joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802d8710
Capabilities:
Encode data using xor

Disassembly:
movabs r8, 0xffffffff6e3282a2
sub r8, rdx
mov eax, dword [0x18077b690]
xor eax, dword [0x18077b694]
sub eax, 0x3219bfc5
mov r9d, 0x7b828b0b
xor edx, edx
div r9d
xor eax, 0xa7495024
cmp eax, 0x62a9b7dd
jbe 0x1802d8790
jmp 0x1802d8747
mov eax, dword [0x18077b698]
imul eax, dword [0x18077b69c]
xor eax, 0x439f848c
imul eax, eax, 0x67c07677
imul edx, eax, 0xfbcff221
mov r9, r8
shr r9, 0x1f
xor r9, r8
mov rax, r9
rol rax, 2
xor rax, r9
and rax, 0xffff
cmp edx, 0xccad7b0b
je 0x1802d8747
jmp 0x1802d8789
add rcx, rax
mov rax, rcx
ret
xlatb
inc byte [rdi - 0x55]
push rdi
out dx, al
imul ebp, ebx, 0xccccccab
int3

Function at 0x1802d9660
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077b830]
or eax, dword [0x18077b834]
sub eax, 0x35fda5f
mov r9d, 0xec6f18f1
xor edx, edx
div r9d
imul eax, eax, 0x59094a2c
cmp eax, 0xf392f2e1
je 0x1802d978c
jmp 0x1802d9692
mov eax, dword [0x18077b838]
imul eax, dword [0x18077b83c]
xor eax, 0x6f45748
xor eax, 0x66047b4a
add eax, 0xfe48f6e
mov rdx, r8
rol rdx, 3
xor rdx, r8
imul r9, rdx, 0x366e6a44
cmp eax, 0x1bac026f
jb 0x1802d9692
jmp 0x1802d96c8
mov eax, dword [0x18077b840]
or eax, dword [0x18077b844]
mov r8d, 0x80441eb9
xor edx, edx
div r8d
or eax, 0x4a77e39b
imul eax, eax, 0x1505d17b
cmp eax, 0xbf4f790d
je 0x1802d979d
jmp 0x1802d96f7
mov eax, dword [0x18077b848]
add eax, dword [0x18077b84c]
add eax, 0x16f583ec
imul eax, eax, 0x73823ea3
or eax, 0x40df3369
mov rdx, r9
add rdx, 0x15887f43
mov r8, rdx
rol r8, 7
xor r8, rdx
and r8, 0xffff
cmp eax, 0xf2e8725a
ja 0x1802d96f7
jmp 0x1802d9737
mov eax, dword [0x18077b850]
sub eax, dword [0x18077b854]
xor eax, 0x47463a48
sub eax, 0x5ea8505d
mov r9d, 0xa6ca28f2
xor edx, edx
div r9d
cmp eax, 0x912ecbf5
jae 0x1802d97aa
mov edx, dword [0x18077b858]
or edx, dword [0x18077b85c]
and edx, 0xce3f4c07
sub edx, 0xce8a0fa3
or edx, 0xfdd90000
mov rax, rcx
add rax, r8
cmp edx, 0x15c7dbb9
jbe 0x1802d97aa
ret
invalid
invalid
retf 0xbb06
sbb ch, al
jrcxz 0x1802d9799
invalid

Function at 0x1802d9dd0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov r9, r8
rol r9, 6
mov eax, dword [0x18077b910]
sub eax, dword [0x18077b914]
add eax, 0xab1ebca9
imul eax, eax, 0x1a43d0a6
add eax, 0xb5cac8dd
cmp eax, 0xe49a63cf
jae 0x1802d9e50
jmp 0x1802d9dff
mov eax, dword [0x18077b918]
and eax, dword [0x18077b91c]
mov r10d, 0xd7dea200
xor edx, edx
div r10d
xor eax, 0xc9977fb
sub eax, 0x73c7feca
mov r10, r9
xor r10, r8
mov rdx, 0xffffffffb06cbbb1
sub rdx, r10
cmp eax, 0x7892cdc7
je 0x1802d9dff
jmp 0x1802d9e39
mov rax, rdx
rol rax, 7
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
test eax, 0x1e0b213
sbb ah, bl
adc ah, byte [rbp + riz*8 - 0x60148c4f]
int3
Function at 0x1802da5e0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
movabs rax, 0xe4841eecde8b2386
imul r8, rax
mov r10, r8
rol r10, 3
mov eax, dword [0x18077b9c0]
imul eax, dword [0x18077b9c4]
and eax, 0x7e42e40c
or eax, 0xb39a15dc
add eax, 0xb5a941c7
cmp eax, 0xca6fb8f1
jae 0x1802da6b7
jmp 0x1802da621
mov eax, dword [0x18077b9c8]
sub eax, dword [0x18077b9cc]
imul eax, eax, 0x6cfe18b
and eax, 0xf9ebdb27
mov r9d, 0x8a1fc7d0
xor edx, edx
div r9d
mov r9, r10
xor r9, r8
and r9, 0xffff
cmp eax, 0xb6998625
jae 0x1802da621
jmp 0x1802da659
mov eax, dword [0x18077b9d0]
sub eax, dword [0x18077b9d4]
or eax, 0x21ba6a47
mov r8d, 0xa14921e2
xor edx, edx
div r8d
and eax, 0xdbf5994d
cmp eax, 0x933fd9f9
movabs eax, dword [0x994d25f0f741d231]
cmc
fstp xword [0x1136d8078]
ja 0x1802da6c4
jmp 0x1802da683
mov eax, dword [0x18077b9d8]
imul eax, dword [0x18077b9dc]
imul eax, eax, 0x6638eb3b
sub eax, 0x317b507f
mov r8d, 0x4e37643f
xor edx, edx
div r8d
mov edx, eax
mov rax, rcx
add rax, r9
cmp edx, 0xc31f8481
ja 0x1802da683
ret
xchg edi, eax
cmc
jl 0x1802da66f
push rbx
movabs al, byte [0x9fffffff5be9addd]
lahf
push rdx
test eax, 0xe7eec962
jp 0x1802da6b8
mov bl, 0xcc
int3

Function at 0x1802da6d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077b9e0]
imul eax, dword [0x18077b9e4]
mov r9d, 0x8eab975e
xor edx, edx
div r9d
and eax, 0xe38d3923
mov r9d, 0xcf7e5960
xor edx, edx
div r9d
cmp eax, 0x36a94ed8
je 0x1802da7ae
mov eax, dword [str.zTG_4a]
add eax, dword [0x18077b9ec]
sub eax, 0xb0bba812
imul r9d, eax, 0xceee519a
add r9d, 0xfe7d473a
mov rax, 0xffffffff9662aec9
sub rax, r8
imul rdx, rax, 0x3d87e1b5
mov rax, rdx
rol rax, 1
xor rax, rdx
mov rdx, rax
rol rdx, 7
cmp r9d, 0xb4934479
ja 0x1802da7ae
stc
jns 0x1802da78f
xchg ebx, eax
mov ah, 0x77
pop rdi
jmp 0x1802da751
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov eax, dword [0x18077b9f0]
sub eax, dword [0x18077b9f4]
sub eax, 0x7f7d45fc
and eax, 0x494a05a5
add eax, 0x231d3072
cmp eax, 0xbefae5bb
ja 0x1802da7bb
jmp 0x1802da782
mov eax, dword [0x18077b9f8]
add eax, dword [0x18077b9fc]
mov r8d, 0xcc86af39
mov eax, 0xcc86af39
xor edx, edx
div r8d
xor eax, 0x598bd2a9
xor eax, 0x42922e80
cmp eax, 0x402b6af5
jae 0x1802da782
mov rax, rcx
ret
mov esp, 0xc815ee23
jae 0x1802da748
pop rdx
jmp 0x1802da706
push rdx
cwde
int1
test byte [rsi], cl
invalid
Function at 0x1802da860
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077ba10]
imul eax, dword [0x18077ba14]
imul eax, eax, 0x293651a1
sub eax, 0x5c419985
mov r9d, 0xa0c7bcd1
xor edx, edx
div r9d
cmp eax, 0xdf030b65
ja 0x1802da990
mov eax, dword [0x18077ba18]
xor edx, edx
div dword [0x18077ba1c]
xor eax, 0xe3d3da4e
and eax, 0x42bdb694
or eax, 0x8cf09015
imul rdx, r8, 0x5cc20589
mov r10, rdx
shr r10, 0x1b
xor r10, rdx
mov r9, r10
shr r9, 0x1c
xor r9, r10
cmp eax, 0xca4ab101
jb 0x1802da990
jmp 0x1802da8d6
mov eax, dword [0x18077ba20]
and eax, dword [0x18077ba24]
add eax, 0xecf927d8
add eax, 0x85f15de2
mov r8d, 0x71b576a4
xor edx, edx
div r8d
cmp eax, 0xd6d4d69e
ja 0x1802da99d
mov eax, dword [0x18077ba28]
or eax, dword [0x18077ba2c]
and eax, 0x7c3fcd54
add eax, 0xd311e9d1
xor eax, 0x8d1db15b
mov r8, r9
rol r8, 1
xor r8, r9
cmp eax, 0x613a407d
je 0x1802da99d
jmp 0x1802da92f
mov eax, dword [0x18077ba30]
add eax, dword [0x18077ba34]
mov r9d, 0x7313989f
xor edx, edx
div r9d
add eax, 0x3f0d286a
and eax, 0xa7a3c5d1
cmp eax, 0x429df5b6
ja 0x1802da9aa
jmp 0x1802da959
mov edx, dword [0x18077ba38]
xor edx, dword [0x18077ba3c]
add edx, 0xbff311b8
or edx, 0x194813d9
and edx, 0xf1f9c05d
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x432f07e5
je 0x1802da959
ret
movsb byte [rdi], byte [rsi]
pop rcx
ror dword [rbx + 0x583b1a44], 0xe9
hlt
adc byte [rsi + rax*8], bl
test byte [rbp - 0x1644aff4], ah
pop rax
invalid
invalid

Function at 0x1802daa00
Capabilities:
Encode data using xor

Disassembly:
mov r8, 0xffffffffaa441735
sub r8, rdx
mov r9, r8
rol r9, 5
mov eax, dword [0x18077ba40]
sub eax, dword [0x18077ba44]
xor eax, 0x23488c11
and eax, 0xd13ec028
sub eax, 0xf5aa527a
cmp eax, 0x73db3c22
jbe 0x1802daa72
jmp 0x1802daa35
mov eax, dword [0x18077ba48]
xor edx, edx
div dword [0x18077ba4c]
imul eax, eax, 0x4caf1458
imul eax, eax, 0x4d89fb0a
imul edx, eax, 0x61f50b33
mov rax, r9
xor rax, r8
and rax, 0xffff
cmp edx, 0x58cd06a7
je 0x1802daa35
jmp 0x1802daa6b
add rcx, rax
mov rax, rcx
ret
call 0x18c7aba2a
add dword [rdi + 5], esp
xchg edx, eax
pcmpeqd mm0, qword [rax - 0x15]
mov bl, 0x48
imul rax, rdx, 0xffffffff96c55684

Function at 0x1802dab10
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077ba60]
imul eax, dword [0x18077ba64]
and eax, 0x6d165d2f
mov r9d, 0x9a456778
xor edx, edx
div r9d
sub eax, 0xbf6612da
cmp eax, 0xc0ae6095
ja 0x1802dabfa
jmp 0x1802dab42
mov r9d, dword [0x18077ba68]
imul r9d, dword [0x18077ba6c]
and r9d, 0x4841f02d
and r9d, 0x83b15f51
and r9d, 0x6198bfbe
mov rdx, r8
rol rdx, 1
xor rdx, r8
mov rax, rdx
xor rax, 0xffffffffffffffff
cmp r9d, 0xc697091e
jae 0x1802dab42
jmp 0x1802dab81
rol rax, 2
xor rdx, rax
xor rdx, 0xffffffffc617dc37
mov r8, rdx
rol r8, 2
mov eax, dword [0x18077ba70]
sub eax, dword [0x18077ba74]
sub eax, 0x51276917
or eax, 0x9fde415d
and eax, 0x5df4d46a
cmp eax, 0x4586ccb0
jae 0x1802dac0b
jmp 0x1802dabba
mov r9d, dword [0x18077ba78]
sub r9d, dword [0x18077ba7c]
or r9d, 0x70a83f27
xor r9d, 0x1397a9ba
xor r9d, 0x38d65721
mov r10, r8
xor r10, rdx
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r9d, 0x953c6a32
ja 0x1802dabba
ret
hlt
invalid
Function at 0x1802db590
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x7a0f173e
sub rax, rdx
imul rax, rax, 0xffffffff93a940df
xchg ebx, eax
add rax, 0x5384793d
mov rdx, rax
rol rdx, 2
xor rdx, rax
and rdx, 0xffff
mov eax, dword [0x18077bb80]
or eax, dword [0x18077bb84]
loop 0x1802db5b2
invalid
inc dword [rax]
add byte [rbx + 0x4a05c405], cl
add byte [rbx], cl
add eax, 0x4a05c2
imul eax, eax, 0xbdf0f815
xor eax, 0x70718a99
imul eax, eax, 0xe40ea00a
cmp eax, 0xa4568fc6
je 0x1802db60f
jmp 0x1802db5dc
mov r8d, dword [0x18077bb88]
or r8d, dword [0x18077bb8c]
or r8d, 0xe82eba5e
xor r8d, 0xea3394f6
add r8d, 0xfe8d5be8
mov rax, rcx
add rax, rdx
cmp r8d, 0x80ca820c
jae 0x1802db5dc
ret
loope 0x1802db5b1
push rdi
jmp 0x1802db59e

Function at 0x1802dbc20
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077bc30]
and eax, dword [0x18077bc34]
or eax, 0x5e468acd
imul eax, eax, 0xa4194804
or eax, 0x90be7815
cmp eax, 0xdd3c0acc
ja 0x1802dbcad
jmp 0x1802dbc48
mov eax, dword [0x18077bc38]
add eax, dword [0x18077bc3c]
or eax, 0xfa5de9
add eax, 0xe73b1d3d
mov r9d, 0xde1bd960
xor edx, edx
div r9d
xor edx, edx
sub rdx, r8
mov r9, rdx
shr r9, 9
xor r9, rdx
mov rdx, r9
rol rdx, 3
xor rdx, r9
cmp eax, 0x9314c4f0
jae 0x1802dbc48
jmp 0x1802dbc8b
mov rax, 0xffffffff96397568
sub rax, rdx
mov rdx, rax
rol rdx, 6
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
in eax, 0x21
outsd dx, dword [rsi]
pushfq
adc ebp, dword [rdx - 0x70145e35]
int3

Function at 0x1802dbfd0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077bca0]
add eax, dword [0x18077bca4]
mov r9d, 0xbc286fe
xor edx, edx
div r9d
sub eax, 0x9b3aabdc
and eax, 0xf6f4eced
cmp eax, 0x84710a09
ja 0x1802dc0a8
jmp 0x1802dc001
mov eax, dword [0x18077bca8]
imul eax, dword [0x18077bcac]
or eax, 0x9ea4206f
or eax, 0x417d51b8
mov r9d, 0x8dd8cb13
xor edx, edx
div r9d
mov rdx, r8
xor rdx, 0xffffffffa119607c
mov r9, rdx
shr r9, 0xb
xor r9, rdx
cmp eax, 0x956a3b98
jae 0x1802dc001
jmp 0x1802dc040
mov eax, dword [0x18077bcb0]
add eax, dword [0x18077bcb4]
mov r8d, 0x136ff490
xor edx, edx
div r8d
sub eax, 0x9c947371
xor eax, 0xcbcac0ed
cmp eax, 0x759a61b2
jb 0x1802dc0b9
jmp 0x1802dc06a
mov edx, dword [0x18077bcb8]
sub edx, dword [0x18077bcbc]
add edx, 0x2625c72c
add edx, 0x43371764
or edx, 0xec859bb6
mov rax, r9
rol rax, 1
cmp edx, 0x45690699
je 0x1802dc06a
jmp 0x1802dc098
xor rax, r9
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
add cl, byte [rax - 0x2e1282d2]
outsb dx, byte ss:[rsi]
scasb al, byte [rdi]
movabs al, byte [0x7bffffff46e93682]
test dword [0x1a1a96de6], edx
jnp 0x1802dc040
adc eax, 0x217bad26
hlt
Function at 0x1802dc160
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x18077bcd0]
add eax, dword [0x18077bcd4]
imul eax, eax, 0xa5f1c69d
or eax, 0xa7c10c46
add eax, 0x39aa9510
cmp eax, 0x82f76f9c
ja 0x1802dc22a
jmp 0x1802dc189
mov r8d, dword [0x18077bcd8]
xor r8d, dword [0x18077bcdc]
sub r8d, 0x39af1cc0
or r8d, 0xae63419b
xor r8d, 0x3c1d5ee5
mov r9, rdx
add r9, 0x3a0e451d
xor r9, 0x329f0d6d
mov rax, r9
rol rax, 6
xor rax, r9
and rax, 0xffff
cmp r8d, 0x96696a61
je 0x1802dc189
jmp 0x1802dc1d8
add rcx, rax
mov eax, dword [0x18077bce0]
add eax, dword [0x18077bce4]
or eax, 0xbc6b1cf6
or eax, 0x8c673144
imul eax, eax, 0x9aafb460
cmp eax, 0x52a51f09
jae 0x1802dc23b
mov eax, dword [0x18077bce8]
and eax, dword [0x18077bcec]
xor eax, 0xf17ebf4d
mov r8d, 0xa9a4caab
xor edx, edx
div r8d
and eax, 0x43c3a720
cmp eax, 0xd963b5d6
jae 0x1802dc23b
mov rax, rcx
ret
invalid
shr ecx, 0xd4
enter 0xffffffffffffa80b, 0xfffffffffffffff5
jmp 0x1802dc1fe

Function at 0x1802dc5f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x18077bd50]
imul ecx, dword [0x18077bd54]
sub ecx, 0xaecbef6c
xor ecx, 0x3585f1b6
add ecx, 0xd6f83241
cmp ecx, 0x724a1f6d
jb 0x1802dc67e
jmp 0x1802dc61c
mov ecx, dword [0x18077bd58]
imul ecx, dword [0x18077bd5c]
or ecx, 0x469de981
imul r8d, ecx, 0xfdc00fb1
or r8d, 0xe7303640
movabs rcx, 0x8e05ee09
mov r9, rdx
add r9, rcx
mov rcx, r9
shr rcx, 0x1f
xor r9, rcx
xor r9, 0x260f063e
mov rcx, r9
rol rcx, 6
xor rcx, r9
and rcx, 0xffff
cmp r8d, 0xb09b36bf
je 0x1802dc61c
jmp 0x1802dc67a
add rax, rcx
ret
movabs eax, dword [0xae68bb791ab3db26]
and al, 0x19
jmp 0x1802dc61a

Function at 0x1802dc690
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x3de48aa3
add rdx, 1
mov rax, rdx
rol rax, 6
mov r8d, dword [0x18077bd60]
sub r8d, dword [0x18077bd64]
xor r8d, 0x6809b5bd
and r8d, 0x217cd79a
and r8d, 0xc1dfa214
cmp r8d, 0xd3326b91
jae 0x1802dc780
jmp 0x1802dc6d4
mov r10d, dword [0x18077bd68]
sub r10d, dword [0x18077bd6c]
or r10d, 0x11516bd
add r10d, 0x20c7943
sub r10d, 0xd5a50c23
mov r8, rax
xor r8, rdx
mov r9, r8
rol r9, 4
cmp r10d, 0xcea0ad3
jbe 0x1802dc6d4
jmp 0x1802dc70f
mov eax, dword [0x18077bd70]
or eax, dword [0x18077bd74]
mov r10d, 0xf4608118
xor edx, edx
div r10d
mov r10d, 0xd1f8a156
xor edx, edx
div r10d
add eax, 0x6010323b
cmp eax, 0xa2cee9c
je 0x1802dc78d
or dh, byte [rax + rdx*2 - 0x15]
add byte [rbx + 0x49f63305], cl
add byte [rbx], dh
add eax, 0x49f631
jmp 0x1802dc73f
mov eax, dword [0x18077bd78]
xor eax, dword [0x18077bd7c]
mov r10d, 0x922e8800
xor edx, edx
div r10d
mov edx, eax
xor edx, 0xac86a5eb
or edx, 0x1136ca2f
mov r10, r9
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xb4f77d8b
jb 0x1802dc73f
ret
and dword [rbx - 7], 0xc
outsb dx, byte [rsi]
and al, 0x11
add eax, 0xffff45e9
push qword [rbx]
loop 0x1802dc73a
xor esp, edx
stosb byte [rdi], al
scasq rax, qword [rdi]
cwde
adc dword [rdi], 0xcccca6eb
int3
Function at 0x1802dc7a0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077bd80]
add eax, dword [0x18077bd84]
mov r9d, 0xa6bc771e
xor edx, edx
div r9d
add eax, 0xc1bdff58
imul eax, eax, 0x361e1490
cmp eax, 0xda8c22bd
jae 0x1802dc87b
mov eax, dword [0x18077bd88]
and eax, dword [0x18077bd8c]
add eax, 0x8e880925
or eax, 0xa7dd4c81
and eax, 0x1a57cecc
mov rdx, r8
xor rdx, 0xffffffffffffffff
mov r9, rdx
shr r9, 0xa
xor r9, rdx
cmp eax, 0x465994b4
ja 0x1802dc87b
jmp 0x1802dc805
mov eax, dword [0x18077bd90]
and eax, dword [0x18077bd94]
mov r8d, 0x8ee706ce
xor edx, edx
div r8d
sub eax, 0x10b3068a
add eax, 0x9dbdb25f
cmp eax, 0x55d3e7a7
je 0x1802dc88c
jmp 0x1802dc82f
mov edx, dword [0x18077bd98]
xor edx, dword [0x18077bd9c]
and edx, 0xbe4f468e
xor edx, 0xa2292bf7
and edx, 0x9480f745
imul rax, r9, 0xffffffffea894c60
xor rax, 0xffffffffaf266147
cmp edx, 0x80e993bb
jae 0x1802dc82f
jmp 0x1802dc864
mov rdx, rax
rol rdx, 1
xor rdx, rax
and rdx, 0xffe9
add rcx, rdx
mov rax, rcx
ret
add ebx, dword cs:[rdx - 0x5cb7da5a]
je 0x1802dc8d1
invalid
movabs eax, dword [0xeb197e533490ca36]
xchg edi, eax
int3
xor eax, 0x49f4d6

Function at 0x1802dcfe0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077be60]
sub eax, dword [str.ojH_f]

Function at 0x1802dd6f0
Capabilities:
Encode data using xor

Disassembly:
imul rax, rdx, 0x322976b4
xor rax, 0xffffffff9e7928d9
add rax, 0x57cbdfc3
xor rax, 0xffffffffdfe95448
mov r8, rax
rol r8, 1
xor r8, rax
mov eax, dword [0x18077bf10]
sub eax, dword [0x18077bf14]
sub eax, 0xaa40ce0b
mov r9d, 0x555ec5e6
xor edx, edx
div r9d
add eax, 0x5f5eb18d
cmp eax, 0xb7c1fe25
ja 0x1802dd773
jmp 0x1802dd73c
mov edx, dword [0x18077bf18]
add edx, dword [str._io_]
add edx, 0x7ecef9fc
add edx, 0x950b8c0d
xor edx, 0x86737316
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xdb6f938e
je 0x1802dd73c
ret
jp 0x1802dd7a5
mov edi, 0xabafd64c
invalid
rol dword [rbx], 0x31
ror dword [rdi], 1
mov bh, 0xc9
add rax, rcx
ret
Function at 0x1802dd7b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0xffffffffffffffff
mov rcx, rdx
shr rcx, 0x16
mov r8d, dword [0x18077bf20]
sub r8d, dword [0x18077bf24]
and r8d, 0x7317a091
imul r8d, r8d, 0x47d59092
add r8d, 0x42325345
cmp r8d, 0x7171b9e3
jbe 0x1802dd83d
jmp 0x1802dd7ec
mov r9d, dword [0x18077bf28]
imul r9d, dword [0x18077bf2c]
xor r9d, 0xaa610cb1
xor r9d, 0xb2749a4d
sub r9d, 0xd2eaadb1
mov r10, rcx
xor r10, rdx
add r10, 0x51ea021c
mov r8, r10
rol r8, 7
xor r8, r10
cmp r9d, 0x3b64e62f
jb 0x1802dd7ec
jmp 0x1802dd832
and r8, 0xffff
add rax, r8
ret
and ch, byte [rdx - 0x34]
jge 0x1802dd87d
scasd eax, dword [rdi]
jrcxz 0x1802dd861
jl 0x1802dd896
sub ebx, ebp
lahf
int3
iretd
int3
add byte [rbx], ch
add eax, 0x49e697
and eax, 0x7eb92bfa
and eax, 0x973891ce
mov r10d, 0xa2e201e6
xor edx, edx
div r10d
cmp eax, 0xe0e39f09
je 0x1802dd90d
mov eax, dword [0x18077bf38]
and eax, dword [0x18077bf3c]
and eax, 0x8bc64829
imul eax, eax, 0xd1ddcf26
mov r10d, 0x79b8a345
xor edx, edx
div r10d
mov edx, eax
mov rax, r9
xor rax, r8
imul rax, rax, 0x5177c21a
xor rax, 0xffffffffffffffff
mov r10, rax
rol r10, 1
xor r10, rax
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x8977ab48
jae 0x1802dd90d
ret
mov cl, al
test eax, 0x4b0f4ca8
mov byte [rax + 0xb], r8b
jmp 0x1802dd8b9

Function at 0x1802de220
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077c040]
or eax, dword [0x18077c044]
xor eax, 0x1f812644
xor eax, 0x768aa5f9
mov r9d, 0x4f19e437
xor edx, edx
div r9d
cmp eax, 0xad723a61
je 0x1802de306
jmp 0x1802de251
mov eax, dword [0x18077c048]
or eax, dword [0x18077c04c]
add eax, 0x293dfba5
mov r9d, 0xbbb7cc1e
xor edx, edx
div r9d
sub eax, 0x8d70cae5
movabs r9, 0x1ad17c66fd19500
mov rdx, r8
imul rdx, r9
mov r9, rdx
rol r9, 4
cmp eax, 0xb3b2d69a
je 0x1802de251
jmp 0x1802de293
xor r9, rdx
mov r8, r9
rol r8, 7
mov eax, dword [0x18077c050]
sub eax, dword [0x18077c054]
and eax, 0x2fb3cf52
imul eax, eax, 0x6973bbc5
imul eax, eax, 0xa911cc8a
cmp eax, 0xc04757bb
jae 0x1802de317
jmp 0x1802de2c3
mov eax, dword [0x18077c058]
xor edx, edx
div dword [0x18077c05c]
mov r10d, 0x412877e9
xor edx, edx
div r10d
mov edx, eax
or edx, 0xae9fe622
add edx, 0x8a68a55b
mov r10, r8
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x3af96d5a
ja 0x1802de2c3
ret
ror dword [rax], 1
stc
invalid
sub ah, byte [rcx + 0x7cad44f0]
jae 0x1802de340
or ebp, 0x9ceb94cd
int3
add ecx, dword [rax + 0x31]
ror dword [rax + 0x69], 1
leave
stosb byte [rdi], al
pop r8
invalid
Function at 0x1802de760
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x18077c0c0]
xor eax, dword [0x18077c0c4]
or eax, 0xc4c559e4
sub eax, 0x2f0892ad
xor eax, 0xab7723f7
cmp eax, 0xda47f0fb
ja 0x1802de834
jmp 0x1802de788
mov eax, dword [0x18077c0c8]
sub eax, dword [0x18077c0cc]
imul r8d, eax, 0x4d01da36
add r8d, 0x16b2c69d
add r8d, 0x6e5e1660
mov rax, rdx
shr rax, 0xe
xor rax, rdx
cmp r8d, 0x297a1089
jbe 0x1802de788
jmp 0x1802de7be
imul rdx, rax, 0x410887f0
mov eax, dword [0x18077c0d0]
and eax, dword [0x18077c0d4]
or eax, 0x10f82e6
or eax, 0x5950948f
add eax, 0xfd064dbe
cmp eax, 0xb0da0374
jae 0x1802de841
mov r8d, dword [0x18077c0d8]
add r8d, dword [0x18077c0dc]
xor r8d, 0xf5da7d1c
or r8d, 0xbb960cf9
and r8d, 0xb942a6b8
mov rax, rdx
add rax, 0x1234157f
mov r9, rax
rol r9, 3
xor r9, rax
and r9, 0xfff7
mov rax, rcx
add rax, r9
cmp r8d, 0x58b60f36
je 0x1802de841
movzx ebx, byte ss:[rax + 0x74]
invalid
ret
jne 0x1802de8a6
sahf
invalid
jbe 0x1802de82d
xor al, 0x39
add eax, 0xb55c75cd
out dx, al
cmp rax, 0x49cc98eb
mov r8, rdx
mov eax, dword [0x18077c0e0]
imul eax, dword [0x18077c0e4]
sub eax, 0x7a60e9b1
xor eax, 0xf7ddff93
sub eax, 0x64914add
cmp eax, 0x9335d9f8
je 0x1802de8cb
mov eax, dword [0x18077c0e8]
and eax, dword [0x18077c0ec]
sub eax, 0xa1551576
mov r9d, 0x9663fe46
xor edx, edx
div r9d
sub eax, 0x988b2589
imul rdx, r8, 0xffffffff8bc7f005
movabs r9, 0xfa651670ca963fd0
cli
add rdx, r9
cmp eax, 0xf5b175e9
je 0x1802de8cb
jmp 0x1802de8b4
mov rax, rdx
rol rax, 7
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
mov ch, 0x13
cmp al, 0x42
fsubr dword [rbx - 0x61]
ret

Function at 0x1802df210
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077c1f0]
xor eax, dword [0x18077c1f4]
imul eax, eax, 0xfb1bd2c4
or eax, 0x245286f
xor eax, 0x9f20d32f
cmp eax, 0x7446b737
je 0x1802df2d9
jmp 0x1802df23c
mov eax, dword [0x18077c1f8]
xor edx, edx
div dword [0x18077c1fc]
sub eax, 0x25287d5c
xor eax, 0x1422fa7f
sub eax, 0xd068ae19
movabs rdx, 0xffffffff3c504f89
mov r9, r8
add r9, rdx
cmp eax, 0xc9c8a925
jb 0x1802df23c
jmp 0x1802df272
mov eax, dword [0x18077c200]
xor edx, edx
div dword [0x18077c204]
imul eax, eax, 0xcf0740c4
sub eax, 0xb6a3d905
and eax, 0x9d931d80
cmp eax, 0x4edb0ffc
je 0x1802df2e6
mov eax, dword [0x18077c208]
add eax, dword [0x18077c20c]
sub eax, 0xd6bd6747
mov r8d, 0x3db7777
xor edx, edx
div r8d
and eax, 0xaa17ed0b
mov rdx, r9
rol rdx, 4
xor rdx, r9
cmp eax, 0xb4268d61
ja 0x1802df2e6
jmp 0x1802df2cb
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
int 0xaa
in eax, dx
adc esi, ebx
push bp
xlatb
jmp 0x1802df23a
push rbp
in eax, dx
or dl, ch
mov fs, word [0x128194b43]
Function at 0x1802df510
Capabilities:
Encode data using xor

Disassembly:
imul r8, rdx, 0x1d2df178
mov r9, r8
rol r9, 7
mov eax, dword [0x18077c240]
and eax, dword [0x18077c244]
mov r10d, 0x694e475b
xor edx, edx
div r10d
or eax, 0xc899f379
mov r10d, 0x4bac9263
xor edx, edx
div r10d
cmp eax, 0xb7c422ca
ja 0x1802df59c
jmp 0x1802df54e
mov edx, dword [str.J9gF:J9s14z]
imul edx, dword [0x18077c24c]
sub edx, 0x2dbee28
sub edx, 0xb4ff542f
and edx, 0x1c4bf590
mov rax, r9
xor rax, r8
mov r10d, 0x3dd37bb6
sub r10, rax
mov r11, r10
rol r11, 6
xor r11, r10
and r11, 0xffff
mov rax, rcx
add rax, r11
cmp edx, 0xe7e4ac00
ja 0x1802df54e
ret
imul edx, dword [rcx - 0x6432e41c], 0xa6ebb559
int3

Function at 0x1802df940
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
xor rcx, 0xffffffff8094329e
mov r8d, dword [0x18077c2b0]
add r8d, dword [0x18077c2b4]
xor r8d, 0xa7a34c3b
sub r8d, 0x336211d5
imul r8d, r8d, 0xc94998a
cmp r8d, 0xe80266af
jbe 0x1802df9d6
jmp 0x1802df97b
mov r9d, dword [0x18077c2b8]
or r9d, dword [0x18077c2bc]
sub r9d, 0x25698e7b
or r9d, 0x573baf46
or r9d, 0xa5ba5cbf
mov r8, rcx
rol r8, 6
xor r8, rdx
xor r8, 0x7f6bcd61
imul r10, r8, 0xfffffffff116c3f8
mov r8, r10
rol r8, 7
xor r8, r10
and r8, 0xffff
cmp r9d, 0xd800efe4
jbe 0x1802df97b
jmp 0x1802df9d2
add rax, r8
ret
add byte [rax - 0x11], ch
or eax, 0xeb4560db
cdq

Function at 0x1802dfbb0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077c2e0]
xor eax, dword [0x18077c2e4]
mov r9d, 0x70cac2af
xor edx, edx
div r9d
imul eax, eax, 0x77aeb13b
sub eax, 0x7b4741e3
cmp eax, 0xf1d246cb
jb 0x1802dfc9e
mov eax, dword [0x18077c2e8]
imul eax, dword [0x18077c2ec]
add eax, 0x1c192518
or eax, 0x235744c5
imul r9d, eax, 0xc539d5f1
mov rax, r8
add rax, 0x107607cb
mov rdx, rax
shr rdx, 0x10
cmp r9d, 0x6797a3c9
jb 0x1802dfc9e
jmp 0x1802dfc1d
mov r8d, dword [0x18077c2f0]
sub r8d, dword [0x18077c2f4]
add r8d, 0x30020901
xor r8d, 0x8090462
sub r8d, 0x9e0dd5f2
cmp r8d, 0xaf853f9e
je 0x1802dfcaf
jmp 0x1802dfc4b
mov r9d, dword [0x18077c2f8]
xor r9d, dword [0x18077c2fc]
and r9d, 0xf1b2476b
sub r9d, 0x4aec9dea
add r9d, 0x1855b447
mov r10, rdx
xor r10, rax
add r10, 0xfffffffff2364374
mov r8, r10
rol r8, 5
xor r8, r10
cmp r9d, 0x97ce0e59
jae 0x1802dfc4b
jmp 0x1802dfc90
and r8, 0xffff
add rcx, r8
mov rax, rcx
ret
xchg edx, eax
fsub qword [rax - 0x3b]
stosd dword [rdi], eax
invalid
invalid