joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180312150
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x180781610]
or ecx, dword [0x180781614]
sub ecx, 0xc983d7e6
and ecx, 0x2a804fa6
and ecx, 0xdddca380
cmp ecx, 0x4aaf2a00
je 0x1803121e0
jmp 0x18031217b
mov r9d, dword [0x180781618]
imul r9d, dword [0x18078161c]
add r9d, 0x5a80e011
and r9d, 0xef4294ba
add r9d, 0xd8fb175b
mov rcx, rdx
shr rcx, 6
xor rcx, rdx
movabs r8, 0x3ffffffcea75710
xor rcx, r8
mov r8, rcx
shr r8, 0x1d
xor r8, rcx
mov rcx, r8
rol rcx, 3
cmp r9d, 0x1b736c49
jb 0x18031217b
jmp 0x1803121d2
xor rcx, r8
and rcx, 0xffff
add rax, rcx
ret
jge 0x180312236
xor byte [0x15ae02897], ah
jmp 0x180312179
loope 0x1803121dc
neg byte [rbx]
add eax, 0x9a58b937
xor eax, 0x8d24a811
cmp eax, 0x23ff86d5
jb 0x1803122a4
mov eax, dword [0x180781628]
xor edx, edx
div dword [0x18078162c]
or eax, 0x7c8f2849
sub eax, 0x71680c6d
add eax, 0x867801d0
mov rdx, r9
xor rdx, r8
imul rdx, rdx, 0xffffffffb17c70ef
mov r10, rdx
shr r10, 0x17
xor rdx, r10
xor rdx, 0xffffffffffffffff
mov r10, rdx
rol r10, 5
cmp eax, 0x578d6cb9
jb 0x1803122a4
jmp 0x180312293
xor r10, rdx
and r10, 0xffff
add rcx, r10
mov rax, rcx
ret
mov dl, 0x6e
jl 0x1803122a0
pop rax
push 0xffffffffcc9debba
int3

Function at 0x1803123e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8d, 0x7e6fecab
sub r8, rdx
xor r8, 0xffffffffb98cc417
mov rcx, r8
rol rcx, 6
xor rcx, r8
mov edx, dword [0x180781650]
xor edx, dword [0x180781654]
imul edx, edx, 0x45cdd027
xor edx, 0xc735b0ce
sub edx, 0xd1f48e1e
cmp edx, 0xeb75869
jb 0x180312472
jmp 0x180312425
mov r8d, dword [0x180781658]
add r8d, dword [0x18078165c]
or r8d, 0x65b19ed7
add r8d, 0x2b53468d
and r8d, 0x928b6c6f
mov rdx, rcx
shr rdx, 0x1f
xor rdx, rcx
cmp r8d, 0x296e7ecc
ja 0x180312425
jmp 0x18031245d
mov rcx, rdx
rol rcx, 7
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
ret
int 0x23
xor al, 0xfd
out dx, eax
jbe 0x1803124bd
pop rax
jmp 0x180312423
rol ecx, 2
xor rcx, r8
mov edx, dword [0x180781660]
add edx, dword [0x180781664]
and edx, 0xed7b3f6c
xor edx, 0xc1ba7e23
imul edx, edx, 0x2f31121b
cmp edx, 0x9f0aaa72
je 0x180312540
mov r9d, dword [0x180781668]
sub r9d, dword [0x18078166c]
or r9d, 0x365fd225
add r9d, 0xbb38bfd2
add r9d, 0x86e1ddcb
mov rdx, rcx
rol rdx, 6
xor rdx, rcx
mov r8, rdx
rol r8, 3
cmp r9d, 0x78afdd2
jb 0x180312540
jmp 0x180312528
xor r8, rdx
mov rcx, r8
rol rcx, 3
xor rcx, r8
and rcx, 0xffff
add rax, rcx
ret
xor dword [rdi], 0xcc37b5d4
or ebx, dword [rdx + 0x6b8e1743]
jmp 0x1803124e9

Function at 0x180312730
Capabilities:
Encode data using xor

Disassembly:
mov r8d, 0x24915937
sub r8, rdx
mov rax, r8
shr rax, 7
xor r8, rax
xor r8, 0xffffffffed7e24b3
mov r9, r8
rol r9, 5
mov eax, dword [0x1807816a0]
xor edx, edx
div dword [0x1807816a4]
mov r10d, 0x5ba9028c
xor edx, edx
Function at 0x180313000
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov r10, r8
shr r10, 0x19
mov eax, dword [0x180781760]
xor edx, edx
div dword [0x180781764]
add eax, 0x9abba19e
imul eax, eax, 0x52b71a5f
add eax, 0x5e741b95
cmp eax, 0xdd9227b2
je 0x1803130e0
jmp 0x180313035
mov eax, dword [0x180781768]
xor edx, edx
div dword [0x18078176c]
sub eax, 0x9252dfe4
or eax, 0xc0ba2a27
or eax, 0x36ec0707
mov rdx, r10
xor rdx, r8
xor rdx, 0xffffffff96b60f2e
add rdx, 0xffffffffa3dfc961
mov r9, rdx
rol r9, 4
xor r9, rdx
cmp eax, 0x975f4b45
jbe 0x180313035
jmp 0x180313079
mov eax, dword [0x180781770]
or eax, dword [0x180781774]
imul eax, eax, 0xa99d7977
xor eax, 0xcf1743e0
sub eax, 0x8a8f38b6
cmp eax, 0x9a8c8cd8
jae 0x1803130f1
jmp 0x18031309e
mov eax, dword [0x180781778]
or eax, dword [0x18078177c]
and eax, 0x9c04b5a7
mov r8d, 0x90d0c6e7
xor edx, edx
div r8d
mov r8d, 0xf0c4bd34
xor edx, edx
div r8d
mov edx, eax
mov r8, r9
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0xf54b8281
jae 0x18031309e
ret
fcom dword [rdi + 0x54]
cmp bl, cl
jmp qword [rbp + 0x52]
fld qword [0x70d96464]
xor ebx, ebp
invalid
int3
int3
int3
int3
int3

Function at 0x180313130
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180781780]
and eax, dword [0x180781784]
xor eax, 0xbc882d43
mov r9d, 0x8ec37f71
xor edx, edx
div r9d
xor eax, 0x72cba3d9
cmp eax, 0xda1aa7e1
ja 0x18031320d
mov eax, dword [0x180781788]
and eax, dword [0x18078178c]
xor eax, 0xd0f6daea
and eax, 0xdf28ac00
imul eax, eax, 0xa9ace200
mov r9, r8
add r9, 1
mov rdx, r9
shr rdx, 0xf
xor r9, rdx
xor r9, 0x4839afb0
cmp eax, 0xcaf4f176
jb 0x18031320d
jmp 0x18031319c
mov eax, dword [0x180781790]
sub eax, dword [0x180781794]
mov r8d, 0x2a5f0aa5
xor edx, edx
div r8d
or eax, 0xfb1a31b5
imul eax, eax, 0x8757eef
cmp eax, 0x8a1ae116
jb 0x18031321a
jmp 0x1803131c7
mov eax, dword [0x180781798]
xor edx, edx
div dword [0x18078179c]
sub eax, 0x8afb20d1
mov r8d, 0x3651c28f
xor edx, edx
div r8d
imul edx, eax, 0x3b142ec0
mov r8, r9
rol r8, 5
xor r8, r9
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0xbf7013f9
jae 0x1803131c7
jmp 0x18031320c
ret
xchg esp, eax
add eax, 0xf59506d0
invalid
stc
cmpsb byte [rsi], byte [rdi]
invalid
Function at 0x180313450
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1807817d0]
sub eax, dword [0x1807817d4]
mov r9d, 0xcf96294
xor edx, edx
div r9d
sub eax, 0x7185f4b5
sub eax, 0xcb91dd4f
cmp eax, 0x7f52a85f
je 0x180313532
mov eax, dword [0x1807817d8]
xor eax, dword [0x1807817dc]
sub eax, 0x2311675c
mov r9d, 0x11f1dfc9
xor edx, edx
div r9d
imul eax, eax, 0x131b5c4b
mov rdx, r8
shr rdx, 2
xor rdx, r8
mov r10, rdx
shr r10, 0xe
xor r10, rdx
movabs r9, 0xffffffff3207ead4
sub r9, r10
cmp eax, 0x59bf8d05
jb 0x180313532
jmp 0x1803134cb
mov eax, dword [0x1807817e0]
add eax, dword [0x1807817e4]
sub eax, 0x5dab691c
xor eax, 0x6f0cfc4c
and eax, 0x67e1ee03
cmp eax, 0x5c57d453
jae 0x180313543
jmp 0x1803134ef
mov eax, dword [0x1807817e8]
imul eax, dword [0x1807817ec]
mov r8d, 0xbcd4e3f2
xor edx, edx
div r8d
sub eax, 0x8507a861
imul edx, eax, 0x5dcda562
int 0x5d
mov rax, r9
rol rax, 1
xor rax, r9
cmp edx, 0xc7535c25
jae 0x1803134ef
jmp 0x180313525
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
rcl bl, cl
fimul dword [0x1ef383254]
sub eax, 0xe9173095
cmp al, 0xff
invalid
jrcxz 0x180313510
push r10
stosb byte [rdi], al
mov edi, 0xcca0ebf8
int3

Function at 0x180314b10
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180781a10]
sub eax, dword [0x180781a14]
imul eax, eax, 0x208d1a0c
add eax, 0x962a7d4b
or eax, 0xefc15172
cmp eax, 0xfc99fef9
je 0x180314b89
jmp 0x180314b38
mov eax, dword [0x180781a18]
xor edx, edx
div dword [0x180781a1c]
xor eax, 0x2d3ddbb
add eax, 0xee762bd5
sub eax, 0x12088e4e
mov rdx, r8
shr rdx, 0xa
xor rdx, r8
mov r9, rdx
shr r9, 1
xor r9, rdx
mov rdx, r9
rol rdx, 6
cmp eax, 0x3d554231
jb 0x180314b38
jmp 0x180314b78
xor rdx, r9
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
stc
and dh, dl
cmp bl, byte [rbx - 0x27]
invalid

Function at 0x180314f10
Capabilities:
Encode data using xor

Disassembly:
imul rax, rdx, 0xfffffffff1c1c687
add rax, 0xfffffffffffffffe
mov rdx, rax
rol rdx, 5
xor rdx, rax
mov eax, dword [0x180781a70]
add eax, dword [0x180781a74]
and eax, 0x1f8ad626
and eax, 0xc9f04f17
imul eax, eax, 0xbf4a9c35
cmp eax, 0xa179ab8c
ja 0x180314f87
jmp 0x180314f4a
mov r8d, dword [0x180781a78]
or r8d, dword [0x180781a7c]
add r8d, 0xc68978cf
and r8d, 0xdd080792
xor r8d, 0x41fdc43e
mov r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0x2d0a1a72
je 0x180314f4a
ret
add eax, esi
xchg edx, eax
xor byte [rbx + rbp], bh
push rax
pop rcx
test al, 0x3f
adc eax, 0xccb3eb17
int3
Function at 0x1803156f0
Capabilities:
Encode data using xor

Disassembly:
imul r8, rdx, 0xffffffffa1dbcbcc
add r8, 0xffffffff8f0c9056
mov r9, r8
rol r9, 3
mov eax, dword [0x180781b40]
xor edx, edx
div dword [0x180781b44]
add eax, 0x35d7e9ed
xor eax, 0x7ac01f1
add eax, 0x3e1ae61e
cmp eax, 0x1e2e3fc2
jb 0x1803157c0
jmp 0x18031572f
mov eax, dword [0x180781b48]
or eax, dword [0x180781b4c]
or eax, 0x28332657
mov r10d, 0xb9d57ba6
xor edx, edx
div r10d
sub eax, 0xa01fca65
mov rdx, r9
xor rdx, r8
cmp eax, 0xc96111c4
jae 0x18031572f
jmp 0x18031575f
mov eax, dword [0x180781b50]
sub eax, dword [0x180781b54]
xor eax, 0x70c93d3d
imul eax, eax, 0xa885aafc
sub eax, 0x928614d9
cmp eax, 0x5f39332a
je 0x1803157d1
mov r8d, dword [0x180781b58]
imul r8d, dword [0x180781b5c]
sub r8d, 0xe891f8aa
xor r8d, 0xf4f5358
sub r8d, 0xe56c5cd1
mov r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0x5594eb48
je 0x1803157d1
ret
mov ah, 0x9b
popfq
sti
and al, 0x35
cmp al, 0x21
and dword [rbp + 0x5ce92a8d], esp
invalid
movsd dword [rdi], dword [rsi]
lea ebp, [rdx]
jmp 0x18031572d
pop rbp
sbb bl, bh
stosd dword [rdi], eax
jge 0x180315807
push 0xffffffffb5cf6597
loope 0x1803157c9
movabs dword [0xae8c149d08949cc], eax
mov bh, 0xca

Function at 0x180315930
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180781b80]
and eax, dword [0x180781b84]
add eax, 0x24e880c7
imul eax, eax, 0xe0a033fc
xor eax, 0xa5b5ccf
cmp eax, 0x638e9b8d
jae 0x180315a06
jmp 0x18031595c
mov eax, dword [0x180781b88]
xor edx, edx
div dword [str._WKO_]
imul eax, eax, 0x760fe5e8
sub eax, 0x1aa1aeb9
mov r9d, 0x153f64e1
xor edx, edx
div r9d
mov r9, r8
add r9, 0x7686504e
cmp eax, 0xeee33413
jae 0x18031595c
jmp 0x180315993
mov r8, r9
rol r8, 1
mov eax, dword [0x180781b90]
and eax, dword [0x180781b94]
or eax, 0xce3f565e
mov r10d, 0x677c0abe
xor edx, edx
div r10d
sub eax, 0x8ca3a824
cmp eax, 0xb4f55f6d
jae 0x180315a13
jmp 0x1803159c3
mov edx, dword [0x180781b98]
or edx, dword [0x180781b9c]
sub edx, 0x9413bfb5
or edx, 0x27a1c57b
xor edx, 0x94d56ba7
mov rax, r8
xor rax, r9
mov r10, rax
rol r10, 1
xor r10, rax
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xfe29a02
jbe 0x1803159c3
ret
mov ecx, 0xd5185c6d
mov esi, dword [rdx + 0x15]
jmp 0x18031595a
adc eax, 0x4c7024cd
sbb dword [rdx - 0x7d], 0xcccca4eb
int3

Function at 0x180315ab0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x34772e09
sub rax, rdx
mov r8, rax
rol r8, 6
xor r8, rax
and r8, 0xffff
mov eax, dword [0x180781bb0]
add eax, 0x46c0e1
xor eax, dword [0x180781bb4]
add eax, 0x19b05e1a
or eax, 0x17853b50
xor eax, 0xc4ffd0cc
cmp eax, 0x251be409
jb 0x180315b1e
jmp 0x180315aed
mov eax, dword [0x180781bb8]
xor eax, dword [0x180781bbc]
mov r9d, 0xc0df5385
xor edx, edx
div r9d
and eax, 0x55856252
imul edx, eax, 0x4899ce7d
mov rax, rcx
add rax, r8
cmp edx, 0xc7bcd608
je 0x180315aed
ret
insb byte [rdi], dx
jno 0x180315aca
invalid
Function at 0x180316820
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffffffffffff
imul rax, rdx, 0xffffffff857a6ea8
mov rdx, rax
shr rdx, 6
xor rax, rdx
xor rax, 0x43135ff2
mov rdx, rax
rol rdx, 7
xor rdx, rax
and rdx, 0xffff
mov eax, dword [0x180781d30]
sub eax, dword [0x180781d34]
or eax, 0xf9c5065e
imul eax, eax, 0x37245fbc
sub eax, 0x3f853863
cmp eax, 0x5405df50
jbe 0x1803168a0
jmp 0x180316871
mov eax, dword [0x180781d38]
xor eax, dword [0x180781d3c]
or eax, 0xc24cb48d
imul r8d, eax, 0xb782daa5
add r8d, 0xc14c83a6
mov rax, rcx
add rax, rdx
cmp r8d, 0xd938237
je 0x180316871
ret
movsd dword [rdi], dword [rsi]
int3

Function at 0x180316d00
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0xffffffffca0c5aa0
mov r8, rdx
rol r8, 5
mov eax, dword [0x180781da0]
xor eax, dword [0x180781da4]
add eax, 0x832af732
or eax, 0x33d2c2ca
xor eax, 0xe771de93
cmp eax, 0x24f09bd5
jbe 0x180316d74
jmp 0x180316d32
mov r9d, dword [0x180781da8]
add r9d, dword [0x180781dac]
add r9d, 0xb209437f
xor r9d, 0x28b110ff
and r9d, 0x86e9fccf
mov r10, r8
xor r10, rdx
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r9d, 0x8921d94
jae 0x180316d32
jmp 0x180316d73
ret
xor eax, 0x5b3f0085
out dx, al
xor eax, 0xccb2ebf8
int3

Function at 0x180316d80
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180781db0]
or eax, dword [0x180781db4]
mov r9d, 0x5c06aeae
xor edx, edx
div r9d
imul eax, eax, 0x122e6249
sub eax, 0x77e059ea
cmp eax, 0x76a49060
jb 0x180316e56
mov eax, dword [0x180781db8]
xor eax, dword [0x180781dbc]
add eax, 0x55b07d26
xor eax, 0x315e4770
or eax, 0x349b762a
mov r9, r8
xor r9, 0x4aa5b74c
cmp eax, 0x4f74cb4d
jae 0x180316e56
jmp 0x180316dde
mov eax, dword [0x180781dc0]
xor edx, edx
div dword [0x180781dc4]
and eax, 0x52edd8b0
xor eax, 0x762c1364
or eax, 0x32f9cc92
cmp eax, 0x1c1b2e65
jb 0x180316e67
jmp 0x180316e04
mov eax, dword [0x180781dc8]
add eax, dword [0x180781dcc]
xor eax, 0xb1671fa7
mov r8d, 0xcf802052
xor edx, edx
div r8d
or eax, 0x5e62f1ad
mov rdx, r9
shr rdx, 0x1b
xor rdx, r9
xor r8d, r8d
sub r8, rdx
mov rdx, r8
rol rdx, 4
xor rdx, r8
and rdx, 0xffff
cmp eax, 0x5e4b1cda
je 0x180316e04
jmp 0x180316e4f
add rcx, rdx
mov rax, rcx
ret
sub bl, dl
invalid
not byte [rax + 0x20d4c1aa]
test dword [rbp - 0x33336e15], edx
int3

Function at 0x180317040
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180781df0]
xor eax, dword [0x180781df4]
mov r9d, 0xd3fd2d2f
xor edx, edx
div r9d
add eax, 0x57273406
or eax, 0x7ee27a55
cmp eax, 0x4b5a47c1
jb 0x1803170c2
mov eax, dword [0x180781df8]
add eax, dword [0x180781dfc]
and eax, 0x5b04eb8
xor eax, 0x29543e26
imul r9d, eax, 0x2a84bbc4
imul rdx, r8, 0xffffffffc4ac6149
mov rax, rdx
shr rax, 0xd
cmp r9d, 0x2db73875
jbe 0x1803170c2
jmp 0x1803170a1
xor rax, rdx
add rax, 0xffffffffefac8f89
mov rdx, rax
rol rdx, 6
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
popfq
mov al, 0xdb
stc
xchg ecx, eax
call 0x121f25776
invalid
Function at 0x1803178a0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180781ee0]
sub eax, dword [0x180781ee4]
mov r9d, 0xba073df3
xor edx, edx
div r9d
sub eax, 0xe8c898fd
mov r9d, 0x1a487db4
xor edx, edx
div r9d
cmp eax, 0xcb83a1a0
ja 0x18031797d
mov eax, dword [0x180781ee8]
or eax, dword [0x180781eec]
or eax, 0xca824907
and eax, 0x9696133b
xor eax, 0xb31e3c9f
mov rdx, r8
shr rdx, 0x1d
xor rdx, r8
mov r10d, 0x214ccd62
sub r10, rdx
xor r10, 0x5f42c638
mov r9, r10
rol r9, 3
xor r9, r10
cmp eax, 0x63f34931
je 0x18031797d
jmp 0x18031791d
mov eax, dword [0x180781ef0]
xor edx, edx
div dword [0x180781ef4]
and eax, 0x5d822827
or eax, 0x724d96de
imul eax, eax, 0xac104296
cmp eax, 0x1c59b67e
je 0x18031798e
jmp 0x180317944
mov edx, dword [0x180781ef8]
xor edx, dword [0x180781efc]
and edx, 0xaf5860a9
xor edx, 0x25875e4f
xor edx, 0x7ff52c94
mov r8, r9
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0xa7a28cf6
je 0x180317944
jmp 0x18031797c
ret
mov eax, 0x5cc7002d
sahf
js 0x1803179da
ja 0x1803179be
xor eax, 0xffff47e9
push qword [rax]
not dword [rdx + 0x4b]
out 0x6d, al
xor bh, dh
push rdx
out 0x6d, al
or al, 0x52
jmp 0x180317942
invalid
int3

Function at 0x180317aa0
Capabilities:
Encode data using xor

Disassembly:
movabs rax, 0xef2f14ed1882670
imul rdx, rax
mov r8, rdx
rol r8, 4
xor r8, rdx
and r8, 0xffff
mov eax, dword [str.Y35]
imul eax, dword [0x180781f14]
or eax, 0x3baece63
sub eax, 0x7e8e6aed
or eax, 0x1419e019
cmp eax, 0x7abb0baf
jb 0x180317b12
jmp 0x180317ae4
mov edx, dword [0x180781f18]
imul edx, dword [0x180781f1c]
add edx, 0xdc6e2b10
xor edx, 0xaff2a5d4
and edx, 0xde01ae61
mov rax, rcx
add rax, r8
cmp edx, 0xf75fbb61
je 0x180317ae4
ret
jl 0x180317b35
jmp 0x180317b15
imul edx, edx, 0x1de37f35

Function at 0x180317c00
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x180781f30]
and ecx, dword [0x180781f34]
imul ecx, ecx, 0x54129086
sub ecx, 0x4f47f5ab
add ecx, 0xc9d08c5d
cmp ecx, 0x160e81bd
je 0x180317c93
jmp 0x180317c2b
mov r8d, dword [0x180781f38]
sub r8d, dword [0x180781f3c]
xor r8d, 0xcc4a9f
add r8d, 0x4906be66
or r8d, 0xf18153d6
mov r9, rdx
add r9, 0x5295f1ee
mov rcx, r9
mov ecx, ecx
rol rcx, 2
xor rcx, r9
cmp r8d, 0xfaf1a3a8
jbe 0x180317c2b
jmp 0x180317c6d
mov rdx, 0xffffffffc48a80c9
sub rdx, rcx
imul rdx, rdx, 0x506aaa6f
mov rcx, rdx
rol rcx, 3
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
ret
push 0xfffffffffffffffa
jp 0x180317c59
mov esp, 0xebd0888e
mov esp, cs
int3
Function at 0x180317d20
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov r9, r8
rol r9, 1
mov eax, dword [0x180781f50]
or eax, dword [0x180781f54]
add eax, 0xabc386cd
add eax, 0x9fc23162
xor eax, 0x9a085293
cmp eax, 0xf143d3a2
je 0x180317df7
mov eax, dword [0x180781f58]
xor edx, edx
div dword [0x180781f5c]
xor eax, 0x91056d48
xor eax, 0x376bfff
mov r10d, 0x563a4d8a
xor edx, edx
div r10d
mov rdx, r9
xor rdx, r8
imul rdx, rdx, 0x102ecd99
xor rdx, 0xffffffffbc2d7fe7
mov r10, rdx
rol r10, 6
cmp eax, 0x4137e29a
ja 0x180317df7
jmp 0x180317d96
mov eax, dword [0x180781f60]
imul eax, dword [0x180781f64]
sub eax, 0x1ceb5e2
sub eax, 0xe35f4fc9
sub eax, 0xd7b41280
cmp eax, 0x6fa1f1c9
jb 0x180317e08
jmp 0x180317dbb
mov eax, dword [0x180781f68]
xor eax, dword [0x180781f6c]
add eax, 0x4beb186f
imul r8d, eax, 0xb02803f3
sub r8d, 0xeecb56d2
mov r9, r10
xor r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0xca6a3b1d
ja 0x180317dbb
ret
pop rsp
pop rax
invalid
invalid

Function at 0x180317f40
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdx
shr r10, 0x12
xor r10, rdx
mov eax, dword [0x180781f90]
xor eax, dword [0x180781f94]
imul eax, eax, 0x48bcc9b6
mov r8d, 0x1df597f0
xor edx, edx
div r8d
imul eax, eax, 0x296fe431
cmp eax, 0x2fb0bd28
jb 0x180318018
mov eax, dword [0x180781f98]
imul eax, dword [0x180781f9c]
sub eax, 0x35485a4e
or eax, 0xc281ce7d
xor eax, 0xd287be22
mov rdx, 0xffffffffc1efcdec
sub rdx, r10
imul r8, rdx, 0x232feaf
mov r9, r8
rol r9, 1
cmp eax, 0x60a42b79
jae 0x180318018
jmp 0x180317fb4
mov eax, dword [0x180781fa0]
imul eax, dword [0x180781fa4]
mov r10d, 0xf74ac62e
xor edx, edx
div r10d
imul eax, eax, 0x1b8977ce
xor eax, 0xff678d63
cmp eax, 0x75120a37
je 0x180318025
mov edx, dword [0x180781fa8]
xor edx, dword [0x180781fac]
add edx, 0xa21cca56
and edx, 0x10508432
xor edx, 0xff172a87
mov r10, r9
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x3fd54fa7
jb 0x180318025
invalid
ret
pop rdx
or ecx, edx
out 0xbe, al
adc dword [rdi], ebx
invalid
xlatb
xor al, 0xa7
jge 0x180317fe0
or ebx, dword [rdx - 0x33501419]

Function at 0x180318850
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
add r8, 0x41ae7cf4
mov eax, dword [0x180782060]
sub eax, dword [0x180782064]
sub eax, 0xa4e3d496
or eax, 0xec06690f
xor eax, 0x929a7f4e
cmp eax, 0x41554b17
jbe 0x1803188d4
jmp 0x18031887e
mov eax, dword [0x180782068]
or eax, dword [0x18078206c]
imul eax, eax, 0x119c6826
add eax, 0xfded3af
mov r9d, 0x250cf7d9
xor edx, edx
div r9d
mov r9, r8
xor r9, 0x52e81dea
mov rdx, r9
shr rdx, 0x15
cmp eax, 0xb2e52f0f
jae 0x18031887e
invalid
jmp 0x1803188ba
xor rdx, r9
mov rax, rdx
rol rax, 2
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
adc al, ch
mov bh, 0xbb
jnp 0x1803188b7
lodsb al, byte [rsi]
jmp 0x18031887c
Function at 0x180318b30
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffffffffffff
imul rax, rdx, 0x57200449
mov rdx, rax
shr rdx, 1
xor rax, rdx
xor rax, 0xffffffffffffffff
mov rdx, rax
rol rdx, 3
xor rdx, rax
and rdx, 0xffff
mov eax, dword [0x1807820b0]
add eax, dword [0x1807820b4]
sub eax, 0x915b632
xor eax, 0x1fdb01d1
xor eax, 0xe09d5a39
cmp eax, 0x8f638688
je 0x180318bb0
jmp 0x180318b7d
mov r8d, dword [0x1807820b8]
xor r8d, dword [0x1807820bc]
or r8d, 0x1e0165c3
or r8d, 0xcd98eee5
or r8d, 0xf4cf4b70
mov rax, rcx
add rax, rdx
cmp r8d, 0xb447f1fb
jb 0x180318b7d
ret
xor byte [rax - 0x278c5e3b], ah
movsb byte [rdi], byte [rsi]
scasd eax, dword [rdi]
cwde
invalid

Function at 0x180318c60
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1807820d0]
xor edx, edx
div dword [0x1807820d4]
sub eax, 0xbe3b8bba
and eax, 0x266fcbe5
sub eax, 0xd7ea9e56
cmp eax, 0xc73088b4
ja 0x180318d38
mov eax, dword [0x1807820d8]
imul eax, dword [0x1807820dc]
imul eax, eax, 0xdbb61f38
imul eax, eax, 0xf62e683a
or eax, 0x48a308a
imul r9, r8, 0x6e56ee63
xor r9, 0x6a9d69b0
cmp eax, 0xf556dd7b
je 0x180318d38
jmp 0x180318cc0
mov eax, dword [0x1807820e0]
imul eax, dword [0x1807820e4]
mov r8d, 0xcb9e02d
xor edx, edx
div r8d
sub eax, 0x3f7e1673
or eax, 0x91d10af0
cmp eax, 0xd1e9975
je 0x180318d45
jmp 0x180318ceb
mov eax, dword [0x1807820e8]
xor edx, edx
div dword [0x1807820ec]
mov r8d, 0x347c1c3
xor edx, edx
div r8d
and eax, 0xc37db55b
mov r8d, 0x60b2f775
xor edx, edx
div r8d
mov edx, eax
mov r8, r9
rol r8, 3
xor r8, r9
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0x5e858ca6
je 0x180318ceb
invalid
jmp 0x180318d37
ret
sub byte [rbx + rax - 0x7a], bl
fsub st(7)
jno 0x180318d13
jmp 0x180318c8b
retf

Function at 0x180318d80
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1807820f0]
imul eax, dword [0x1807820f4]
mov r9d, 0xd5b101ee
xor edx, edx
div r9d
xor eax, 0x2ed81b0b
mov r9d, 0xbf928c2e
xor edx, edx
div r9d
cmp eax, 0xd9cfea9f
jae 0x180318e69
jmp 0x180318db8
mov eax, dword [0x1807820f8]
and eax, dword [0x1807820fc]
mov r9d, 0xcc1c24e8
xor edx, edx
div r9d
imul eax, eax, 0xd8f0271e
xor eax, 0x8b3a81e9
mov rdx, r8
shr rdx, 3
xor rdx, r8
imul r9, rdx, 0x1b9b79aa
cmp eax, 0x105b448a
jb 0x180318db8
jmp 0x180318df4
mov eax, dword [0x180782100]
sub eax, dword [0x180782104]
add eax, 0x78baf4f4
sub eax, 0xf35bd5f3
imul eax, eax, 0x3e16efed
cmp eax, 0x9b6021ac
je 0x180318e7a
mov eax, dword [0x180782108]
xor eax, dword [0x18078210c]
sub eax, 0xd3f0dd70
mov r8d, 0xee43a9fc
xor edx, edx
div r8d
or eax, 0x840a8b7b
movabs rdx, 0x10ecd25de1cac7f
mov r8, r9
add r8, rdx
mov rdx, r8
rol rdx, 7
xor rdx, r8
and rdx, 0xffff
cmp eax, 0xf48ec711
je 0x180318e7a
jmp 0x180318e62
add rcx, rdx
mov rax, rcx
ret
out dx, eax
cmp byte [rsi - 0x74], 0x18
invalid
invalid
Function at 0x180318f70
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x180782120]
xor ecx, dword [0x180782124]
imul ecx, ecx, 0xa76ae069
add ecx, 0x5ca5c421
and ecx, 0x7f791cd5
cmp ecx, 0x1fb13684
je 0x180319004
jmp 0x180318f9b
mov r8d, dword [0x180782128]
and r8d, dword [0x18078212c]
xor r8d, 0x1bc76941
sub r8d, 0x31785322
or r8d, 0x9e5f44de
mov rcx, rdx
rol rcx, 6
cmp r8d, 0x554c4454
jb 0x180318f9b
jmp 0x180318fd0
xor rcx, rdx
mov rdx, rcx
shr rdx, 0x10
xor rdx, rcx
mov ecx, 0x72a7ff65
sub rcx, rdx
mov rdx, rcx
shr rdx, 0x16
xor rdx, rcx
mov rcx, rdx
rol rcx, 7
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
ret
cld
js 0x180319044
in al, 0x5b
ja 0x18031905b
sbb eax, dword [rdx + 0x33]
insd dword [rdi], dx
shr ebx, 0x87
int3
add byte [rax], al
add byte [rbx + 0x4690eb05], cl
add byte [rbx], dh
add eax, 0x4690e9
jno 0x180318fef
lahf

Function at 0x180319020
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x180782130]
and eax, dword [0x180782134]
add eax, 0x8af05a59
sub eax, 0x86305c6d
imul eax, eax, 0xb0bbb021
cmp eax, 0x6f7ca57
je 0x1803190f4
mov eax, dword [0x180782138]
xor eax, dword [0x18078213c]
imul eax, eax, 0xe1ad0963
xor eax, 0x9f9271ed
imul eax, eax, 0xb6be050b
mov r9, 0xffffffffbceaf186
sub r9, rdx
mov r8, r9
shr r8, 6
xor r8, r9
add r8, 0xffffffffddec0957
mov r9, r8
rol r9, 1
cmp eax, 0x2c12538f
jb 0x1803190f4
jmp 0x18031908e
mov eax, dword [0x180782140]
imul eax, dword [0x180782144]
scasd eax, dword [rdi]
add eax, 0x4690a9
mov r10d, 0xa8ea4650
xor edx, edx
div r10d
xor eax, 0xfa788f54
xor eax, 0x9c7b38fb
cmp eax, 0xd8d1d17f
je 0x180319101
jmp 0x1803190b9
mov edx, dword [0x180782148]
or edx, dword [0x18078214c]
xor edx, 0x9cc3fc8
or edx, 0xe5c0a9a6
and edx, 0x55c6ea25
mov rax, r9
xor rax, r8
and rax, 0xffff
cmp edx, 0x36f58fb3
jb 0x1803190b9
jmp 0x1803190ed
add rcx, rax
mov rax, rcx
ret
mov ch, 5
push rbx
fst st(1)
je 0x180319095
invalid
in al, 0xd0
cmp byte [rbx + 0x3e6c2c53], bh
mov bl, 0xa8
shr byte [rdi - 0x15], cl
test al, 0xcc

Function at 0x1803198d0
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0x12d6096e
mov r8, rdx
rol r8, 1
xor r8, rdx
and r8, 0xffff
mov eax, dword [0x180782230]
imul eax, dword [0x180782234]
xor eax, 0x444200f2
sub eax, 0x6af9fda6
or eax, 0xb551fdfc
cmp eax, 0xbb1941e1
je 0x180319948
jmp 0x18031990c
mov eax, dword [0x180782238]
xor edx, edx
div dword [0x18078223c]
xor eax, 0x649bce5b
mov r9d, 0x72d6bf68
xor edx, edx
div r9d
mov r9d, 0x2cc2cc86
xor edx, edx
div r9d
mov edx, eax
mov rax, rcx
add rax, r8
cmp edx, 0x9359ab7d
jae 0x18031990c
jmp 0x180319947
ret
or qword [r14], rdx
mov ah, 0x1e
sbb al, 0x22
mov bh, 0xeb
mov eax, 0xcccccccc
int3