joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802fdee0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077f480]
sub eax, dword [0x18077f484]
and eax, 0xd7ddf95a
mov r9d, 0x5581aad6
xor edx, edx
div r9d
add eax, 0xa6a1d12a
cmp eax, 0xbd33951c
je 0x1802fdfc4
mov eax, dword [0x18077f488]
imul eax, dword [0x18077f48c]
or eax, 0xc258af08
xor eax, 0x36fb3f01
and eax, 0x9c813bb9
mov r9, r8
add r9, 0xffffffffedc8f2e5
cmp eax, 0xacb0fab4
jae 0x1802fdfc4
jmp 0x1802fdf42
mov eax, dword [0x18077f490]
and eax, dword [0x18077f494]
xor eax, 0x4f669a55
add eax, 0x4afc924a
xor eax, 0x71e06b33
cmp eax, 0xb978d45d
jbe 0x1802fdfd1
jmp 0x1802fdf66
mov eax, dword [0x18077f498]
add eax, dword [0x18077f49c]
mov r8d, 0x2b74dd07
xor edx, edx
div r8d
and eax, 0xe5ed67bc
add eax, 0x2400a334
mov rdx, r9
rol rdx, 5
mov r8, r9
xor r8, rdx
xor r8, 0xffffffffedf20b7c
mov rdx, r8
shr rdx, 0xa
xor rdx, r8
cmp eax, 0x45950afd
jae 0x1802fdf66
jmp 0x1802fdfae
mov rax, rdx
rol rax, 1
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
movabs al, byte [0xe9f50c9178360819]
invalid
scasb al, byte [rdi]
lodsd eax, dword [rsi]
outsb dx, byte [rsi]
invalid

Function at 0x1802fe2b0
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffffda52a769
add rdx, 0x435e5a45
mov r8, rdx
rol r8, 7
xor r8, rdx
and r8, 0xffff
mov eax, dword [0x18077f4e0]
add eax, dword [0x18077f4e4]
imul eax, eax, 0xba9890d0
imul eax, eax, 0x433d332d
xor eax, 0x24e213de
cmp eax, 0x8dba781a
jb 0x1802fe322
jmp 0x1802fe2f5
mov edx, dword [0x18077f4e8]
or edx, dword [0x18077f4ec]
and edx, 0xecd92683
add edx, 0x51896443
xor edx, 0x49c46ce1
mov rax, rcx
add rax, r8
cmp edx, 0xf2a3fa97
je 0x1802fe2f5
ret
retf 0x568

Function at 0x1802fe650
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077f540]
xor eax, dword [0x18077f544]
xor eax, 0x214d6514
or eax, 0xa93b5809
sub eax, 0xbd619b2d
cmp eax, 0x8f4b0af0
ja 0x1802fe749
jmp 0x1802fe67b
mov eax, dword [0x18077f548]
sub eax, dword [0x18077f54c]
mov r9d, 0xe078a76e
xor edx, edx
div r9d
mov r9d, 0x91ac55f0
xor edx, edx
div r9d
mov r9d, 0xfce39abe
xor edx, edx
div r9d
mov r9, r8
shr r9, 3
xor r9, r8
mov r10, r9
rol r10, 4
cmp eax, 0xcd0da895
je 0x1802fe67b
jmp 0x1802fe6c2
mov eax, dword [0x18077f550]
sub eax, dword [0x18077f554]
sub eax, 0x17022709
mov r8d, 0x18425b85
xor edx, edx
div r8d
mov r8d, 0x3da13922
xor edx, edx
div r8d
cmp eax, 0x238d5447
ja 0x1802fe75a
mov eax, dword [0x18077f558]
imul eax, dword [0x18077f55c]
imul r8d, eax, 0x8bdb8c32
xor r8d, 0x57b04d8e
xor r8d, 0xdfdc57ab
mov rdx, r10
xor rdx, r9
mov rax, rdx
rol rax, 1
cmp r8d, 0xbb4329f1
ja 0x1802fe75a
jmp 0x1802fe729
xor rax, rdx
add rax, 0xfffffffff7ad9532
mov rdx, rax
rol rdx, 1
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
jp 0x1802fe6d3
pop rsp
fidiv word [r10 - 0x6b]
cmp byte [rbx - 0x17], ch
invalid
and esi, ebp
push rcx
pop rdi
invalid
Function at 0x1802ff2e0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077f6a0]
add eax, dword [0x18077f6a4]
mov r9d, 0xbf7051d2
xor edx, edx
div r9d
or eax, 0x501ec9c8
and eax, 0x4ad22e20
cmp eax, 0xdec33777
je 0x1802ff3c2
jmp 0x1802ff311
mov edx, dword [0x18077f6a8]
add edx, dword [0x18077f6ac]
xor edx, 0xc600297c
add edx, 0x3ffb90ec
sub edx, 0x5d4b827a
mov eax, 0x7d4366df
sub rax, r8
cmp edx, 0xa4b3cdda
jb 0x1802ff311
jmp 0x1802ff341
xor rax, 0x48ef2b0d
mov r8, rax
rol r8, 1
xor r8, rax
mov r9, r8
rol r9, 3
mov eax, dword [0x18077f6b0]
xor eax, dword [0x18077f6b4]
or eax, 0x96b82898
or eax, 0xa00132d3
mov r10d, 0x2ce72016
xor edx, edx
div r10d
cmp eax, 0x4a81aaa8
je 0x1802ff3cf
jmp 0x1802ff381
mov eax, dword [0x18077f6b8]
add eax, dword [0x18077f6bc]
add eax, 0xa8c7a881
add eax, 0x1cf18032
imul edx, eax, 0x857a8d28
mov rax, r9
xor rax, r8
mov r10, rax
rol r10, 1
xor r10, rax
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x731802b0
ja 0x1802ff381
ret
adc al, byte [rdi]
ret 0x4f44
cmpsb byte [rsi], byte [rdi]
pop rsi
cmc
int1
jno 0x1802ff403
mov ch, ch
jmp 0x1802ff37f
add cl, byte [rax]
add eax, 0x17a09272
add eax, 0x396b63d2
sub eax, 0x30b5c2b3
cmp eax, 0xaab62e0e
ja 0x1802ff472
mov eax, dword [0x18077f6c8]
imul eax, dword [0x18077f6cc]
imul eax, eax, 0x975ab1af
mov r10d, 0x7a84f1c7
xor edx, edx
div r10d
mov edx, eax
xor edx, 0x2f0ff375
mov rax, r9
xor rax, r8
mov r10, rax
shr r10, 0x19
xor r10, rax
mov r11, r10
rol r11, 6
xor r11, r10
and r11, 0xffff
mov rax, rcx
add rax, r11
cmp edx, 0xd807520a
ja 0x1802ff472
ret
invalid

Function at 0x1802ff480
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
rol r8, 1
xor r8, rdx
xor r8, 0xffffffffb35a120e
add r8, 0xcdf5d85
mov eax, dword [0x18077f6d0]
xor eax, dword [0x18077f6d4]
imul eax, eax, 0xb98b420e
and eax, 0x14e4c5b2
and eax, 0x963afc8b
cmp eax, 0xb644838f
ja 0x1802ff4fa
jmp 0x1802ff4bc
mov edx, dword [0x18077f6d8]
sub edx, dword [0x18077f6dc]
xor edx, 0x79944696
and edx, 0x6e025fc5
and edx, 0x77b67793
mov r9, r8
rol r9, 3
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x80349c4
jb 0x1802ff4bc
ret
invalid
Function at 0x1802ff8f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x18077f740]
add eax, dword [0x18077f744]
xor eax, 0x9fd12456
or eax, 0x3d34fba3
xor eax, 0x35513ca4
cmp eax, 0x3d5bd023
jb 0x1802ff9d1
jmp 0x1802ff918
mov r9d, dword [0x18077f748]
sub r9d, dword [0x18077f74c]
add r9d, 0x5c1f23a4
xor r9d, 0x3f6171fb
or r9d, 0x3b9fd61
imul rax, rdx, 0x216a0f65
movabs r8, 0xf2b37827d21e3e8b
add rax, r8
mov r8, rax
shr r8, 0x13
cmp r9d, 0x58917cd9
jae 0x1802ff918
jmp 0x1802ff961
xor r8, rax
mov rax, 0xffffffffa6d0b189
sub rax, r8
mov r8, rax
rol r8, 7
xor r8, rax
and r8, 0xffff
mov eax, dword [0x18077f750]
sub eax, dword [0x18077f754]
xor eax, 0xf89e3f9d
or eax, 0x17343ad0
xor eax, 0x217a9332
cmp eax, 0x80312bf8
jae 0x1802ff9de
jmp 0x1802ff9a3
mov eax, dword [0x18077f758]
xor edx, edx
div dword [0x18077f75c]
and eax, 0x277133e3
imul edx, eax, 0xa7623ec5
add edx, 0x1e651dc7
mov rax, rcx
add rax, r8
cmp edx, 0xe66a8b09
je 0x1802ff9a3
ret
adc dl, cl
cwde
and dh, byte [rax]
invalid
shr byte [rsi - 0x23a77a33], cl
lock adc esi, dword [rbp - 0x66]
jae 0x1802ff9d6
mov ch, 0xcc
int3

Function at 0x1802ffea0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 5
xor rax, rdx
mov edx, dword [0x18077f7f0]
xor edx, dword [0x18077f7f4]
add edx, 0x6f858a6a
or edx, 0x13bbc461
or edx, 0xc5291f14
cmp edx, 0xc88d1d2a
jbe 0x1802fff80
jmp 0x1802ffed6
mov edx, dword [0x18077f7f8]
or edx, dword [0x18077f7fc]
xor edx, 0x3e400bd0
or edx, 0xf4bb1ea9
and edx, 0xb37a5daa
mov r9d, 0x70f5ee65
sub r9, rax
mov r8, r9
rol r8, 1
xor r9, r8
xor r9, 0xffffffffeb33c033
mov r8, r9
rol r8, 4
xor r8, r9
and r8, 0xffff
cmp edx, 0x45c63893
jb 0x1802ffed6
jmp 0x1802fff28
mov eax, dword [0x18077f800]
imul eax, dword [0x18077f804]
sub eax, 0x4edf51b8
mov r9d, 0xf5b34d12
xor edx, edx
div r9d
sub eax, 0xedabfe9f
cmp eax, 0xd6ee5b19
jae 0x1802fff8d
jmp 0x1802fff53
mov edx, dword [0x18077f808]
and edx, dword [0x18077f80c]
and edx, 0x876b2fae
or edx, 0xc163e32e
and edx, 0x77c05e25
mov rax, rcx
add rax, r8
cmp edx, 0x8d6e38e
je 0x1802fff53
ret
cmp bl, byte [rbx]
sbb dword [0x14ffb2d76], ecx
jmp 0x1802ffed4
dec byte [rax]
mov edi, 0x344fa8a
sbb dword [rax - 0x14719fdc], ebx
mov dh, 0xcc
int3

Function at 0x180300100
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
rol r8, 4
xor r8, rdx
mov eax, dword [str.WD_]
xor eax, dword [0x18077f844]
xor eax, 0xecc7c31b
or eax, 0x39aa3496
and eax, 0xfc702263
cmp eax, 0x4766171c
jbe 0x180300189
jmp 0x18030012e
mov eax, dword [0x18077f848]
xor edx, edx
div dword [0x18077f84c]
and eax, 0xe0a925df
mov r9d, 0xc1d83e51
xor edx, edx
div r9d
xor eax, 0x1ff73fed
mov rdx, r8
xor rdx, 0x5a2fb0ec
imul rdx, rdx, 0x47227ab1
cmp eax, 0x1b1f0631
jbe 0x18030012e
jmp 0x18030016b
add rdx, 0x52aa23ed
mov rax, rdx
rol rax, 4
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
sub bh, dh
cmp dword [rcx], ebx
idiv qword [rbp - 0x33661430]
int3
Function at 0x1803001d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077f850]
and eax, dword [0x18077f854]
mov r9d, 0xcb2d133f
xor edx, edx
div r9d
add eax, 0xb4a72d6a
sub eax, 0x4710a9b6
cmp eax, 0xc188c3e6
ja 0x1803002fb
mov eax, dword [0x18077f858]
xor eax, dword [0x18077f85c]
add eax, 0x6b848c96
imul eax, eax, 0x911c7854
xor eax, 0xd6da6645
mov rdx, r8
rol rdx, 3
xor rdx, r8
mov r10, rdx
rol r10, 6
xor r10, rdx
mov r9, r10
rol r9, 3
xor r9, r10
cmp eax, 0x5efa4cbd
ja 0x1803002fb
jmp 0x180300246
mov eax, dword [0x18077f860]
and eax, dword [0x18077f864]
add eax, 0x4b9fa5b9
xor eax, 0x1087952d
sub eax, 0x497f88c8
cmp eax, 0x7292498c
ja 0x180300308
jmp 0x18030026e
mov eax, dword [0x18077f868]
xor edx, edx
div dword [0x18077f86c]
sub eax, 0x2a9d2b56
or eax, 0x10573677
xor eax, 0xbec43803
mov r8, r9
and r8, 0xffff
cmp eax, 0x28b6094f
jbe 0x18030026e
jmp 0x18030029e
mov eax, dword [0x18077f870]
sub eax, dword [0x18077f874]
add eax, 0x474ca19a
sub eax, 0xf47d8809
and eax, 0xcd00c602
cmp eax, 0xd3a82cd1
ja 0x180300319
jmp 0x1803002c2
mov eax, dword [0x18077f878]
imul eax, dword [0x18077f87c]
sub eax, 0x61024804
mov r9d, 0x4f2a98e7
xor edx, edx
div r9d
mov r9d, 0x298ed370
xor edx, edx
div r9d
mov edx, eax
mov rax, rcx
add rax, r8
cmp edx, 0x580d5b1a
je 0x1803002c2
ret
mov edi, 0x2ff2e7e7
ret 0xfc78
xor ecx, dword [rax]
invalid
mov al, 0xd4
mov dh, 0xda
adc eax, 0x6e32d88f
push rcx
cdq
lodsb al, byte [rsi]
jmp 0x1803002c0

Function at 0x180300520
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077f8c0]
imul eax, dword [0x18077f8c4]
xor eax, 0xa0c89ee9
add eax, 0x1b6c5fbe
mov r9d, 0xaacbb2c3
xor edx, edx
div r9d
cmp eax, 0x8c41a66e
jae 0x180300604
jmp 0x180300552
mov eax, dword [0x18077f8c8]
add eax, dword [0x18077f8cc]
mov r9d, 0xbb5ffcf9
xor edx, edx
div r9d
sub eax, 0x56b2ebc7
xor eax, 0x1f99eea0
imul rdx, r8, 0xffffffffecd7af6f
movabs r9, 0xf739863618537aec
add rdx, r9
cmp eax, 0x99c803d3
jbe 0x180300552
jmp 0x180300590
mov eax, dword [0x18077f8d0]
sub eax, dword [0x18077f8d4]
add eax, 0x8049afe6
or eax, 0xeb4d9449
imul eax, eax, 0x4b375ad5
cmp eax, 0xc5a1c245
je 0x180300611
mov eax, dword [0x18077f8d8]
or eax, dword [0x18077f8dc]
or eax, 0xdeaa47eb
imul r8d, eax, 0x9f559294
sub r8d, 0x3ba317e4
mov rax, rdx
xor rax, 0xffffffffc4e4b5f0
cmp r8d, 0x59f7af28
jbe 0x180300611
jmp 0x1803005e6
add rax, 0x16129b36
mov rdx, rax
rol rdx, 7
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
mov ah, byte [rdx]
mov bh, 0x43
movabs al, byte [0xffffff3fe9288c6a]
add edi, dword [rdx - 0x6e566fee]
and al, 0xc4
jmp 0x1803005b3
Function at 0x180300800
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x405b5e2c
mov r8, rdx
rol r8, 4
xor r8, rdx
mov eax, dword [0x18077f900]
or eax, dword [0x18077f904]
and eax, 0x7f4abaa0
xor eax, 0x21a0fcad
mov r9d, 0xec7c3627
xor edx, edx
div r9d
cmp eax, 0x2a198405
jae 0x1803008dd
jmp 0x18030083f
mov eax, dword [0x18077f908]
sub eax, dword [0x18077f90c]
mov r9d, 0xcc78e930
xor edx, edx
div r9d
or eax, 0x7bd4b6a8
or eax, 0xac72598a
mov rdx, r8
rol rdx, 1
xor rdx, r8
imul r9, rdx, 0xffffffff81032512
mov rdx, r9
rol rdx, 2
xor rdx, r9
cmp eax, 0xbd51e0a2
jbe 0x18030083f
jmp 0x180300883
mov eax, dword [0x18077f910]
and eax, dword [0x18077f914]
sub eax, 0x89200c48
and eax, 0xb49170bd
add eax, 0xae08ccb5
cmp eax, 0x618de354
je 0x1803008ea
mov eax, dword [0x18077f918]
and eax, dword [0x18077f91c]
add eax, 0xc8b3a6b6
imul eax, eax, 0x187a7bf3
imul r8d, eax, 0x8aa4dd92
mov r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0x691b31bc
je 0x1803008ea
ret
invalid
or ch, dl
pop rbp
sub esp, dword [0x16cca1082]
int3

Function at 0x1803009f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077f940]
and eax, dword [0x18077f944]
mov r9d, 0x8bd6d13d
xor edx, edx
div r9d
and eax, 0xdee8a985
sub eax, 0xc8c527dc
cmp eax, 0x34a6d6fc
je 0x180300a85
jmp 0x180300a1d
mov edx, dword [0x18077f948]
xor edx, dword [0x18077f94c]
add edx, 0xf71c9d30
and edx, 0x9714b15d
and edx, 0xac0603c
mov r9, r8
rol r9, 7
xor r9, r8
mov rax, r9
shr rax, 0x11
xor rax, r9
cmp edx, 0xa11abba3
ja 0x180300a1d
jmp 0x180300a59
mov rdx, rax
rol rdx, 3
xor rdx, rax
mov rax, 0xffffffffc63622c8
sub rax, rdx
mov rdx, rax
rol rdx, 6
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
sbb byte [0x1a80c4324], sil
test eax, 0xf1df5db6
jmp 0x180300a1b

Function at 0x180300cb0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x18077f980]
or ecx, dword [0x18077f984]
xor ecx, 0x5dfcad2d
sub ecx, 0x2fb4f5ee
xor ecx, 0x1d6f5238
cmp ecx, 0x3549ebca
jb 0x180300d2f
jmp 0x180300cdb
mov r8d, dword [0x18077f988]
imul r8d, dword [0x18077f98c]
sub r8d, 0xa191d7e1
sub r8d, 0x1b44233
and r8d, 0xf59020e0
mov rcx, rdx
shr rcx, 1
xor rcx, rdx
imul r9, rcx, 0xffffffffd81ba6dc
mov rcx, r9
rol rcx, 2
xor rcx, r9
cmp r8d, 0xb22e7cce
je 0x180300cdb
jmp 0x180300d24
and rcx, 0xffff
add rax, rcx
ret
pop rax
ret 0x1dc7

Function at 0x180300e40
Capabilities:
Encode data using xor

Disassembly:
imul r8, rdx, 0xffffffffe3884127
movabs rax, 0x1b96237bea07cc5
add r8, rax
mov eax, dword [0x18077f9b0]
sub eax, dword [0x18077f9b4]
mov r9d, 0xc7f7298f
xor edx, edx
div r9d
imul eax, eax, 0x29c640a6
sub eax, 0x8a209638
cmp eax, 0x80d47af1
je 0x180300ec4
jmp 0x180300e7f
mov eax, dword [0x18077f9b8]
xor edx, edx
div dword [0x18077f9bc]
imul eax, eax, 0xac837d10
sub eax, 0x38eaa02f
mov r9d, 0x981e04db
xor edx, edx
div r9d
mov rdx, r8
rol rdx, 5
xor rdx, r8
cmp eax, 0xaef8ec04
ja 0x180300e7f
jmp 0x180300eb6
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
mov dword [rax + 0x139c0746], esp
iretd
Function at 0x180300ff0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x728605b6
sub rax, rdx
mov rdx, rax
rol rdx, 5
mov r8d, dword [0x18077f9e0]
imul r8d, dword [0x18077f9e4]
add r8d, 0xb037a866
imul r8d, r8d, 0x1d5f5a78
sub r8d, 0xf3b6001e
cmp r8d, 0xb617884f
ja 0x1803010e1
jmp 0x180301032
mov r8d, dword [0x18077f9e8]
or r8d, dword [0x18077f9ec]
imul r9d, r8d, 0x33f61eb0
sub r9d, 0x628069f8
or r9d, 0x88922e42
mov r10, rdx
xor r10, rax
add r10, 0x5a4fea86
mov r8, r10
rol r8, 4
xor r8, r10
and r8, 0xffff
cmp r9d, 0xe8baadc6
ja 0x180301032
jmp 0x18030107e
mov eax, dword [0x18077f9f0]
or eax, dword [0x18077f9f4]
mov r9d, 0x9296c9b1
xor edx, edx
div r9d
or eax, 0x46cbb80d
or eax, 0xcdc9b1e0
cmp eax, 0x3781ed94
jb 0x1803010ee
jmp 0x1803010a8
mov eax, dword [0x18077f9f8]
xor eax, dword [0x18077f9fc]
mov r9d, 0x243e483a
xor edx, edx
div r9d
mov r9d, 0xdddd6c67
xor edx, edx
div r9d
mov edx, eax
and edx, 0xb1c5647a
mov rax, rcx
mov eax, ecx
add rax, r8
cmp edx, 0x8b57e6dc
jae 0x1803010a8
ret
js 0x180301129
sbb byte [rsi], ah
pop rsi
mov dl, 0xf
jrcxz 0x1803010d3
invalid
invalid
add byte [rax], al
add bl, ch
add byte [rbx + 0x47e8d405], cl
add byte [rbx], ah
add eax, 0x47e8d2
mov eax, dword [0x18077fa08]
and eax, dword [0x18077fa0c]
add eax, 0x247c8eaa
add eax, 0x2796d451
and eax, 0x248d12bb
xor edx, edx
sub rdx, r8
mov r10, rdx
rol r10, 7
xor r10, rdx
xor r10, 0x37fd19cd
mov r9, r10
rol r9, 5
xor r9, r10
cmp eax, 0x50e6c97b
ja 0x18030112e
jmp 0x180301172
mov eax, dword [0x18077fa10]
and eax, dword [0x18077fa14]
sub eax, 0xd248a1af
sub eax, 0x1367c864
mov r8d, 0x23b02574
xor edx, edx
div r8d
cmp eax, 0x3433a261
je 0x180301236
mov eax, dword [0x18077fa18]
and eax, dword [0x18077fa1c]
imul eax, eax, 0x35351c84
add eax, 0x6c697904
or eax, 0x99a0e454
mov rdx, r9
rol rdx, 2
xor rdx, r9
and rdx, 0xffff
cmp eax, 0xaf346117
jbe 0x180301236
jmp 0x1803011d4
mov eax, dword [0x18077fa20]
add eax, dword [0x18077fa24]
add eax, 0xd7175c60
sub eax, 0x423a68d3
or eax, 0x2abcac8d
cmp eax, 0xc1e17233
jae 0x180301247
jmp 0x1803011f8
mov eax, dword [0x18077fa28]
or eax, dword [0x18077fa2c]
add eax, 0xd0c6bfac
and eax, 0xef6bddd4
imul r8d, eax, 0x5c409f1a
mov rax, rcx
add rax, rdx
cmp r8d, 0x1da2198
jbe 0x1803011f8
ret
add edi, dword [rbx + 0x25256130]
mov bl, 0xa8
invalid
invalid

Function at 0x180301290
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077fa30]
add eax, dword [0x18077fa34]
mov r9d, 0x2063e628
xor edx, edx
div r9d
or eax, 0x81df36d4
imul eax, eax, 0xae551427
cmp eax, 0x5e21ddeb
je 0x180301310
jmp 0x1803012be
mov eax, dword [0x18077fa38]
xor edx, edx
div dword [0x18077fa3c]
sub eax, 0xb1b2931d
sub eax, 0x4474574f
imul edx, eax, 0xa72bf1a5
mov rax, r8
add rax, 1
xor rax, 0x52e1840c
add rax, 0xfffffffff7c85770
cmp edx, 0x9a08d0b0
jae 0x1803012be
jmp 0x1803012f9
mov rdx, rax
rol rdx, 1
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
mov edx, 0x64ccc5d8
sbb dword [rcx], ebp
jmp 0x1803012bc
Function at 0x180301340
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077fa40]
and eax, dword [0x18077fa44]
xor eax, 0x1f7ebe8f
mov r9d, 0x238b5c7c
xor edx, edx
div r9d
or eax, 0x31d2f5cd
cmp eax, 0x61a8cc2c
jae 0x1803013cb
jmp 0x18030136d
mov eax, dword [0x18077fa48]
or eax, dword [0x18077fa4c]
and eax, 0x16b176e1
imul edx, eax, 0x8981c4f4
or edx, 0xd47fb7d2
mov rax, r8
xor rax, 0x29661a06
add rax, 1
cmp edx, 0x41198d8a
jb 0x18030136d
jmp 0x1803013a1
mov rdx, rax
rol rdx, 1
xor rdx, rax
mov rax, rdx
rol rax, 5
xor rax, rdx
mov rdx, rax
rol rdx, 1
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
int1
jo 0x1803013de
adc ch, dh
xlatb
sub bl, 0x96
int3
int3

Function at 0x1803023f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077fc00]
add eax, dword [0x18077fc04]
or eax, 0x26d59413
imul eax, eax, 0xe9b7c643
imul eax, eax, 0x7681cc0c
cmp eax, 0xdddb8955
ja 0x1803024d1
jmp 0x18030241d
mov eax, dword [0x18077fc08]
xor eax, dword [0x18077fc0c]
and eax, 0x146e725b
add eax, 0xb57aa139
mov r9d, 0xafa0f42a
xor edx, edx
div r9d
mov r9, r8
shr r9, 0x16
cmp eax, 0xc8f0b005
jae 0x18030241d
jmp 0x18030244e
mov eax, dword [0x18077fc10]
add eax, dword [0x18077fc14]
xor eax, 0x6247d7a1
sub eax, 0x7f122ca8
imul eax, eax, 0xe7b36d02
cmp eax, 0xa775e4ce
je 0x1803024e2
jmp 0x180302473
mov eax, dword [0x18077fc18]
sub eax, dword [0x18077fc1c]
xor eax, 0xd03e450c
and eax, 0x7cdcdb9e
mov r10d, 0x1031d425
xor edx, edx
div r10d
mov rdx, r9
xor rdx, r8
imul r10, rdx, 0x118d3e00
mov rdx, r10
rol rdx, 3
cmp eax, 0x4f7d0f65
ja 0x180302473
jmp 0x1803024b1
xor rdx, r10
xor eax, eax
sub rax, rdx
mov rdx, rax
rol rdx, 6
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
cld
mov ah, 0x5f
invalid
in al, 0x36
adc ebp, dword [rsi]
pop rsi
mov ch, 0x22
invalid

Function at 0x180302810
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077fc70]
and eax, dword [0x18077fc74]
imul eax, eax, 0xcbf5b7de
sub eax, 0x863fbee0
sub eax, 0x9b927eb7
cmp eax, 0xbfb62941
ja 0x180302895
jmp 0x180302838
mov eax, dword [0x18077fc78]
xor edx, edx
div dword [0x18077fc7c]
and eax, 0xda2a9da2
sub eax, 0xdcd6b6b1
add eax, 0x2eaabd29
xor edx, edx
sub rdx, r8
mov r9, rdx
shr r9, 0x1b
xor r9, rdx
add r9, 0x229bb499
mov rdx, r9
shr rdx, 0xa
xor rdx, r9
cmp eax, 0xcb9ab017
ja 0x180302838
jmp 0x18030287e
mov rax, rdx
rol rax, 5
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
mov al, 0x61
movsb byte [rdi], byte [rsi]
jg 0x180302905
mov dword [rcx + 0x7b], ecx
jmp 0x180302836
add eax, 0x695dbfba
Function at 0x1803028a0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077fc80]
sub eax, dword [0x18077fc84]
imul eax, eax, 0xe321097d
or eax, 0xb7e2b6c5
mov r9d, 0x9c43af12
xor edx, edx
div r9d
cmp eax, 0x746974a5
jae 0x18030298c
mov eax, dword [0x18077fc88]
add eax, dword [0x18077fc8c]
sub eax, 0x574b2054
imul edx, eax, 0x5c7d4b46
add edx, 0x872a0c07
mov rax, r8
xor rax, 0x701906f
cmp edx, 0x5efba6e7
ja 0x18030298c
jmp 0x180302904
add rax, 0x695dbfba
mov rdx, rax
shr rdx, 8
xor rdx, rax
mov r8d, 0x24d77c1b
sub r8, rdx
mov eax, dword [0x18077fc90]
xor edx, edx
div dword [0x18077fc94]
add eax, 0x7c66e01a
mov r9d, 0xcca443e2
xor edx, edx
div r9d
sub eax, 0xbc3a8eb2
cmp eax, 0x462f4c24
jae 0x180302999
jmp 0x180302949
mov eax, dword [0x18077fc98]
add eax, dword [0x18077fc9c]
sub eax, 0xcd5c5743
mov r9d, 0x20d5a02a
xor edx, edx
div r9d
mov edx, eax
xor edx, 0x90061e04
mov r9, r8
rol r9, 1
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x8b62a879
je 0x180302949
ret
jo 0x1803029f6
adc dword [rcx + 0x6d], 0xffffffc1
invalid
invalid
and eax, 0x2d81c94f
imul eax, eax, 0x3ed1a1f5
cmp eax, 0x2dc50207
je 0x180302ac0
mov r9d, dword [0x18077fca8]
add r9d, dword [0x18077fcac]
and r9d, 0x3aafb480
sub r9d, 0x69d82634
add r9d, 0xc1763684
mov rax, r8
xor rax, 0xffffffff88909351
add rax, 0x3cf329aa
mov rdx, rax
rol rdx, 7
cmp r9d, 0x77d419b1
jae 0x180302ac0
jmp 0x180302a50
xor rdx, rax
imul rax, rdx, 0x7a5aa956
mov rdx, rax
rol rdx, 7
xor rdx, rax
mov eax, dword [0x18077fcb0]
and eax, dword [0x18077fcb4]
sub eax, 0x42b3709b
imul eax, eax, 0x83328823
and eax, 0xfca93600
cmp eax, 0x45cabce9
je 0x180302acd
mov eax, dword [0x18077fcb8]
or eax, dword [0x18077fcbc]
and eax, 0x34e6b4fb
imul r8d, eax, 0xdf6b2890
and r8d, 0x5764663a
mov r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0x8fc68d52
ja 0x180302acd
ret
pop rbx
mov eax, 0xefbb1d3d
invalid
test al, 0xa6
xor eax, 0xdf378cb2
jmp 0x180302a87

Function at 0x180303600
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077fdf0]
and eax, dword [0x18077fdf4]
xor eax, 0xedd9de29
mov r9d, 0xd90a4fdb
xor edx, edx
div r9d
mov r9d, 0xa58aace2
xor edx, edx
div r9d
cmp eax, 0x65e10fe2
jae 0x1803036f0
jmp 0x180303637
mov eax, dword [0x18077fdf8]
imul eax, dword [0x18077fdfc]
xor eax, 0xad852996
and eax, 0x4c667f59
imul edx, eax, 0x82b29125
mov r9, r8
rol r9, 5
xor r9, r8
xor r9, 0x18ce2f6c
add r9, 0x33a6172b
mov rax, r9
rol rax, 5
xor rax, r9
cmp edx, 0x194fb02a
jbe 0x180303637
jmp 0x180303680
mov r8, rax
rol r8, 5
xor r8, rax
and r8, 0xffff
mov eax, dword [0x18077fe00]
imul eax, dword [0x18077fe04]
and eax, 0x30d33106
imul eax, eax, 0x2defd1a4
mov r9d, 0x3a5d17f7
xor edx, edx
div r9d
cmp eax, 0x320c298c
jae 0x180303701
mov eax, dword [0x18077fe08]
imul eax, dword [0x18077fe0c]
imul eax, eax, 0x804120c3
mov r9d, 0xcfc6c7d6
xor edx, edx
div r9d
mov edx, eax
or edx, 0x76a4a80f
mov rax, rcx
add rax, r8
cmp edx, 0xcc549a63
ja 0x180303701
ret
jmp 0x1803036a9
pop rsp
bt qword [rdx], 0x35
sub byte [rsi - 0x33334f15], dl
int3