joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180308b90
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180780700]
and eax, dword [0x180780704]
imul eax, eax, 0x354c6edd
imul eax, eax, 0xe727c3a
xor eax, 0x43f1544b
cmp eax, 0xada0d11a
je 0x180308c7b
mov eax, dword [0x180780708]
or eax, dword [0x18078070c]
mov r9d, 0x6a6756ba
xor edx, edx
div r9d
and eax, 0x74f788f4
mov r9d, 0xfd44bda5
xor edx, edx
div r9d
imul rdx, r8, 0x2415f95d
movabs r9, 0xba9a6871bab62f9
add rdx, r9
mov r9, rdx
rol r9, 5
xor r9, rdx
mov rdx, r9
shr rdx, 4
cmp eax, 0x64aa07dd
ja 0x180308c7b
jmp 0x180308c10
xor rdx, r9
xor edx, ecx
mov eax, dword [0x180780710]
and eax, dword [0x180780714]
sub eax, 0x46c8d79e
and eax, 0x684ed8a4
sub eax, 0xd9daa9d4
cmp eax, 0x9e5eeea6
je 0x180308c8c
jmp 0x180308c37
mov r8d, dword [0x180780718]
sub r8d, dword [0x18078071c]
or r8d, 0x4fcaa94a
xor r8d, 0x8d3585ac
or r8d, 0xf9e99714
mov r9, rdx
rol r9, 7
xor r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0xe39281f5
je 0x180308c37
ret
cmp byte [rsi + 0x343faea3], ch
sahf
out 0x44, al
ja 0x180308c11
invalid
invalid

Function at 0x180308f70
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xffffffffdcfb8298
sub rax, rdx
xor rax, 0xffffffff958018d8
imul r8, rax, 0xa86413b
mov eax, dword [0x180780760]
add eax, dword [0x180780764]
and eax, 0x91f0a476
add eax, 0xb0753ca7
and eax, 0xa21be490
cmp eax, 0x3f2a3f5c
je 0x180308fed
jmp 0x180308fab
mov eax, dword [0x180780768]
sub eax, dword [0x18078076c]
mov r9d, 0xc34f1ade
xor edx, edx
div r9d
add eax, 0xe2656053
imul edx, eax, 0x7841db0e
mov r9, r8
rol r9, 2
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x4f85b26
jbe 0x180308fab
ret
xor ah, bh
invalid

Function at 0x1803097b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 0x19
xor rax, rdx
mov edx, 0xdfbaf8a4
sub rdx, rax
mov r8, rdx
rol r8, 1
mov eax, dword [0x180780840]
or eax, dword [0x180780844]
or eax, 0x697b6af2
imul eax, eax, 0x693591dc
or eax, 0xc262450d
cmp eax, 0x19c68891
jbe 0x18030982d
jmp 0x1803097ed
mov r9d, dword [0x180780848]
and r9d, dword [0x18078084c]
sub r9d, 0xc2a24ef7
xor r9d, 0xc69c2048
sub r9d, 0xc2e97875
mov r10, r8
xor r10, rdx
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r9d, 0xff844741
je 0x1803097ed
ret
xchg edx, eax
invalid
Function at 0x1803099c0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180780870]
sub eax, dword [0x180780874]
mov r9d, 0x7681b1fe
xor edx, edx
div r9d
and eax, 0x6dc61a4b
xor eax, 0x8df9b75f
cmp eax, 0x168d1f13
jb 0x180309aa8
jmp 0x1803099f1
mov eax, dword [0x180780878]
xor eax, dword [0x18078087c]
imul eax, eax, 0x9b70142d
imul eax, eax, 0xd823f64e
mov r9d, 0x8a9a14b7
xor edx, edx
div r9d
mov r9d, 0x5f53ba90
sub r9, r8
mov rdx, r9
rol rdx, 7
xor rdx, r9
mov r9, rdx
rol r9, 1
cmp eax, 0x8555d1ea
je 0x1803099f1
jmp 0x180309a36
xor r9, rdx
add r9, 0x4859c296
mov r8, r9
rol r8, 4
mov eax, dword [str._uf_E]
and eax, dword [0x180780884]
add eax, 0x476e31
and eax, 0xa72aac7a
mov r10d, 0x185507b
xor edx, edx
div r10d
xor eax, 0x28c1f27b
cmp eax, 0x9f7c5873
je 0x180309ab9
mov eax, dword [0x180780888]
add eax, dword [0x18078088c]
add eax, 0xd13d1818
adc dword [rsi + 0x47], ebp
add byte [0x1516db298], al
imul edx, eax, 0xaa3332f
or edx, 0x9f939a15
mov r10, r8
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xd3e09a15
ja 0x180309ab9
ret
push rsp
je 0x180309a4e
add esi, dword [rdi]
and esi, dword [rbx]
and eax, 0xef1d7025
jmp 0x1803099ef
stosb byte [rdi], al
movsb byte [rdi], byte [rsi]
pop rsi
js 0x180309a77
invalid

Function at 0x180309da0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1807808e0]
xor edx, edx
div dword [0x1807808e4]
or eax, 0xd6d6fb42
sub eax, 0x1aa50af1
mov r9d, 0xddd83b71
xor edx, edx
div r9d
cmp eax, 0x6db90cc7
ja 0x180309e89
jmp 0x180309dd3
mov eax, dword [0x1807808e8]
sub eax, dword [0x1807808ec]
add eax, 0x9eed611
imul eax, eax, 0xf852b8ec
mov r9d, 0xf142276
xor edx, edx
div r9d
imul r9, r8, 0x4e1a2e6f
cmp eax, 0x4a9dd2c1
jae 0x180309dd3
jmp 0x180309e05
xor r9, 0xffffffffffffffff
mov r8, r9
shr r8, 0x1b
mov eax, dword [0x1807808f0]
and eax, dword [0x1807808f4]
sub eax, 0x9ce36fb4
and eax, 0xaed3e83c
add eax, 0xceb62636
cmp eax, 0x13a652d1
jb 0x180309e96
jmp 0x180309e34
mov eax, dword [0x1807808f8]
xor edx, edx
div dword [0x1807808fc]
or eax, 0x60f72435
mov r10d, 0xfca51a27
xor edx, edx
div r10d
mov edx, eax
add edx, 0xc0553938
mov rax, r8
xor rax, r9
mov r10, rax
rol r10, 3
xor r10, rax
mov r11, r10
rol r11, 1
xor r11, r10
and r11, 0xffff
mov rax, rcx
add rax, r11
cmp edx, 0x9121a91a
jbe 0x180309e34
ret
and edx, dword [rdi - 0x4f]
enter 0x76e0, 0x57
shr cl, 1
cmp edi, edi
invalid
fdivrp st(7)
invalid

Function at 0x180309f50
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
add r8, 0xffffffffab8674af
mov eax, dword [0x180780910]
and eax, dword [0x180780914]
mov r9d, 0x2c6325a0
xor edx, edx
div r9d
add eax, 0x3dd2340a
add eax, 0x17c380c9
cmp eax, 0xa8c5b9b2
ja 0x180309fc8
jmp 0x180309f84
mov eax, dword [0x180780918]
imul eax, dword [0x18078091c]
or eax, 0xf80e6ce5
imul eax, eax, 0xf985b4a0
mov r9d, 0x21f55535
xor edx, edx
div r9d
mov rdx, r8
rol rdx, 6
xor rdx, r8
cmp eax, 0x1982dc5b
ja 0x180309f84
jmp 0x180309fba
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
out 0x5a, eax
invalid
Function at 0x18030a2f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov r9, r8
rol r9, 1
mov eax, dword [0x180780970]
xor edx, edx
div dword [0x180780974]
sub eax, 0xb93fc98c
sub eax, 0xf42311cd
add eax, 0x94cf9a63
cmp eax, 0x1cc492a3
jb 0x18030a3cc
mov eax, dword [0x180780978]
or eax, dword [0x18078097c]
xor eax, 0x37269e68
and eax, 0x7f5afcba
and eax, 0xb6b50504
mov rdx, r9
xor rdx, r8
mov r10, 0xffffffffd1c049fd
sub r10, rdx
xor r10, 0xffffffff90a60b1d
add r10, 0x4dff172d
mov rdx, r10
rol rdx, 3
xor rdx, r10
and rdx, 0xffff
cmp eax, 0xd77067aa
je 0x18030a3cc
jmp 0x18030a374
mov eax, dword [0x180780980]
imul eax, dword [0x180780984]
add eax, 0x6206b10d
add eax, 0x2c115508
sub eax, 0x7aff3158
cmp eax, 0x22485b23
je 0x18030a3d9
jmp 0x18030a399
mov r8d, dword [0x180780988]
add r8d, dword [0x18078098c]
xor r8d, 0xa194ae18
or r8d, 0x48a63e86
xor r8d, 0xe44a98b2
mov rax, rcx
add rax, rdx
cmp r8d, 0x93979aa3
ja 0x18030a399
ret
shl edi, 0xf7
lodsd eax, dword [rsi]
movabs eax, dword [0x8952ffffff48e964]
and al, 7
push rdx
mov dword [rdi + rax], esp
sub al, 0xb9
mov esp, dword [rsi]
pushfq
xchg edx, eax
movabs eax, dword [0xccccccccccb0eb27]
int3

Function at 0x18030a8f0
Capabilities:
Encode data using xor

Disassembly:
imul rdx, rdx, 0xffffffffac59954a
mov rax, rdx
shr rax, 0xc
xor rax, rdx
add rax, 0x423aa436
mov r8, rax
rol r8, 6
xor r8, rax
mov eax, dword [0x180780a10]
xor edx, edx
div dword [0x180780a14]
add eax, 0x93912099
and eax, 0x3576232
add eax, 0x4b978871
cmp eax, 0x315d0a72
jbe 0x18030a974
jmp 0x18030a937
mov eax, dword [0x180780a18]
xor eax, dword [0x180780a1c]
or eax, 0x2196b8df
mov r9d, 0x70221e2e
xor edx, edx
div r9d
mov edx, eax
and edx, 0x208345f9
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xce6bd582
je 0x18030a937
ret
stosd dword [rdi], eax
js 0x18030a97e
pop rdx
xchg ebx, eax
xchg edx, eax
wait
enter 0x5bea, 0xffffffffffffffdf
jmp 0x14cfd5d6f
fucompi st(1)
jmp 0x18030a935

Function at 0x18030b270
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
shr r8, 0x14
xor r8, rdx
mov r9, r8
rol r9, 6
mov eax, dword [0x180780ad0]
xor eax, dword [0x180780ad4]
or eax, 0xe6438219
xor eax, 0x2813273
sub eax, 0xe32a234e
cmp eax, 0x6381ef8e
ja 0x18030b2f6
jmp 0x18030b2a5
mov eax, dword [0x180780ad8]
or eax, dword [0x180780adc]
mov r10d, 0x3bddf07b
xor edx, edx
div r10d
mov edx, eax
add edx, 0xc2ed156f
and edx, 0x71f81f08
mov rax, r8
xor rax, r9
xor rax, 0x31794588
mov r10, rax
rol r10, 3
xor r10, rax
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xdd9e2426
je 0x18030b2a5
ret
lahf
add al, 0xf7
shr dword [0x1e48f20c6], cl
test dword [rbx - 0x15], esp
lahf
int3
Function at 0x18030b310
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xfffffffff4e3df67
sub rax, rdx
mov rdx, rax
shr rdx, 0x19
xor rdx, rax
mov r8, rdx
shr r8, 0x16
xor r8, rdx
mov r9, r8
rol r9, 1
mov eax, dword [0x180780ae0]
imul eax, dword [0x180780ae4]
imul eax, eax, 0x6ed19838
mov r10d, 0xd6b5191c
xor edx, edx
div r10d
and eax, 0x77946372
cmp eax, 0xfec4eb1f
ja 0x18030b3ae
jmp 0x18030b360
mov eax, dword [0x180780ae8]
and eax, dword [0x180780aec]
mov r10d, 0xa3eee6e2
xor edx, edx
div r10d
mov r10d, 0x426e1571
xor edx, edx
movabs dword [0x71ba41f2f741d231], eax
adc eax, 0xd231426e
div r10d
or eax, 0x961e8bc5
mov r10, r9
xor r10, r8
mov rdx, r10
rol rdx, 5
xor rdx, r10
cmp eax, 0x29dd3cb1
je 0x18030b360
jmp 0x18030b3a0
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
jg 0x18030b371
test dword [rdx + rdx*2 - 0x14559ac0], eax
cmpsb byte [rsi], byte [rdi]
int3

Function at 0x18030b6c0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180780b40]
add eax, dword [0x180780b44]
xor eax, 0x33552576
or eax, 0x4358f1b2
sub eax, 0x1210db70
cmp eax, 0xf80f7c56
jae 0x18030b739
jmp 0x18030b6e7
mov eax, dword [0x180780b48]
add eax, dword [0x180780b4c]
add eax, 0x6dd315fc
mov r9d, 0xa69a7da8
xor edx, edx
div r9d
sub eax, 0xb4206eeb
mov rdx, r8
rol rdx, 1
xor rdx, r8
imul r9, rdx, 0xffffffffbd78eed8
mov rdx, r9
rol rdx, 7
xor rdx, r9
cmp eax, 0xe6bc1464
ja 0x18030b6e7
jmp 0x18030b72b
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
loope 0x18030b787
fisttp qword [rbx]
sti
add dword [0x130d90104], ecx
invalid
mov al, 0xc5
jmp 0x18030b6e5
mov r9d, dword [0x180780b58]
sub r9d, dword [0x180780b5c]
and r9d, 0xf24c71b4
sub r9d, 0x50349e8b
rcl dword [rbx + 0x47]
add byte [rcx - 0x7f], al
loope 0x18030b743
jno 0x18030b7dd
sub r9d, 0x50349e8b
sub r9d, 0x75f5d782
mov rcx, rdx
add rcx, 0x59ef0b00
mov r8, rcx
rol r8, 6
xor r8, rcx
mov r10, r8
shr r10, 9
xor r10, r8
mov rcx, r10
rol rcx, 4
xor rcx, r10
mov r8, rcx
rol r8, 1
cmp r9d, 0x1bbf5cba
jbe 0x18030b840
jmp 0x18030b7d9
mov edx, dword [0x180780b60]
xor edx, dword [0x180780b64]
add byte [r11], r14b
adc eax, 0x47537f
xor edx, 0x231c316a
add edx, 0x7b96ee3b
xor edx, 0xe2d24429
cmp edx, 0xf97a19da
je 0x18030b851
jmp 0x18030b801
mov r9d, dword [0x180780b68]
xor r9d, dword [0x180780b6c]
add r9d, 0x6ed1c2fd
xor r9d, 0x2e33eacc
or r9d, 0xff3f4894
mov rdx, r8
xor rdx, rcx
and rdx, 0xffff
cmp r9d, 0x25109918
je 0x18030b801
jmp 0x18030b83c
add rax, rdx
ret
mov byte [rdx - 0x66], dl
in al, 0x28
sal r15b, 1
imul esp, dword [rax - 3], 5
jmp 0x18030b77d
invalid
Function at 0x18030c9a0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, 0x300a25b3
sub r8, rdx
mov r9, r8
rol r9, 5
mov eax, dword [0x180780d30]
and eax, dword [0x180780d34]
xor eax, 0x8cf326da
xor eax, 0xe1ba6c6f
xor eax, 0x908d61ef
cmp eax, 0xfd4cd53d
je 0x18030ca22
jmp 0x18030c9d4
mov eax, dword [0x180780d38]
xor eax, dword [0x180780d3c]
sub eax, 0x596381eb
sub eax, 0xcd417db4
mov r10d, 0x251cd764
xor edx, edx
div r10d
mov r10, r8
xor r10, r9
xor r10, 0xffffffff9cc86673
mov rdx, r10
rol rdx, 1
xor rdx, r10
cmp eax, 0x544ab0c6
jae 0x18030c9d4
jmp 0x18030ca14
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
sti
sub al, byte [rbp + 0x60d0a30b]
test eax, 0xeb59a7f1
movabs byte [0x4a37ae33b9c88948], al
mov rax, rcx
mov ecx, 0x4a37ae33

Function at 0x18030ca60
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
sub r8, rdx
mov r9, r8
rol r9, 3
mov eax, dword [0x180780d40]
xor eax, dword [0x180780d44]
or eax, 0x35d121be
xor eax, 0x3bbf6308
sub eax, 0x98cc0069
cmp eax, 0x222a7e62
jb 0x18030cadf
jmp 0x18030ca91
mov eax, dword [0x180780d48]
xor eax, dword [0x180780d4c]
mov r10d, 0xc1730b4a
xor edx, edx
div r10d
or eax, 0x6bb2e187
mov r10d, 0x18a5c2fb
xor edx, edx
div r10d
mov r10, r9
xor r10, r8
mov rdx, r10
rol rdx, 2
xor rdx, r10
and rdx, 0xffff
cmp eax, 0x5b2a323d
jae 0x18030ca91
jmp 0x18030cad8
add rcx, rdx
mov rax, rcx
ret
invalid

Function at 0x18030cd90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 0x10
xor rax, rdx
imul rax, rax, 0x4e694983
mov rdx, rax
rol rdx, 1
xor rax, rdx
xor rax, 0x6db9640d
mov r8, rax
rol r8, 6
xor r8, rax
mov eax, dword [0x180780d90]
and eax, dword [0x180780d94]
mov r9d, 0x5f45126c

Function at 0x18030d010
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180780dd0]
xor edx, edx
div dword [0x180780dd4]
mov r9d, 0xd4435571
xor edx, edx
div r9d
and eax, 0xa3b62145
xor eax, 0x8c00f242
cmp eax, 0xef2609b5
je 0x18030d09a
jmp 0x18030d03f
mov eax, dword [0x180780dd8]
or eax, dword [0x180780ddc]
mov r9d, 0x4b33b0be
xor edx, edx
div r9d
xor eax, 0xd0506c21
mov r9d, 0xdb10e3dc
xor edx, edx
div r9d
imul rdx, r8, 0xffffffff9db2d7a7
cmp eax, 0x206d26d7
ja 0x18030d03f
jmp 0x18030d076
movabs rax, 0xc9d33567add01335
add rdx, rax
mov rax, rdx
rol rax, 4
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
int3

Function at 0x18030d680
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180780e80]
imul eax, dword [0x180780e84]
add eax, 0x1d87e861
or eax, 0x7277b3d9
mov r9d, 0x94b0a270
xor edx, edx
div r9d
cmp eax, 0x2e615a42
jae 0x18030d702
jmp 0x18030d6ae
mov eax, dword [0x180780e88]
xor edx, edx
div dword [0x180780e8c]
sub eax, 0xc572acb7
sub eax, 0x6533dbb7
or eax, 0xe277616f
mov rdx, r8
shr rdx, 0x14
xor rdx, r8
cmp eax, 0x88732b63
jb 0x18030d6ae
jmp 0x18030d6de
movabs rax, 0xfffcb5f19da
xor rdx, rax
mov rax, rdx
rol rax, 6
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
sar byte [rbp - 0x76651b8b], 0xc
sub edx, esi
loop 0x18030d702
invalid
Function at 0x18030d7a0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
movabs rax, 0x17774a29e1612a3
imul r8, rax
movabs rax, 0x7ac8c528f09246ee
add r8, rax
mov eax, dword [0x180780ea0]
add eax, dword [0x180780ea4]
and eax, 0xeb999709
mov r9d, 0x6409ecb
xor edx, edx
div r9d
xor eax, 0x742f6dee
cmp eax, 0x1f79cad7
jbe 0x18030d825
jmp 0x18030d7e8
mov eax, dword [0x180780ea8]
and eax, dword [0x180780eac]
or eax, 0xc816d8e
or eax, 0x3a0256d3
imul edx, eax, 0x8aa0fbd6
mov rax, r8
rol rax, 3
xor rax, r8
cmp edx, 0x893ad815
jb 0x18030d7e8
jmp 0x18030d818
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
add al, 0xe1
outsb dx, byte [rsi]
push rsp
and al, 0x5d
retf 0xb7eb

Function at 0x18030d970
Capabilities:
Encode data using xor

Disassembly:
imul r8, rdx, 0xffffffffe8d71169
movabs rax, 0x2c5403b13382aa6
add r8, rax
mov r9, r8
rol r9, 1
mov eax, dword [0x180780ed0]
or eax, dword [0x180780ed4]
mov r10d, 0x5fe7a4e1
xor edx, edx
div r10d
add eax, 0x9074436c
imul eax, eax, 0x2d1e962b
cmp eax, 0xa5e03758
je 0x18030d9f0
jmp 0x18030d9b5
mov edx, dword [0x180780ed8]
add edx, dword [0x180780edc]
add edx, 0xecd6eeb5
add edx, 0xde5a2976
sub edx, 0x9b950d8d
mov rax, r9
xor rax, r8
and rax, 0xffff
cmp edx, 0x1efce424
jbe 0x18030d9b5
jmp 0x18030d9e9
add rcx, rax
mov rax, rcx
ret
xchg ebx, eax
invalid

Function at 0x18030dc90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 0x11
xor rax, rdx
xor r8d, r8d
sub r8, rax
xor r8, 0xfffffffff4dbf228
mov eax, dword [0x180780f20]
xor eax, dword [0x180780f24]
imul eax, eax, 0xfc560f18
mov r9d, 0xe3bd1aa8
xor edx, edx
div r9d
imul eax, eax, 0xa609b778
cmp eax, 0x4bd847b1
je 0x18030dd78
jmp 0x18030dcd7
mov eax, dword [0x180780f28]
sub eax, dword [0x180780f2c]
sub eax, 0xa6422419
add eax, 0xbba77197
mov r9d, 0x3eb9fada
xor edx, edx
div r9d
mov r9, r8
shr r9, 1
cmp eax, 0xa18ada76
jae 0x18030dcd7
jmp 0x18030dd07
mov eax, dword [0x180780f30]
xor edx, edx
div dword [0x180780f34]
xor eax, 0x6d343b71
and eax, 0x69bcb384
xor eax, 0x3ee4dcfe
cmp eax, 0x881bb1c0
je 0x18030dd85
jmp 0x18030dd2d
mov eax, dword [0x180780f38]
and eax, dword [0x180780f3c]
mov r10d, 0x8e136859
xor edx, edx
div r10d
mov edx, eax
and edx, 0xb0f8023e
add edx, 0xf482abe1
mov rax, r9
xor rax, r8
mov r10, rax
rol r10, 3
xor r10, rax
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xa986e76c
jbe 0x18030dd2d
ret
fst qword [rcx]
mov eax, dword [rbx - 0x75]
invalid
invalid
Function at 0x18030e490
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180780ff0]
add eax, dword [0x180780ff4]
imul eax, eax, 0xc0594486
xor eax, 0x37be5da3
mov r9d, 0x9f40848f
xor edx, edx
div r9d
cmp eax, 0x3c30ce6f
ja 0x18030e521
jmp 0x18030e4be
mov eax, dword [0x180780ff8]
and eax, dword [0x180780ffc]
xor eax, 0xdade39e
or eax, 0x27cc9b69
mov r9d, 0x4e2395dd
xor edx, edx
div r9d
mov rdx, 0xffffffffe7304d99
sub rdx, r8
imul r9, rdx, 0x4816ce78
mov rdx, r9
rol rdx, 6
xor rdx, r9
add rdx, 0xffffffffde5d9742
cmp eax, 0x2f33b9fe
je 0x18030e4be
jmp 0x18030e50a
mov rax, rdx
rol rax, 7
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
mov dl, 0xd3
cmp ebp, edi
mov eax, 0x665f5b23
invalid

Function at 0x18030e690
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor r8d, r8d
sub r8, rdx
mov rcx, r8
rol rcx, 1
xor rcx, r8
mov edx, dword [0x180781020]
add edx, dword [0x180781024]
xor edx, 0xeca7821e
sub edx, 0x8b8b4c90
sub edx, 0x634f2e67
cmp edx, 0xe797f5a3
je 0x18030e71c
jmp 0x18030e6ca
mov edx, dword [0x180781028]
imul edx, dword [0x18078102c]
imul r8d, edx, 0x9a099d20
add r8d, 0x3b174490
or r8d, 0x199c30b7
mov rdx, rcx
rol rdx, 3
xor rdx, rcx
imul rdx, rdx, 0xffffffffeb22ba82
cmp r8d, 0x1278d2f5
jbe 0x18030e6ca
jmp 0x18030e708
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
ret
xchg esp, eax
invalid

Function at 0x18030ed70
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffffffffffff
mov r8, rdx
shr r8, 5
xor r8, rdx
mov eax, dword [0x1807810b0]
imul eax, dword [0x1807810b4]
mov r9d, 0x4bba1d2e
xor edx, edx
div r9d
mov r9d, 0x8cf79f3c
xor edx, edx
div r9d
imul eax, eax, 0x667064d3
cmp eax, 0x461dc9e3
je 0x18030ee63
mov eax, dword [0x1807810b8]
xor edx, edx
div dword [0x1807810bc]
mov r9d, 0x2d23da1e
xor edx, edx
div r9d
mov r9d, 0x3454412b
xor edx, edx
div r9d
imul eax, eax, 0x76e0b366
imul rdx, r8, 0x471c059c
mov r10, rdx
rol r10, 7
xor r10, rdx
mov r9, r10
rol r9, 1
xor r9, r10
and r9, 0xffff
cmp eax, 0x56fc0d41
je 0x18030ee63
jmp 0x18030ee06
mov eax, dword [0x1807810c0]
or eax, dword [0x1807810c4]
mov r8d, 0xd4be2de5
xor edx, edx
div r8d
mov r8d, 0xf90a2a05
xor edx, edx
div r8d
add eax, 0x823c2de9
cmp eax, 0xf2e1fb7
jb 0x18030ee70
jmp 0x18030ee36
mov edx, dword [0x1807810c8]
add edx, dword [0x1807810cc]
or edx, 0xaad9c22b
xor edx, 0x28da008f
and edx, 0x5dbf41e2
mov rax, rcx
add rax, r9
cmp edx, 0xa8cd65c8
jae 0x18030ee36
ret
mov bl, 7
and byte [rdx - 0x60fafd88], dh
jmp 0x18030edb2
in al, dx
sar al, 1
invalid
Function at 0x18030f800
Capabilities:
Encode data using xor

Disassembly:
imul r8, rdx, 0x53ccb35
mov eax, dword [0x1807811e0]
or eax, dword [0x1807811e4]
xor eax, 0x353fb49c
xor eax, 0x45e46805
add eax, 0xcd9c9f3c
cmp eax, 0xcddba32c
ja 0x18030f880
jmp 0x18030f82b
mov eax, dword [0x1807811e8]
and eax, dword [0x1807811ec]
and eax, 0xcb8ebfc8
mov r9d, 0xa2925ff7
xor edx, edx
div r9d
or eax, 0xebf6b582
mov r9, r8
add r9, 0xffffffffb36813dd
mov rdx, r9
shr rdx, 6
xor rdx, r9
cmp eax, 0xf0c9cea9
je 0x18030f82b
jmp 0x18030f869
mov rax, rdx
rol rax, 2
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
adc ebx, dword [rdi - 3]
je 0x18030f904
sbb byte [rdx], ah
cmp al, 0xed
invalid
imul ecx, edx, 0xce669a2e

Function at 0x18030fd80
Capabilities:
Encode data using xor

Disassembly:
imul r8, rdx, 0xa6cce9a
xor r8, 0xffffffffd19a568f
mov r9, r8
rol r9, 1
mov eax, dword [0x180781270]
imul eax, dword [0x180781274]
sub eax, 0x1fcc366f
or eax, 0x4063c2a2
imul eax, eax, 0x79545141
cmp eax, 0x28fa412b
je 0x18030fdfa
jmp 0x18030fdba
mov eax, dword [0x180781278]
and eax, dword [0x18078127c]
sub eax, 0xbd1598c1
mov r10d, 0x972c6846
xor edx, edx
div r10d
mov edx, eax
sub edx, 0x5a1d42a5
mov r10, r9
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x602c90e5
jb 0x18030fdba
ret
movabs dword [0xeb2133e82b66141e], eax
mov ah, 0xcc
int3

Function at 0x1803105a0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180781340]
imul eax, dword [0x180781344]
xor eax, 0xadf441f3
imul eax, eax, 0x654ab99a
mov r9d, 0x634849c4
xor edx, edx
div r9d
cmp eax, 0x2bf6104c
ja 0x18031061c
jmp 0x1803105cf
mov eax, dword [0x180781348]
xor eax, dword [0x18078134c]
imul edx, eax, 0xe16ee79d
xor edx, 0x766f67c0
and edx, 0xfb0bdb2d
imul rax, r8, 0x69575ba8
cmp edx, 0x16abb50c
jbe 0x1803105cf
jmp 0x1803105fe
xor rax, 0xffffffffc61b04f5
mov rdx, rax
rol rdx, 6
rol edx, 6
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
in al, 0x10
jne 0x180310608
mov bh, byte [rcx - 5]
add al, 0x10
test byte [rsi - 0x15], al
invalid
int3
int3
int3
int3
int3
int3
Function at 0x180310e70
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180781440]
sub eax, dword [0x180781444]
imul eax, eax, 0x5b4928db
imul eax, eax, 0xc50e43c3
imul eax, eax, 0xea35e71b
cmp eax, 0x1c471b3c
jb 0x180310f4e
mov eax, dword [0x180781448]
xor edx, edx
div dword [0x18078144c]
or eax, 0x69b69e3b
or eax, 0xe271ded9
mov r9d, 0x8df9e5fc
xor edx, edx
div r9d
mov edx, 0x6334a00b
sub rdx, r8
movabs r9, 0xf9c435c105b36b40
imul rdx, r9
cmp eax, 0x595b47fd
ja 0x180310f4e
jmp 0x180310ede
mov r8, rdx
rol r8, 1
xor r8, rdx
mov eax, dword [0x180781450]
xor edx, edx
div dword [0x180781454]
add eax, 0xedcb7a07
mov r9d, 0x4a0ed169
xor edx, edx
div r9d
xor eax, 0xa8c1a5f5
cmp eax, 0xc1addb1c
je 0x180310f5b
jmp 0x180310f13
mov eax, dword [0x180781458]
or eax, dword [0x18078145c]
mov r9d, 0xd6cac34c
xor edx, edx
div r9d
xor eax, 0x1466e8a
imul edx, eax, 0x9752aaf8
mov r9, r8
and r9, 0xffc1
mov rax, rcx
add rax, r9
cmp edx, 0x68adbe4d
ja 0x180310f13
ret
rcr byte [rsp + rdi], 0x3c
xor al, 0x2e
add dword [rdi - 0xbe17], esi
dec dword [rsi + riz*8 + 0x21328e31]
xor bl, dl
mov esi, fs
xor dword [rsi - 0x25cddece], ecx
mov esp, 0xeb6ebf36
test al, 0xcc
int3

Function at 0x1803114a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
imul rcx, rdx, 0x6f19d460
xor rcx, 0xfffffffff6a89896
mov rdx, rcx
rol rdx, 1
mov r8d, dword [0x1807814e0]
and r8d, dword [0x1807814e4]
imul r8d, r8d, 0xbf4c845d
imul r8d, r8d, 0x117bc249
sub r8d, 0xbbad1e7f
cmp r8d, 0xceff073
je 0x180311524
jmp 0x1803114e5
mov r9d, dword [0x1807814e8]
or r9d, dword [0x1807814ec]
add r9d, 0x72c7401d
and r9d, 0xca4109dc
xor r9d, 0x7255f66d
mov r8, rdx
xor r8, rcx
cmp r9d, 0x9e14bbe9
jae 0x1803114e5
jmp 0x180311519
and r8, 0xfffb
add rax, r8
ret
lodsb al, byte [rsi]
adc eax, 0xa2ee87df
ror byte [rbx - 0x15], cl
mov ch, 0xcc
int3

Function at 0x180311a40
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xffffffffa2e1a14c
sub rax, rdx
imul rax, rax, 0x40026c72
add rax, 0xffffffff954f7976
mov rdx, rax
rol rdx, 1
xor rdx, rax
and rdx, 0xffff
mov eax, dword [0x180781560]
imul eax, dword [0x180781564]
and eax, 0x1eb518c5
xor eax, 0x640905ac
and eax, 0x2e015f94
cmp eax, 0x59c0309
jb 0x180311abb
jmp 0x180311a8c
mov eax, dword [0x180781568]
xor eax, dword [0x18078156c]
sub eax, 0x861f9eb9
imul r8d, eax, 0x6ac26f07
sub r8d, 0x230ead47
mov rax, rcx
add rax, rdx
cmp r8d, 0x7f7198cf
je 0x180311a8c
ret
movsd dword [rdi], dword [rsi]
idiv bl
invalid

Function at 0x180311f40
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
rol r8, 4
xor r8, rdx
mov eax, dword [0x1807815e0]
or eax, dword [0x1807815e4]
mov r9d, 0x3e04662a
xor edx, edx
div r9d
xor eax, 0x269dce98
add eax, 0xa15e8854
cmp eax, 0xe9c63d88
je 0x180311fcd
jmp 0x180311f74
mov edx, dword [0x1807815e8]
add edx, dword [0x1807815ec]
or edx, 0x9133e464
xor edx, 0x91d7d24c
add edx, 0x6458bce2
mov rax, r8
shr rax, 6
xor rax, r8
cmp edx, 0x11b0832e
jb 0x180311f74
jmp 0x180311fa6
mov rdx, rax
shr rdx, 2
xor rdx, rax
xor eax, eax
sub rax, rdx
mov rdx, rax
rol rdx, 7
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
mov ebx, 0x47d2d295
invalid