joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180233da0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x18051dfe8]
or eax, dword [0x18051dfec]
and eax, 0x4923e6ca
and eax, 0xaf628629
add eax, 0x83bffb62
cmp eax, 0x6e50523b
je 0x18023418b
jmp 0x180233dd5
mov eax, dword [0x18051dff0]
or eax, dword [0x18051dff4]
imul ecx, eax, 0x82c072
and ecx, 0xea19af97
xor ecx, 0xd1aaa5cd
mov rax, rsi
add rax, 0x18
cmp ecx, 0x1dc75df1
je 0x180233dd5
jmp 0x180233e04
mov cl, byte [rax]
movzx eax, cl
test cl, cl
je 0x180233e2e
jmp 0x180233e0f
mov ecx, eax
sub ecx, 3
invalid
je 0x180233e48
jmp 0x180233e18
sub eax, 4
je 0x180233ed7
jmp 0x180233e23
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rdx, qword [rsi]
cmp rdx, 0
je 0x180233e23
mov rcx, qword [rsi + 8]
mov r8d, 1
call fcn.1802cbf20
jmp 0x180233e23
mov rax, rsi
add rax, 0x20
cmp word [rax], 3
sete al
test al, 1
jne 0x180233e5c
jmp 0x180233e23
add rsi, 0x28
mov rsi, qword [rsi]
mov eax, dword [0x18051dff8]
and eax, dword [0x18051dffc]
xor eax, 0x8ff2ac95
or eax, 0xa588701c
sub eax, 0x948f0625
cmp eax, 0x22b8fa83
jbe 0x18023419c
mov eax, dword [0x18051e000]
xor edx, edx
div dword [0x18051e004]
xor eax, 0xf8c745fa
mov ecx, 0x46cf1faf
xor edx, edx
div ecx
mov edi, eax
add edi, 0xbf1e7d05
mov rcx, rsi
call fcn.180405e10
cmp edi, 0x4eaecb69
jbe 0x18023419c
test al, 1
jne 0x180233eca
jmp 0x180233e23
mov rcx, rsi
call fcn.180407050
jmp 0x180233e23
mov al, byte [rsi + 0xb8]
cmp al, 3
sete al
test al, 1
jne 0x180233ee8
jmp 0x180233ef6
mov rcx, rsi
add rcx, 0x70
call fcn.180235e70
jmp 0x180233ef6
mov eax, dword [rsi + 0x28]
cmp eax, 0
sete al
test al, 1
jne 0x180233f2a
jmp 0x180233f05
mov rdx, qword [rsi + 0x40]
cmp rdx, 0
je 0x180233f2a
mov rax, rsi
add rax, 0x30
mov rcx, qword [rax]
shl rdx, 5
mov r8d, 4
call fcn.1802cbf20
jmp 0x180233f2a
mov rcx, qword [rsi + 0x20]
mov eax, dword [0x18051e008]
xor edx, edx
div dword [0x18051e00c]
and eax, 0xafce22
and eax, 0x473eb550
mov r8d, 0xddab539c
xor edx, edx
div r8d
cmp eax, 0x6ed6fb61
ja 0x1802341b5
mov eax, dword [0x18051e010]
xor eax, dword [0x18051e014]
add eax, 0x8f9a75cd
mov r8d, 0x2eb925ef
xor edx, edx
div r8d
mov r8d, 0x8a9e6843
xor edx, edx
div r8d
cmp rcx, 0
sete dl
cmp eax, 0x6687cce1
jae 0x1802341b5
jmp 0x180233f97
test dl, 1
jne 0x180233e23
jmp 0x180233fa2
mov rax, rcx
and rax, 3
lea rdx, [0x180486440]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
invalid
xor dword [rdi], ecx
invalid
pop rax
enter 0xffffffffffff92ee, 0xffffffffffffffd6
ror dword [rbx + rbx], cl
invalid
mov esi, 0x9eb959f7
fdiv qword [rbx + 0x7a]
and eax, 0x48025de5
mov ecx, esi
call fcn.180405e10
jmp 0x180233e89
jb 0x18023416a
cmp byte [rbp], ah
invalid
Function at 0x1802357b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, rsi
call fcn.1802b7070
mov r14, rsi
add r14, 0x18
mov rdi, qword [r14]
cmp rdi, 0xffffffffffffffff
je 0x1802358a9
mov r15, rsi
add r15, 0x20
mov rbx, qword [rsi + 0x20]
cmp rbx, 0
sete al
test al, 1
jne 0x18023584a
jmp 0x1802357f2
mov rcx, rbx
call fcn.18041b8c0
mov rax, qword [rbx]
lock dec qword [rax]
sete al
test al, 1
jne 0x18023580a
jmp 0x180235814
mov rcx, rbx
call fcn.180279160
jmp 0x180235814
add rbx, 8
mov rax, qword [rbx]
lock dec qword [rax]
sete al
test al, 1
jne 0x180235828
jmp 0x180235832
mov rcx, rbx
call fcn.180272d20
jmp 0x180235832
mov rcx, qword [r15]
mov edx, 0x20
mov r8d, 8
call fcn.1802cbf20
mov rdi, qword [r14]
jmp 0x18023584a
mov eax, dword [0x18051e278]
imul eax, dword [0x18051e27c]
xor eax, 0xb14da4f
add eax, 0xb339ec02
and eax, 0x72e3f83d
cmp eax, 0xb218728c
ja 0x1802359cf
jmp 0x180235873
mov eax, dword [0x18051e280]
xor eax, dword [0x18051e284]
mov ecx, 0xf491c8f6
xor edx, edx
div ecx
mov ebx, eax
sub ebx, 0xcfb9d03d
xor ebx, 0xe0f70d78
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
cmp ebx, 0xf52237c4
ja 0x180235873
jmp 0x1802358a9
mov rcx, rsi
call fcn.180405bd0
mov rax, qword [rsi]
mov rcx, rsi
add rcx, 8
cmp rax, 0
jne 0x1802358de
mov rax, qword [rcx]
lock dec qword [rax]
sete al
test al, 1
jne 0x1802358d4
jmp 0x1802359a2
call fcn.180275eb0
jmp 0x1802359a2
mov eax, dword [0x18051e288]
and eax, dword [0x18051e28c]
and eax, 0xe01b4fa8
imul eax, eax, 0xc218ce96
add eax, 0x6931e1cd
cmp eax, 0x2a67f192
jbe 0x1802359e9
mov eax, dword [0x18051e290]
and eax, dword [0x18051e294]
mov r8d, 0xe36950c0
xor edx, edx
div r8d
imul eax, eax, 0xc891d725
or eax, 0x92bc9261
mov r8, qword [rcx]
cmp eax, 0x2ac47ba4
jb 0x1802359e9
jmp 0x180235937
mov eax, dword [0x18051e298]
imul eax, dword [0x18051e29c]
or eax, 0x26f593eb
mov r9d, 0x52e5057c
xor edx, edx
div r9d
and eax, 0x91bb318f
cmp eax, 0x67523dc2
jae 0x1802359fa
mov eax, dword [0x18051e2a0]
and eax, dword [0x18051e2a4]
mov r9d, 0x52d5f8e0
xor edx, edx
div r9d
add eax, 0x9ebef945
imul edx, eax, 0x8473f936
lock dec qword [r8]
sete al
cmp edx, 0xc300b932
jb 0x1802359fa
test al, 1
jne 0x18023599b
jmp 0x1802359a2
call fcn.180279770
jmp 0x1802359a2
mov rcx, rsi
add rcx, 0x10
mov rax, qword [rsi + 0x10]
lock dec qword [rax]
sete al
jmp 0x1802359b6
test al, 1
jne 0x1802359bc
jmp 0x1802359c3
call fcn.180274de0
jmp 0x1802359c3
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
invalid
je 0x1802359c5
jne 0x180235a3d
push rcx
adc al, 0xdd
jbe 0x180235a52
invalid
invalid
in eax, 0xc1
movsb byte [rdi], byte [rsi]
imul ebp, dword [rbx - 0xf417], 0xffffffff
jae 0x1802359f0
cmp eax, 0x5f1128ff
cmp al, 0xf0
dec qword [r8]
sete al
jmp 0x180235964
Function at 0x180235e70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x18051e2f8]
or eax, dword [0x18051e2fc]
imul eax, eax, 0x429ab652
sub eax, 0x69ecf26
xor eax, 0xdd8c8eb7
cmp eax, 0x87b2e0a
je 0x1802360c2
jmp 0x180235ea3
mov eax, dword [0x18051e300]
add eax, dword [0x18051e304]
and eax, 0x4b5c396f
mov ecx, 0xe1f87c03
xor edx, edx
div ecx
sub eax, 0x45a6f8b6
mov rcx, rsi
add rcx, 0x40
cmp eax, 0xbc661058
ja 0x180235ea3
jmp 0x180235ed2
movzx eax, byte [rcx]
test eax, eax
je 0x180235eee
jmp 0x180235edb
sub eax, 3
je 0x1802360b1
jmp 0x180235ee6
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov eax, dword [0x18051e308]
xor edx, edx
div dword [0x18051e30c]
sub eax, 0x1ed462a4
mov ecx, 0x74abc199
xor edx, edx
div ecx
add eax, 0x6866e244
cmp eax, 0x405f14a1
je 0x1802360cf
jmp 0x180235f1c
mov eax, dword [0x18051e310]
xor eax, dword [0x18051e314]
add eax, 0x7d906e95
and eax, 0x4d0c3b62
imul eax, eax, 0x90b0e948
mov rbx, rsi
add rbx, 8
cmp eax, 0x9f95c9c1
jbe 0x180235f1c
jmp 0x180235f48
mov rdi, qword [rbx]
cmp rdi, 0
sete cl
mov eax, dword [0x18051e318]
imul eax, dword [0x18051e31c]
imul eax, eax, 0x7f441b6b
imul eax, eax, 0xc4a97a6b
and eax, 0x18bb04e8
cmp eax, 0x19f28ddd
je 0x1802360e0
mov eax, dword [0x18051e320]
xor eax, dword [0x18051e324]
imul eax, eax, 0x1aabae5a
mov r8d, 0xb7911366
xor edx, edx
div r8d
or eax, 0xa803ff0
cmp eax, 0xc02869d8
jae 0x1802360e0
test cl, 1
jne 0x180236056
jmp 0x180235fb3
mov rcx, rdi
call fcn.18041b8c0
mov rax, qword [rdi]
lock dec qword [rax]
sete al
test al, 1
jne 0x180235fcb
jmp 0x180235fd5
mov rcx, rdi
call fcn.180279160
jmp 0x180235fd5
add rdi, 8
mov rax, qword [rdi]
lock dec qword [rax]
sete al
test al, 1
je 0x180235ff1
mov rcx, rdi
call fcn.180272d20
jmp 0x180235ff1
mov rcx, qword [rbx]
mov edx, 0x20
mov r8d, 8
call fcn.1802cbf20
mov eax, dword [0x18051e328]
xor edx, edx
div dword [0x18051e32c]
or eax, 0xd3810a35
add eax, 0x6027cb43
and eax, 0x927e4d14
cmp eax, 0xb7f6e2ee
ja 0x1802360ed
mov eax, dword [0x18051e330]
xor edx, edx
div dword [0x18051e334]
sub eax, 0xc48a8622
or eax, 0xe7a6e7de
sub eax, 0x2f0c7509
cmp eax, 0x303ba5ec
jb 0x1802360ed
jmp 0x180236056
mov rcx, qword [rsi]
call qword [sym.imp.ws2_32.dll_closesocket]
mov eax, dword [0x18051e338]
or eax, dword [0x18051e33c]
mov ecx, 0xb4f5e717
xor edx, edx
div ecx
cmc
mov ah, 0x31
sal bh, cl
int1
mov ecx, 0xf4d76e7a
xor edx, edx
div ecx
and eax, 0x294aaf1d
cmp eax, 0x57b78044
jae 0x1802360fa
mov eax, dword [0x18051e340]
or eax, dword [0x18051e344]
or eax, 0xb54d97b3
imul eax, eax, 0x1a3fc57c
xor eax, 0x7dd3a274
cmp eax, 0xa6b5667f
jae 0x1802360fa
jmp 0x180235ee6
add rsi, 0x10
mov rcx, rsi
call fcn.1802357b0
jmp 0x180235ee6
pop rbx
jae 0x18023606e
sub r11d, dword [rbp - 0x31]
cmp eax, 0xfffdd2e9
dec ebp
nop
int 0x90
int3
or edi, edi
cmpsd dword [rsi], dword [rdi]
push rcx
push rdi
adc al, byte [rbp + 0x41]
jmp 0x180235f7b
invalid
add ebp, dword [rax]
xchg ebx, eax
out dx, eax
adc dh, byte [rbx - 0x7a1478c4]
int3
Function at 0x180238bc0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, r8
mov r12, rdx
mov rdi, rcx
mov rsi, rdi
mov rdx, qword [r12]
mov r15, qword [r12 + 8]
mov r13, qword [r12 + 0x10]
mov rcx, r14
mov r8, r15
mov r9, r13
call fcn.180284fd0
mov rbx, rdx
mov rcx, rax
sub rcx, 2
sete bpl
test rax, 0xfffffffffffffffd
je 0x180238c23
jmp 0x180238c10
mov qword [rdi], 1
add rdi, 8
mov qword [rdi], rbx
jmp 0x180238ce8
add r12, 0x18
mov rdx, qword [r12]
mov rcx, r14
mov r8, r13
mov r9, r15
call fcn.180284d50
mov rcx, rdx
mov rdx, rax
sub rdx, 2
sete dl
test rax, 0xfffffffffffffffd
je 0x180238cb0
jmp 0x180238c50
mov qword [rdi], 1
add rdi, 8
mov eax, dword [0x18051e6f8]
xor eax, dword [0x18051e6fc]
imul eax, eax, 0x28de6cd1
sub eax, 0xec80339f
mov r8d, 0x36a3690b
xor edx, edx
div r8d
cmp eax, 0x5d7c28ab
je 0x180238cfc
jmp 0x180238c86
mov eax, dword [0x18051e700]
xor edx, edx
div dword [0x18051e704]
imul eax, eax, 0x1b25c991
xor eax, 0x3e219250
and eax, 0x2a268be2
mov qword [rdi], rcx
cmp eax, 0x8ca3726d
ja 0x180238c86
sub cl, byte [rax - 0x77]
invalid
jmp 0x180238ce8
test bpl, 1
jne 0x180238cbf
jmp 0x180238cb8
test dl, 1
jne 0x180238cdf
jmp 0x180238cc8
mov qword [rdi], 2
jmp 0x180238ce8
mov qword [rdi], 0
mov rax, rdi
add rax, 8
mov qword [rax], rbx
mov qword [rdi + 0x10], rcx
jmp 0x180238ce8
mov qword [rdi], 2
jmp 0x180238ce8
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
je 0x180238ca3
pop rbx
pop rdi
jno 0x180238d66
invalid
add byte [rax + 0x29], cl
invalid
Function at 0x180246aa0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov al, byte [rsi + 0x10]
movzx eax, al
mov ecx, eax
sub ecx, 3
je 0x180246ad6
jmp 0x180246abe
sub eax, 4
je 0x180246bb2
jmp 0x180246ac9
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, rsi
add rax, 0x18
mov ax, word [rax]
cmp ax, 3
jne 0x180246ac9
mov eax, dword [0x18051f160]
and eax, dword [0x18051f164]
imul eax, eax, 0xae1f97c1
mov ecx, 0x48141e20
xor edx, edx
div ecx
and eax, 0x904a9567
cmp eax, 0xd59077c7
ja 0x180246ebd
jmp 0x180246b13
mov eax, dword [0x18051f168]
add eax, dword [0x18051f16c]
add eax, 0xb8812b26
xor eax, 0x8c458bb6
mov ecx, 0x64a85d6f
xor edx, edx
div ecx
mov rcx, rsi
add rcx, 0x20
cmp eax, 0xa3a67ddf
ja 0x180246b13
jmp 0x180246b42
mov rsi, qword [rcx]
mov rcx, rsi
call fcn.180405e10
test al, 1
jne 0x180246b56
jmp 0x180246ac9
mov eax, dword [0x18051f170]
xor eax, dword [0x18051f174]
or eax, 0xa969278
and eax, 0x7c01a34f
imul eax, eax, 0x72bac46
cmp eax, 0x2aeda5f5
jb 0x180246ece
jmp 0x180246b7f
mov eax, dword [0x18051f178]
and eax, dword [0x18051f17c]
add eax, 0x7492c842
and eax, 0xd4156ffe
imul edi, eax, 0xe1f01d16
mov rcx, rsi
call fcn.180407050
cmp edi, 0x961a06df
ja 0x180246b7f
jmp 0x180246bad
jmp 0x180246ac9
mov rax, rsi
add rax, 0xb0
cmp byte [rax], 3
sete al
test al, 1
jne 0x180246bc7
jmp 0x180246bd5
mov rcx, rsi
add rcx, 0x68
call fcn.180248ec0
jmp 0x180246bd5
mov rax, rsi
add rax, 0x20
mov eax, dword [rax]
cmp eax, 0
je 0x180246c0d
mov rdx, qword [rsi + 0x38]
cmp rdx, 0
sete al
test al, 1
jne 0x180246c0d
jmp 0x180246bf4
mov rax, rsi
add rax, 0x28
mov rcx, qword [rax]
shl rdx, 5
mov r8d, 4
call fcn.1802cbf20
mov rcx, qword [rsi + 0x18]
cmp rcx, 0
sete al
test al, 1
jne 0x180246ac9
jmp 0x180246c22
mov eax, dword [0x18051f180]
and eax, dword [0x18051f184]
and eax, 0x535d6fb7
sub eax, 0x11b03124
xor eax, 0x27c3cd25
cmp eax, 0x3ef30fbe
je 0x180246ee7
mov eax, dword [0x18051f188]
xor edx, edx
div dword [0x18051f18c]
xor eax, 0x91b89417
imul eax, eax, 0xb151a34a
imul eax, eax, 0xae1ccabe
cmp eax, 0xe088a4c0
jae 0x180246ee7
jmp 0x180246c74
mov rax, rcx
and rax, 3
mov edx, dword [0x18051f190]
xor edx, dword [0x18051f194]
or edx, 0xbe5e27d3
xor edx, 0x8413a500
and edx, 0x3291e70b
cmp edx, 0xe4389c4d
je 0x180246ef8
mov edx, dword [0x18051f198]
and edx, dword [0x18051f19c]
and edx, 0xd52e0d8a
and edx, 0xa370eb
or edx, 0x1979ea3
cmp edx, 0x9e1cf866
jae 0x180246ef8
lea rdx, [0x1804869a0]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
invalid
mul al
invalid
imul ecx, dword [rcx - 0xb], 0xffffff98
movabs al, byte [0xe9e50a990c9f7e30]
push rax
std
invalid
invalid
Function at 0x18025e260
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov bpl, dl
mov rdi, rcx
cmp bpl, 0
sete cl
cmp rsi, 0
setl al
test cl, 1
jne 0x18025e289
jmp 0x18025e37b
xor ecx, ecx
test al, 1
jne 0x18025e3d9
jmp 0x18025e295
cmp rsi, 0
sete al
mov ebx, 1
test al, 1
jne 0x18025e3d7
jmp 0x18025e2ab
mov eax, dword [0x1805205e8]
and eax, dword [0x1805205ec]
imul eax, eax, 0x88337aa4
xor eax, 0x3991b822
add eax, 0xdea9d425
cmp eax, 0x73b6a663
je 0x18025e3f8
mov eax, dword [0x1805205f0]
sub eax, dword [0x1805205f4]
add eax, 0xaa64e1d4
xor eax, 0x57530b87
mov ecx, 0xfb0ad13c
xor edx, edx
div ecx
mov ebp, eax
mov rcx, rsi
mov edx, 1
call fcn.1802cbf40
mov rbx, rax
cmp ebp, 0x293f5fcd
jae 0x18025e3f8
jmp 0x18025e311
cmp rbx, 0
sete al
mov ecx, 1
test al, 1
jne 0x18025e3d9
jmp 0x18025e327
mov eax, dword [0x1805205f8]
imul eax, dword [0x1805205fc]
sub eax, 0x2f384f7f
mov ecx, 0x30749a1f
xor edx, edx
div ecx
add eax, 0x57eefc33
cmp eax, 0x9bc34e63
jae 0x18025e416
jmp 0x18025e354
mov eax, dword [0x180520600]
and eax, dword [0x180520604]
xor eax, 0x9403fa35
sub eax, 0x74fe90e6
imul eax, eax, 0xa73ff81d
cmp eax, 0x497c66e2
jbe 0x18025e354
jmp 0x18025e379
jmp 0x18025e3d7
xor ecx, ecx
test al, 1
jne 0x18025e3bf
jmp 0x18025e383
cmp rsi, 0
sete al
mov ebx, 1
test al, 1
jne 0x18025e3c7
jmp 0x18025e395
mov al, byte [0x1805297c8]
mov rcx, rsi
mov edx, 1
call fcn.1802cbf10
mov rbx, rax
cmp rbx, 0
sete al
mov ecx, 1
test al, 1
jne 0x18025e3bf
jmp 0x18025e3bd
jmp 0x18025e3c7
mov rdx, rsi
call fcn.180407090
mov rcx, rbx
mov dl, bpl
mov r8, rsi
call fcn.1804691b0
jmp 0x18025e3e1
jmp 0x18025e3e1
mov rdx, rsi
call fcn.180407090
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rsi
mov rax, rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
adc edi, edx
invalid
sal byte [rsi + 0x3d63aad0], cl
jl 0x18025e478
stosd dword [rdi], eax
adc edx, edi
mov ebp, 0xffff2be9
dec esp
int3
mov eax, dword [0x180520610]
sub al, 0
or eax, dword [0x180520614]
imul eax, eax, 0x22daf5c9
xor eax, 0x7dc48431
imul ecx, eax, 0xa4e1e343
cmp rbx, 0
sete al
cmp ecx, 0xc602769f
je 0x18025e474
test al, 1
jne 0x18025e4d4
jmp 0x18025e4a6
mov rbx, rdi
jmp 0x18025e4ab
add rbx, 1
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
lea r8, [0x18048a720]
call fcn.18044f2d0
cmp rbx, rsi
mov rdi, rbx
jne 0x18025e4ab
jmp 0x18025e4d4
lea rcx, [rsp + 0x30]
call fcn.18044f400
and al, 1
movzx eax, al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x18025e500
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r8, rdx
mov rsi, rcx
mov eax, dword [0x180520618]
imul eax, dword [0x18052061c]
xor eax, 0x2d0b0827
xor eax, 0xa0d9d481
imul eax, eax, 0x9589d40f
cmp eax, 0x1fafb050
jb 0x18025e5e3
jmp 0x18025e539
mov eax, dword [0x180520620]
xor eax, dword [0x180520624]
imul eax, eax, 0x4e73dedc
mov ecx, 0xe3875b50
xor edx, edx
div ecx
add eax, 0x4feca9fb
mov rcx, r8
add rcx, 0x10
cmp eax, 0xc1f50e32
jae 0x18025e539
jmp 0x18025e569
mov rbx, qword [r8 + 8]
mov rdi, qword [rcx]
xor ecx, ecx
cmp rdi, 0
jl 0x18025e5b5
cmp rdi, 0
sete al
mov r14d, 1
test al, 1
jne 0x18025e5bd
jmp 0x18025e58b
mov al, byte [0x1805297c8]
mov rcx, rdi
mov edx, 1
call fcn.1802cbf10
mov r14, rax
cmp r14, 0
sete al
mov ecx, 1
test al, 1
jne 0x18025e5b5
jmp 0x18025e5b3
jmp 0x18025e5bd
mov rdx, rdi
call fcn.180407090
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.180468b10
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
movabs al, byte [0xe9c9e5524cb88280]
invalid

Function at 0x18025ecc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rax, rcx
add rax, 8
mov rsi, qword [rax]
mov rdi, qword [rcx + 0x10]
cmp rdi, 0
sete al
test al, 1
jne 0x18025edcb
jmp 0x18025ece6
xor ebx, ebx
jmp 0x18025ecea
lea rcx, [rbx + rbx*4]
lea rax, [rsi + rcx*8]
inc rbx
mov rdx, qword [rsi + rcx*8]
movabs rcx, 0x8000000000000000
mov r8, rdx
xor r8, rcx
mov rcx, r8
sub rcx, 5
mov ecx, 5
cmovb rcx, r8
mov r8, rcx
sub r8, 4
jb 0x18025ed4a
jmp 0x18025ed24
sub rcx, 4
je 0x18025ed2c
jmp 0x18025ed53
add rax, 8
mov rdx, qword [rax]
movabs rcx, 0x8000000000000002
cmp rdx, rcx
setl cl
test cl, 1
jne 0x18025ed6a
jmp 0x18025ed53
add rax, 8
mov rdx, qword [rax]
jmp 0x18025ed53
cmp rdx, 0
je 0x18025ed6a
mov rcx, qword [rax + 8]
mov r8d, 1
call fcn.1802cbf20
jmp 0x18025ed6a
mov eax, dword [0x180520670]
add eax, dword [0x180520674]
imul eax, eax, 0x380dcbdd
mov ecx, 0x1ec30fa3
xor edx, edx
div ecx
imul eax, eax, 0x34955ac3
cmp eax, 0x8752bcf2
je 0x18025edd3
jmp 0x18025ed94
mov eax, dword [0x180520678]
sub eax, dword [0x18052067c]
xor eax, 0xd199962c
and eax, 0x8720e934
imul ecx, eax, 0xde28121e
cmp rbx, rdi
sete al
cmp ecx, 0xa531e7aa
ja 0x18025ed94
jmp 0x18025edc0
test al, 1
jne 0x18025edc9
jmp 0x18025ecea
jmp 0x18025edcb
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov eax, 0x8ea3e3f2
shr ecx, 0xeb
mov ch, 0xcc
int3
Function at 0x18025f120
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rax, rcx
add rax, 8
mov rdi, qword [rax]
mov rsi, qword [rcx + 0x10]
cmp rsi, 0
je 0x18025f592
xor r12d, r12d
jmp 0x18025f14d
Function at 0x180260940
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r9, rdx
mov rsi, rcx
mov eax, dword [0x1805208c0]
or eax, dword [0x1805208c4]
and eax, 0xe9dc3f83
or eax, 0x9d4cf363
imul eax, eax, 0x49e1df71

Function at 0x1802611a0
Capabilities:
Encode data using xor

Disassembly:
mov r8b, dl
mov eax, dword [0x180520990]
and eax, dword [0x180520994]
mov r9d, 0xf151d093
xor edx, edx
div r9d
and eax, 0xb4126ebb
sub eax, 0xf459e8dd
cmp eax, 0xec22e105
je 0x18026124a
mov eax, dword [0x180520998]
imul eax, dword [0x18052099c]
sub eax, 0xd41f5f6
add eax, 0x2f974c89
add eax, 0xce85741a
mov byte [rcx], 2
cmp eax, 0xd11908ab
jbe 0x18026124a
jmp 0x1802611f3
mov eax, dword [0x1805209a0]
or eax, dword [0x1805209a4]
sub eax, 0x4db14bf7
add eax, 0x2b68cc78
add eax, 0xa469940a
cmp eax, 0x565371d3
jb 0x18026125a
jmp 0x180261217
xchg edx, eax
pop rsp
cmp dword [rcx - 0x74], edx
lea ebp, [rax]
cmpsb byte [rsi], byte [rdi]
mov byte [rcx], 2
jmp 0x1802611cb
hlt

Function at 0x180261270
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov rbx, rdx
mov ebx, edx
mov rdi, rcx
mov r12, rdi
mov r8, qword [rbx]
mov rcx, rbx
add rcx, 8
mov r9, qword [rcx]
cmp r9, 9
setb al
invalid

Function at 0x180262760
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [rsi + 8]
mov rax, rsi
add rax, 0x18
mov rcx, qword [rax]
mov rax, rcx
sub rax, rbx
mov r8d, 0x28
xor edx, edx
div r8
mov rdi, rax
cmp rcx, rbx
je 0x18026287c
xor r14d, r14d
jmp 0x18026279c
Function at 0x180263850
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rbx, rdi
add rbx, 8
mov eax, dword [0x180520c00]
add eax, dword [0x180520c04]
add eax, 0x1ffc2e18
sub eax, 0x20a554af
add eax, 0xe6d9302b
cmp eax, 0xfb692077
ja 0x1802639a5
jmp 0x18026388e
mov eax, dword [0x180520c08]
imul eax, dword [0x180520c0c]
sub eax, 0x90e313c5
xor eax, 0xd1e87152
and eax, 0x17908196
mov r14, rdi
add r14, 0x10
mov r9, qword [rdi + 0x10]
cmp eax, 0xe75d1505
je 0x18026388e
jmp 0x1802638be
jmp 0x1802638c0
xor edx, edx
cmp r9, 0
mov eax, 0
je 0x180263947
mov r8, qword [rbx]
mov rcx, qword [rdi]
mov rdx, rsi
call fcn.180407930
mov r8, rax
mov rcx, rdx
mov eax, dword [0x180520c10]
imul eax, dword [0x180520c14]
or eax, 0xfd05a00d
and eax, 0xa40d6282
and eax, 0x3ed000e
cmp eax, 0xce930a2b
ja 0x1802639b2
jmp 0x18026390a
mov eax, dword [0x180520c18]
sub eax, dword [0x180520c1c]
mov r9d, 0x47fe4456
xor edx, edx
div r9d
imul eax, eax, 0xd95be0eb
and eax, 0x37648ac
cmp r8, 2
sete dl
cmp eax, 0x3ef53da1
jae 0x18026390a
mov eax, 1
test dl, 1
je 0x180263951
mov rdx, rcx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp r8, 0
sete dl
xor eax, eax
test dl, 1
jne 0x180263964
mov rdx, rcx
jmp 0x180263947
mov rax, qword [rbx]
mov r9, qword [r14]
mov edx, 1
mov qword [rbx], rdx
mov qword [r14], 0
cmp r9, rcx
jae 0x180263982
ud2
add rax, rcx
sub r9, rcx
mov qword [rbx], rax
mov qword [r14], r9
movabs rdx, 0x1700000003
xor eax, eax
cmp rcx, 0
je 0x180263947
invalid
jmp 0x1802638c0
in al, dx
call rcx
invalid
sti
sti
js 0x18026393a
jnp 0x180263994
push rsp
push rdx
jge 0x1802639a8
invalid

Function at 0x180264430
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
lea rcx, [rsp + 0x28]
mov rdx, rdi
Function at 0x180265460
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
mov rsi, rcx
mov r14, rsi
add r14, 0x40
mov r15, qword [r14]
mov rcx, qword [rsi]
cmp r15, 0
je 0x1802655dd
lea rdi, [rsp + 0xe8]
add rdi, 8
lea rax, [rsp + 0xe8]
add rax, 0x10
mov qword [rsp + 0xe0], rax
mov rbx, qword [rsi + 8]
mov rax, rsi
add rax, 0x10
mov r14, qword [rax]
mov rax, rsi
add rax, 0x18
mov r10, qword [rax]
mov qword [rsi], 0
cmp rcx, 0
je 0x1802661bb