, 0xcbc5ccc
xor edx, edx
div r8d
cmp eax, 0x8c3bb77a
ja 0x1801d044c
jmp 0x1801d03c1
mov eax, dword [0x1805179e0]
and eax, dword [0x1805179e4]
and eax, 0xf0cca859
sub eax, 0x1abff22d
add eax, 0x2b8a8299
mov r8, r9
rol r8, 3
xor r8, r9
and r8, 0xffff
cmp eax, 0x5e0d2ce4
jb 0x1801d03c1
jmp 0x1801d03f6
mov eax, dword [0x1805179e8]
and eax, dword [0x1805179ec]
xor eax, 0xe49c0e25
and eax, 0xcc6aeba2
add eax, 0x1c648227
cmp eax, 0x72efeb8
je 0x1801d0459
jmp 0x1801d041a
mov eax, dword [0x1805179f0]
sub eax, dword [0x1805179f4]
xor eax, 0x8fb23c08
xor eax, 0x4440a369
mov r9d, 0xdea6cb38
xor edx, edx
div r9d
mov edx, eax
mov rax, rcx
add rax, r8
cmp edx, 0xdca93c6b
je 0x1801d041a
ret
mov esi, 0xcd4eb1e5
invalid
invalid

Function at 0x1801d0580
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
add r8, 0xffffffffffffffff
mov eax, dword [0x180517a08]
and eax, dword [0x180517a0c]
or eax, 0x9c9c101f
and eax, 0xed038e13
or eax, 0x5aad91a5
cmp eax, 0x5344022c
jbe 0x1801d0604
jmp 0x1801d05ab
mov eax, dword [0x180517a10]
or eax, dword [0x180517a14]
imul eax, eax, 0x154c9317
sub eax, 0xb8e983f8
mov r9d, 0x51278635
xor edx, edx
div r9d
mov edx, eax
mov rax, r8
shr rax, 2
xor rax, r8
mov r9, rax
shr r9, 0x15
xor r9, rax
mov r10, r9
rol r10, 1
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x9bbfc925
jae 0x1801d05ab
jmp 0x1801d0603
ret
retf

Function at 0x1801d0820
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, 0xffffffffab1b882f
sub rcx, rdx
mov rdx, rcx
shr rdx, 0xf
xor rcx, rdx
xor rcx, 0xffffffff84da0804
mov rdx, rcx
shr rdx, 2
xor rdx, rcx
mov rcx, rdx
rol rcx, 3
xor rcx, rdx
mov edx, dword [0x180517a28]
or edx, dword [0x180517a2c]
or edx, 0xcf323538
xor edx, 0x194744e9
imul edx, edx, 0x1de97499
cmp edx, 0xa04e70c7
ja 0x1801d08b4
jmp 0x1801d087a
mov edx, dword [0x180517a30]
add edx, dword [0x180517a34]
imul r8d, edx, 0xb8de17ee
xor r8d, 0xd6db69a0
and r8d, 0x57b8bf70
mov rdx, rcx
and rdx, 0xffff
cmp r8d, 0xd6ba9b77
ja 0x1801d087a
jmp 0x1801d08b0
add rax, rdx
ret
loopne 0x1801d08f5
outsb dx, byte [rsi]
mov ah, 0xec
invalid
leave
add rax, rcx
ret
Function at 0x1801d0ad0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180517a68]
xor eax, dword [0x180517a6c]
and eax, 0x8fba176e
sub eax, 0x3383da14
mov r9d, 0x1ad7afb1
xor edx, edx
div r9d
cmp eax, 0xa03c78ba
je 0x1801d0bad
mov eax, dword [0x180517a70]
sub eax, dword [0x180517a74]
add eax, 0x115284dc
imul r9d, eax, 0xef053da4
add r9d, 0x9c11bf5d
imul rax, r8, 0x5654f1f
add rax, 0xffffffffaeee3200
mov rdx, rax
rol rdx, 2
cmp r9d, 0xf7af5a59
je 0x1801d0bad
jmp 0x1801d0b3d
mov r8d, dword [0x180517a78]
and r8d, dword [0x180517a7c]
add r8d, 0xa104b629
and r8d, 0x89e0d82d
add r8d, 0x17ba1340
cmp r8d, 0xa436544b
jae 0x1801d0bba
jmp 0x1801d0b6b
mov r9d, dword [0x180517a80]
sub r9d, dword [0x180517a84]
xor r9d, 0x3ef255cb
and r9d, 0x73b6ce7e
or r9d, 0xc1fa2251
mov r8, rdx
xor r8, rax
cmp r9d, 0xecd3a5f5
jb 0x1801d0b6b
jmp 0x1801d0b9f
and r8, 0xffff
add rcx, r8
mov rax, rcx
ret
or al, 0xb1
out 0xa, al
xchg esp, eax
cmpsb byte [rsi], byte [rdi]
invalid
lahf
xchg byte [rbp + rsi*2 + 0x3b], cl
invalid

Function at 0x1801d1890
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x180517b38]
sub ecx, dword [0x180517b3c]
and ecx, 0x6e8053da
and ecx, 0x1e501f30
or ecx, 0xb8781eb1
cmp ecx, 0xd56b4e5c
jae 0x1801d1919
jmp 0x1801d18bb
mov r8d, dword [0x180517b40]
xor r8d, dword [0x180517b44]
or r8d, 0x16473d82
and r8d, 0x2826eb
xor r8d, 0xb0bd2145
movabs rcx, 0xe46080a02f997df8
mov r9, rdx
imul r9, rcx
mov rcx, r9
rol rcx, 3
xor rcx, r9
cmp r8d, 0x28a55644
je 0x1801d18bb
jmp 0x1801d1904
mov rdx, rcx
rol rdx, 2
xor rdx, rcx
and rdx, 0xffff
add rax, rdx
ret
enter 0x75f, 0xffffffffffffff86
or bh, byte [rsi - 0x691448f6]
int3

Function at 0x1801d2610
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, 0xffffffff815cb17b
sub rcx, rdx
mov edx, dword [0x180517be8]
or edx, dword [0x180517bec]
add edx, 0xf930a2aa
and edx, 0x806d1c57
imul edx, edx, 0x7708bb54
cmp edx, 0x2123d938
je 0x1801d2692
jmp 0x1801d2645
mov r9d, dword [0x180517bf0]
add r9d, dword [0x180517bf4]
xor r9d, 0x23b13d03
sub r9d, 0x691ded13
and r9d, 0xf74ff64a
mov r8, rcx
xor r8, 0x4fb984ac
mov rdx, r8
rol rdx, 4
cmp r9d, 0x1a2c3ba
je 0x1801d2645
jmp 0x1801d2684
xor rdx, r8
and rdx, 0xffff
add rax, rdx
ret
imul esi, dword [rcx], 0x6762661f
cdq
invalid

Function at 0x1801d2850
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x65c6d994
imul r8, rdx, 0x118bb6ff
movabs rax, 0x2e7c5114d3728ed
add r8, rax
mov eax, dword [0x180517c18]
sub eax, dword [0x180517c1c]
xor eax, 0x912302f8
xor eax, 0x36311c1f
or eax, 0xa2988852
cmp eax, 0x9600ce93
jbe 0x1801d28d6
jmp 0x1801d288f
mov eax, dword [0x180517c20]
xor edx, edx
div dword [0x180517c24]
xor eax, 0xee69f199
add byte [0x16e871a3b], dh
sub eax, 0xf458f585
mov r9d, 0x8482553e
xor edx, edx
div r9d
mov edx, eax
mov r9, r8
rol r9, 7
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x33c709ee
jae 0x1801d288f
jmp 0x1801d28d5
ret
ja 0x1801d289c
cmc
push rdx
test dword [rdi - 0xd], 0xeb8747fa
invalid
Function at 0x1801d29b0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180517c28]
imul eax, dword [0x180517c2c]
xor eax, 0x3ca8e86
add eax, 0x2b6177ff
xor eax, 0xad7e995a
cmp eax, 0x5d137753
jae 0x1801d2a33
jmp 0x1801d29d8
mov eax, dword [0x180517c30]
add eax, dword [0x180517c34]
mov r9d, 0x6043a58d
xor edx, edx
div r9d
and eax, 0x90d2b85c
and eax, 0xbe10feb4
imul r9, r8, 0x5a8ad0b0
mov rdx, r9
rol rdx, 5
xor rdx, r9
cmp eax, 0xb73d1d71
je 0x1801d29d8
jmp 0x1801d2a13
mov eax, 0x265af67a
sub rax, rdx
mov rdx, rax
rol rdx, 5
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
xor al, 0x4a
cwde
jrcxz 0x1801d2a37
invalid
mov edx, 0x953754fa
pop rdx
invalid

Function at 0x1801d34a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8, rdx
shr r8, 4
xor r8, rdx
mov rcx, r8
shr rcx, 0x10
xor rcx, r8
mov edx, dword [0x180517c98]
imul edx, dword [0x180517c9c]
and edx, 0xf54ee86a
sub edx, 0x2d8ae77f
imul edx, edx, 0xefda7156
cmp edx, 0x4e97394a
je 0x1801d352c
jmp 0x1801d34e0
mov r8d, dword [0x180517ca0]
and r8d, dword [0x180517ca4]
add r8d, 0xa43df7af
add r8d, 0x3523a092
sub r8d, 0x681ec28c
mov r9, 0xffffffffa50e849f
sub r9, rcx
mov rdx, r9
rol rdx, 1
xor rdx, r9
cmp r8d, 0xf6f15e71
je 0x1801d34e0
jmp 0x1801d3521
and rdx, 0xffff
add rax, rdx
ret
mov ecx, 0x25acc810
xchg ecx, eax
lodsb al, byte [rsi]
retf 0xeab3

Function at 0x1801d3f30
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
rol r8, 1
xor r8, rdx
mov r9, r8
rol r9, 7
mov eax, dword [0x180517d58]
imul eax, dword [0x180517d5c]
imul eax, eax, 0xa9ad47b5
xor eax, 0xb512cc02
xor eax, 0xaf681d23
cmp eax, 0xd5265e15
je 0x1801d3fb7
jmp 0x1801d3f66
mov eax, dword [0x180517d60]
xor edx, edx
div dword [0x180517d64]
sub eax, 0xcba411ce
or eax, 0x27cb97f0
and eax, 0xfeaa9e7b
mov rdx, r9
xor rdx, r8
mov r10, rdx
rol r10, 1
xor r10, rdx
xor edx, edx
sub rdx, r10
cmp eax, 0xf2a7a0ed
jae 0x1801d3f66
jmp 0x1801d3fa0
mov rax, rdx
rol rax, 5
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
adc ah, byte [rbx]
or al, 0x80
adc eax, 0x83285195
mov ebp, ecx
or ebx, ebp
lahf
int3

Function at 0x1801d43a0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180517da8]
xor edx, edx
div dword [0x180517dac]
xor eax, 0x87ccf987
sub eax, 0x54221ac9
xor eax, 0xa8df9f1e
cmp eax, 0xc6d97255
je 0x1801d4424
jmp 0x1801d43c9
mov eax, dword [0x180517db0]
sub eax, dword [0x180517db4]
and eax, 0x86a16a5b
xor eax, 0x8afb6ace
imul edx, eax, 0x39e95e49
mov r9, 0xffffffff9f139038
sub r9, r8
mov rax, r9
rol rax, 5
xor rax, r9
cmp edx, 0xe0cfe206
ja 0x1801d43c9
jmp 0x1801d4403
mov rdx, rax
shr rdx, 0x15
xor rdx, rax
mov rax, rdx
rol rax, 6
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
and byte [rdx + 0x21], dh
invalid
Function at 0x1801d5dc0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0xffffffffffffffff
mov eax, dword [0x180517f08]
imul eax, dword [0x180517f0c]
sub eax, 0xd1fb7bb3
and eax, 0xfb49f4ef
add eax, 0xb1533737
cmp eax, 0x9dbf24c2
jbe 0x1801d5e42
jmp 0x1801d5dec
mov eax, dword [0x180517f10]
add eax, 0x34211e
imul eax, dword [0x180517f14]
imul eax, eax, 0x2ca08066
or eax, 0xe4f33f3f
imul r9d, eax, 0x30d84b83
mov rax, r8
shr rax, 8
xor rax, rdx
xor rax, 0x50a26850
add rax, 1
mov r10, rax
rol r10, 5
xor r10, rax
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r9d, 0x46fbe7e7
je 0x1801d5dec
jmp 0x1801d5e41
ret
loope 0x1801d5ded
xchg r15, rsp
invalid

Function at 0x1801d6fa0
Capabilities:
Hash data using murmur3

Disassembly:
mov rax, rcx
mov rcx, rdx
shr rcx, 3
xor rcx, rdx
mov rdx, rcx
shr rdx, 0xd
xor rdx, rcx
mov rcx, rdx
shr rcx, 0x10
xor rcx, rdx
imul rdx, rcx, 0xffffffffc96de0ee
mov rcx, rdx
rol rcx, 3
xor ecx, edx
movzx ecx, cx
add rax, rcx
ret

Function at 0x1801d7990
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1805180c8]
imul eax, dword [0x1805180cc]
add eax, 0x6b81ed30
xor eax, 0x6f1c6154
sub eax, 0xbb1ee1d2
cmp eax, 0x6ed33cc6
jbe 0x1801d7a72
jmp 0x1801d79b9
mov r9d, dword [0x1805180d0]
and r9d, dword [0x1805180d4]
xor r9d, 0x78d93919
sub r9d, 0x99a50833
and r9d, 0xef9b4656
mov rax, rdx
rol rax, 3
xor rax, rdx
imul rax, rax, 0xffffffffd02dcf3b
mov r8, rax
shr r8, 0x1d
cmp r9d, 0x15580f10
jbe 0x1801d79b9
jmp 0x1801d79ff
xor r8, rax
mov eax, dword [0x1805180d8]
sub eax, dword [0x1805180dc]
xor eax, 0x3930693c
mov r9d, 0x7ecbb612
xor edx, edx
div r9d
or eax, 0x56f040f3
cmp eax, 0x8feb761a
je 0x1801d7a7f
jmp 0x1801d7a2c
mov eax, dword [0x1805180e0]
xor eax, dword [0x1805180e4]
or eax, 0xec36f3ec
imul eax, eax, 0xd68c9646
imul edx, eax, 0xaf14d777
mov rax, r8
rol rax, 1
xor rax, r8
mov r9, rax
rol r9, 4
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xf4392d9f
jae 0x1801d7a2c
ret
push rdi
insb byte [rdi], dx
leave
mov ch, 0x85
int 0x87
jmp 0x1801d79b7
insd dword [rdi], dx
adc cl, al
xchg edx, eax
invalid

Function at 0x1801d7b70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0x7fd3fab6
mov ecx, dword [0x1805180e8]
and ecx, dword [0x1805180ec]
or ecx, 0xad022383
imul ecx, ecx, 0x6177e8e5
and ecx, 0x7d0c9931
cmp ecx, 0x1612b2dc
jb 0x1801d7bff
jmp 0x1801d7ba2
mov r8d, dword [0x1805180f0]
and r8d, dword [0x1805180f4]
xor r8d, 0x735d2faa
xor r8d, 0x3ff4eaa0
sub r8d, 0xd1367cda
mov rcx, rdx
add rcx, 1
mov r9, rcx
rol r9, 1
xor r9, rcx
mov r10, r9
rol r10, 5
xor r10, r9
mov rcx, r10
rol rcx, 7
xor rcx, r10
cmp r8d, 0x2ca9acc5
jae 0x1801d7ba2
jmp 0x1801d7bf4
and rcx, 0xffff
add rax, rcx
ret
sal byte cs:[rbx + 0x5a], cl
invalid
Function at 0x1801d7d30
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
add rdx, 0xffffffffb1367c0b
mov ecx, dword [str..3]
add ecx, dword [0x18051810c]
sub ecx, 0x56e8312a
add ecx, 0x37c5b7b4
or ecx, 0x13a7b689
cmp ecx, 0xbc594904
jae 0x1801d7da0
jmp 0x1801d7d62
mov ecx, dword [0x180518110]
and ecx, dword [str.20FhO7]
or ecx, 0xe742e13f
or ecx, 0x3d4afb00
imul r8d, ecx, 0x22191cbe
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
cmp r8d, 0x114596cf
jb 0x1801d7d62
jmp 0x1801d7d95
and rcx, 0xffff
add rax, rcx
ret
jo 0x1801d7df1
adc ebp, dword [rsi - 0x4ce6b66d]
jmp 0x1801d7d60
mov eax, edx

Function at 0x1801d85f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x180518188]
or ecx, dword [0x18051818c]
xor ecx, 0x3f8143b1
add ecx, 0x244644ce
sub ecx, 0xb223775e
cmp ecx, 0x7762bef2
jae 0x1801d867c
jmp 0x1801d861b
mov r8d, dword [0x180518190]
sub r8d, dword [0x180518194]
or r8d, 0x69471978
sub r8d, 0x4319e7
xor r8d, 0x584b46eb
imul rcx, rdx, 0x305ebaee
movabs r9, 0xee5ecdf89944597a
add rcx, r9
mov r9, rcx
rol r9, 4
xor r9, rcx
mov rcx, r9
rol rcx, 2
xor rcx, r9
cmp r8d, 0xd7ec32d
je 0x1801d861b
jmp 0x1801d8671
and rcx, 0xffff
add rax, rcx
ret
jl 0x1801d86be
mov ch, 0xb4
mov bl, 0xce
invalid
int3

Function at 0x1801d8820
Capabilities:
Encode data using xor

Disassembly:
mov r8d, 0x2a573f4b
sub r8, rdx
mov r9, r8
shr r9, 0x13
mov eax, dword [0x1805181a8]
and eax, dword [0x1805181ac]
xor eax, 0x5be4170
xor eax, 0xc43722d3
add eax, 0x81b7079a
cmp eax, 0x2175b3d5
jb 0x1801d88a2
jmp 0x1801d8854
mov eax, dword [0x1805181b0]
xor edx, edx
div dword [0x1805181b4]
add eax, 0x4a4ea0b
add eax, 0xf5c06881
imul edx, eax, 0x13fee14d
mov rax, r9
xor rax, r8
mov r10d, 0x63d7edef
sub r10, rax
mov rax, r10
rol rax, 7
xor rax, r10
and rax, 0xffff
cmp edx, 0xa5037769
je 0x1801d8854
jmp 0x1801d889b
add rcx, rax
mov rax, rcx
ret
pop rbx
add eax, 0x64634676
invalid

Function at 0x1801d9060
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xffffffffe0792802
sub rax, rdx
imul rax, rax, 0xffffffffff9a07cf
add rax, 0xffffffffe43759f5
mov rdx, rax
rol rdx, 7
xor rdx, rax
mov r8, rdx
rol r8, 4
mov eax, dword [0x180518208]
imul eax, dword [0x18051820c]
add eax, 0x26663752
sub eax, 0x7f045727
sub eax, 0x2a0b1367
cmp eax, 0xf8395494
je 0x1801d90e5
mov eax, dword [0x180518210]
or eax, dword [0x180518214]
add eax, 0xc79ba195
and eax, 0x52f76298
imul r9d, eax, 0xdcfff8b9
mov r10, r8
xor r10, rdx
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r9d, 0x1ea6aaf3
jbe 0x1801d90e5
ret
invalid

Function at 0x1801d9180
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0xffffffffffffffff
rol r8, 1
xor r8, rdx
xor r8, 0x7d1289b7
add r8, 0xffffffffb8a4a0b6
mov eax, dword [0x180518228]
imul eax, dword [0x18051822c]
xor eax, 0x1294cbb5
mov r9d, 0x2d118916
xor edx, edx
div r9d
or eax, 0x1f33ecec
cmp eax, 0xabbe9e39
ja 0x1801d9204
jmp 0x1801d91c6
mov edx, dword [0x180518230]
and edx, dword [0x180518234]
sub edx, 0x30575249
sub edx, 0xa1532d47
or edx, 0x612cdf90
mov r9, r8
rol r9, 6
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xf8bde03b
je 0x1801d91c6
ret
push rdx
retf
Function at 0x1801d98e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
imul rax, rdx, 0x5676ec9e
mov r8, rax
shr r8, 7
xor r8, rax
mov eax, dword [0x1805182a8]
or eax, dword [0x1805182ac]
imul eax, eax, 0xeac5bf79
xor eax, 0x33779d24
xor eax, 0xd906d0fe
cmp eax, 0x5a190e04
je 0x1801d9964
jmp 0x1801d9916
mov eax, dword [0x1805182b0]
imul eax, dword [0x1805182b4]
imul eax, eax, 0x7d61e55e
sub eax, 0x8c2828bc
mov r9d, 0x1a6f7125
xor edx, edx
div r9d
mov edx, eax
imul rax, r8, 0xffffffff80790814
mov r9, rax
rol r9, 6
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x101e1b8b
je 0x1801d9916
jmp 0x1801d9963
ret
invalid

Function at 0x1801dbb70
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0xffffffffffffffff
mov ecx, dword [0x1805184e8]
imul ecx, dword [0x1805184ec]
xor ecx, 0x928622cf
or ecx, 0x4d96c0eb
add ecx, 0xce45fea9
cmp ecx, 0xea517126
ja 0x1801dbbfc
jmp 0x1801dbba0
mov r8d, dword [0x1805184f0]
sub r8d, dword [str._B]
sub r8d, 0x72495665
add r8d, 0x3bad370e
add r8d, 0x3c2812d1
mov rcx, rdx
rol rcx, 5
xor rcx, rdx
mov r9, rcx
rol r9, 1
xor r9, rcx
xor r10d, r10d
sub r10, r9
mov rcx, r10
rol rcx, 4
xor rcx, r10
cmp r8d, 0x3eeb43ff
jbe 0x1801dbba0
jmp 0x1801dbbf1
and rcx, 0xffff
add rax, rcx
ret
idiv byte [rbx + rbp*4]
jae 0x1801dbc11
out 0xbe, al
jmp 0x1801dbb9e
mov eax, ecx

Function at 0x1801dbd20
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1805184f8]
xor edx, edx
div dword [0x1805184fc]
imul eax, eax, 0x62c05dd0
and eax, 0xeda25fa9
add eax, 0x6554f529
cmp eax, 0x13c00c98
je 0x1801dbdaa
jmp 0x1801dbd4a
mov r9d, dword [0x180518500]
xor r9d, dword [0x180518504]
add r9d, 0x97c1a1f9
add r9d, 0x1361ae16
and r9d, 0xc75f3126
mov rax, r8
xor rax, 0x3d255928
imul rdx, rax, 0xffffffffb4cccfad
mov rax, rdx
rol rax, 3
cmp r9d, 0x1dde84d3
jb 0x1801dbd4a
jmp 0x1801dbd8f
xor rax, rdx
mov rdx, rax
rol rdx, 7
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
xchg dword [0x1681f9250], esi
ret 0xebcd

Function at 0x1801dcba0
Capabilities:
Encode data using xor

Disassembly:
movabs rax, 0x6304d9f0d3d601b4
imul rdx, rax
mov rax, rdx
rol rax, 4
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov eax, dword [0x1805185e8]
sub eax, dword [str.y7b]
mov r8d, 0xb0017974
xor edx, edx
div r8d
add eax, 0x831ce240
or eax, 0xc0644369
cmp eax, 0x510101cd
jb 0x1801dcc19
jmp 0x1801dcbeb
mov eax, dword [0x1805185f0]
xor edx, edx
div dword [0x1805185f4]
xor eax, 0xfdd81506
sub eax, 0x38d34d6b
mov r8d, 0x33cddf6f
xor edx, edx
div r8d
cmp eax, 0x5aa121
jae 0x1801dcbeb
mov rax, rcx
ret
push rdi
push 4
shr dl, cl
mov byte [rsi + rcx*4], dl
sub cl, dh
invalid