joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1803308b0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
add r8, 0xfffffffff23ae93f
mov r9, r8
rol r9, 7
mov eax, dword [0x180784750]
sub eax, dword [0x180784754]
mov r10d, 0x242d43e1
xor edx, edx
div r10d
or eax, 0x9f0c41f3
sub eax, 0x6f40b1aa
cmp eax, 0xfa18fa4f
ja 0x180330981
jmp 0x1803308ef
mov eax, dword [0x180784758]
or eax, dword [0x18078475c]
imul eax, eax, 0x9a060f4f
imul eax, eax, 0xe34a8e92
mov r10d, 0x87f56659
xor edx, edx
div r10d
mov r10, r9
xor r10, r8
cmp eax, 0xa14899b
je 0x1803308ef
jmp 0x180330921
mov eax, dword [0x180784760]
add eax, dword [0x180784764]
and eax, 0x7e60063e
xor eax, 0x632a239f
imul eax, eax, 0xd816bda6
cmp eax, 0x8907f617
jbe 0x180330992
mov eax, dword [0x180784768]
xor eax, dword [0x18078476c]
add eax, 0x712e986b
imul eax, eax, 0x59992408
mov r8d, 0xc4a7eea3
xor edx, edx
div r8d
mov edx, eax
mov r8, r10
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0x5208819a
jae 0x180330992
ret
movabs dword [0x299b7e13bc8379ea], eax
invalid
push 0xfffffffffe66f75c
sub esp, ebp
adc ch, bl
test al, 0xcc
int3

Function at 0x180330a90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 3
xor rax, rdx
xor rax, 0xffffffffffffffff
imul rax, rax, 0x2727ba9
xor rax, 0x20b94174
mov r8, rax
rol r8, 2
xor r8, rax
mov eax, dword [0x180784780]
xor eax, dword [0x180784784]
sub eax, 0x4be4da63
or eax, 0xb1ac22f0
and eax, 0xb8bab74c
cmp eax, 0x71f3738f
je 0x180330b16
jmp 0x180330ad9
mov eax, dword [0x180784788]
xor edx, edx
div dword [0x18078478c]
add eax, 0xcea3d386
mov r9d, 0xc2f81c03
xor edx, edx
div r9d
or eax, 0x8ecf276e
mov rdx, r8
and rdx, 0xffff
cmp eax, 0x2a992dce
jb 0x180330ad9
jmp 0x180330b0f
add rcx, rdx
mov rax, rcx
ret
ficomp word [rdi + 0x14]
movabs rcx, 0xd08949b7ebf8625f
mov r8, rdx
mov eax, dword [0x180784790]
xor edx, edx
div dword [0x180784794]
or eax, 0x983b2e30
sub eax, 0xe11f81be
imul eax, eax, 0x10f5dc6f
cmp eax, 0x7281cee0
jae 0x180330ba8
jmp 0x180330b4a
mov eax, dword [0x180784798]
add eax, dword [0x18078479c]
mov r9d, 0xb5bc9792
xor edx, edx
div r9d
or eax, 0xa711cd9e
mov r9d, 0x84037555
xor edx, edx
div r9d
movabs r9, 0xffffffff17fe6e3f
mov rdx, r8
add rdx, r9
xor rdx, 0xffffffff8a20c3fb
cmp eax, 0x83700a10
ja 0x180330b4a
jmp 0x180330b91
mov rax, rdx
rol rax, 3
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
or eax, 0x6e165350
invalid
Function at 0x180330e50
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1807847f0]
imul eax, dword [0x1807847f4]
add eax, 0x994d5b32
imul eax, eax, 0x1b952645
or eax, 0x967006cd
cmp eax, 0x4cf2f88c
jb 0x180330f22
jmp 0x180330e7d
mov eax, dword [0x1807847f8]
xor eax, dword [0x1807847fc]
and eax, 0x78bd5738
mov r9d, 0xa68e58f2
xor edx, edx
div r9d
and eax, 0x3e9e370
mov rdx, 0xffffffff89fcda1d
sub rdx, r8
mov r9, rdx
rol r9, 3
xor r9, rdx
cmp eax, 0x946b966a
je 0x180330e7d
jmp 0x180330ebb
mov r8, r9
rol r8, 4
mov eax, dword [0x180784800]
xor edx, edx
div dword [0x180784804]
xor eax, 0x97803c47
or eax, 0xd04fbce
or eax, 0x93709d87
cmp eax, 0x79344195
je 0x180330f2f
jmp 0x180330ee8
mov edx, dword [0x180784808]
or edx, dword [0x18078480c]
and edx, 0x398b9797
sub edx, 0xd1f76d49
add edx, 0x864dc396
mov r10, r8
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xb38fd53b
je 0x180330ee8
ret
scasd eax, dword [rdi]
jmp 0x180330f92
lea edx, [rbx - 0x23985ccf]
hlt
mov eax, dword [0x180784818]
xor edx, edx
div dword [0x18078481c]
xor eax, 0xbfad0d91
sub eax, 0x247d812a
sub eax, 0xcdc0c09e
imul rdx, r8, 0x3adb55a9
xor rdx, 0xffffffff9e8ac6ae
cmp eax, 0xed153afa
jae 0x180330f67
jmp 0x180330f9b
mov rax, rdx
shr rax, 0xa
xor rax, rdx
mov rdx, rax
rol rdx, 7
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret

Function at 0x180330fd0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180784820]
sub eax, dword [0x180784824]
sub eax, 0xd3242343
add eax, 0x1820d18b
add eax, 0xe75693de
cmp eax, 0xb1d8833b
je 0x1803310a3
mov eax, dword [0x180784828]
xor edx, edx
div dword [0x18078482c]
imul eax, eax, 0xdfef8e14
or eax, 0x477d85e8
and eax, 0xfc27e507
mov rdx, r8
xor rdx, 0x3c5d8d85
imul r9, rdx, 0xffffffffd01efea9
cmp eax, 0xf749e869
je 0x1803310a3
jmp 0x180331031
xor r9, 0xffffffff81bfa0bf
mov eax, dword [0x180784830]
xor eax, dword [0x180784834]
and eax, 0x8532ab15
sub eax, 0xfb7e4d45
or eax, 0x4dcc04f3
cmp eax, 0x84bf34a6
jbe 0x1803310b4
jmp 0x18033105c
mov eax, dword [0x180784838]
xor edx, edx
div dword [0x18078483c]
mov r8d, 0xe20b2deb
xor edx, edx
div r8d
mov edx, eax
add edx, 0xe07e1f0d
add edx, 0xc242c8b0
mov r8, r9
rol r8, 6
xor r8, r9
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0x8aeb2303
je 0x18033105c
ret
repne cmpsb byte [rsi], byte [rdi]
jl 0x180331123
sub eax, 0x14b5334d
outsd dx, dword [rsi]
or byte [rbp - 0xba17], 0xff
invalid
xor ah, byte [rdx + 0xac870f]
add byte [rax], al

Function at 0x180331230
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180784860]
and eax, dword [0x180784864]
mov r9d, 0xb5838c7c
xor edx, edx
div r9d
Function at 0x180331570
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1807848c0]
or eax, dword [0x1807848c4]
imul eax, eax, 0xa4dc3125
imul eax, eax, 0x1e01f326
or eax, 0xfbd119a5
cmp eax, 0x978570e7
jb 0x18033164a
jmp 0x18033159a
mov eax, dword [0x1807848c8]
add eax, dword [0x1807848cc]
imul eax, eax, 0x20fda13c
imul eax, eax, 0x83a92a3d
sub eax, 0xc13455d8
mov r8, 0xffffffffe0792802
sub r8, rdx
imul r8, r8, 0xffffffffff9a07cf
add r8, 0xffffffffe43759f5
mov r9, r8
rol r9, 7
cmp eax, 0x95834b7e
je 0x18033159a
jmp 0x1803315df
mov eax, dword [0x1807848d0]
or eax, dword [0x1807848d4]
imul eax, eax, 0xc3c4d9fb
and eax, 0x94036403
and eax, 0x48fc5ab9
cmp eax, 0xf1d4e5c0
ja 0x180331657
jmp 0x180331604
mov edx, dword [0x1807848d8]
add edx, dword [0x1807848dc]
or edx, 0xeba637a1
xor edx, 0x5766926b
xor edx, 0x74422c
mov rax, r9
xor rax, r8
mov r10, rax
rol r10, 4
xor r10, rax
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x13f0abe2
jbe 0x180331604
jmp 0x180331649
ret
jae 0x1803316c3
or byte [rbx - 0xdc0135f], al
jmp 0x180331598
xchg edi, eax
xchg esi, eax
popfq
push 0xffffffffffffff84
mov ebx, 0x9761eea2
movsd dword [rdi], dword [rsi]
jmp 0x180331602
sub byte [rbx - 0x3eb721b4], bl
rol dword [rbx], 0x41
mov ecx, 0x21b364d7

Function at 0x1803324e0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180784a40]
sub eax, dword [0x180784a44]
mov r9d, 0x587d2c31
xor edx, edx
div r9d
and eax, 0x7446ca14
imul eax, eax, 0xe3d6503e
cmp eax, 0x477d7ccd
je 0x1803325bd
jmp 0x180332512
mov edx, dword [0x180784a48]
add edx, dword [str.1_rL]
xor edx, 0x4775514
or edx, 0x235ec0cb
xor edx, 0xf0add987
mov rax, r8
xor rax, 0xffffffff9d70a8f3
cmp edx, 0x291ad921
jb 0x180332512
jmp 0x180332543
imul r8, rax, 0xffffffff9eeef7e5
xor r8, 0xffffffffffffffff
mov eax, dword [0x180784a50]
or eax, dword [0x180784a54]
imul eax, eax, 0xdc98d298
and eax, 0x6654ab42
add eax, 0x908acf5c
cmp eax, 0x3feac010
je 0x1803325ce
mov eax, dword [0x180784a58]
or eax, dword [0x180784a5c]
xor eax, 0x5c737116
sub eax, 0x1298f870
mov r9d, 0x92e52478
xor edx, edx
div r9d
mov edx, eax
mov rax, r8
rol rax, 5
xor rax, r8
mov r9, rax
rol r9, 1
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x6c1487f0
ja 0x1803325ce
ret
out 0xff, al
fdivr qword [rdx]
movabs byte [0xe9dee8b838bef45f], al
invalid
rcl dword [rcx - 0x1d063771], 0xa1
mov dword [rax], 0xeb399d47
xchg ebp, eax
int3

Function at 0x1803328c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
imul rax, rdx, 0xffffffffe1191700
movabs rdx, 0xf26290d154bcd100
add rax, rdx
xor rax, 0x6834c6b9
mov r8, rax
rol r8, 6
xor r8, rax
mov eax, dword [0x180784ab0]
xor edx, edx
div dword [0x180784ab4]
xor eax, 0x393f845
imul eax, eax, 0x1ef71c53
mov r9d, 0xb130900b
xor edx, edx
div r9d
cmp eax, 0x470aa6f1
ja 0x18033294a
jmp 0x180332911
mov edx, dword [0x180784ab8]
or edx, dword [0x180784abc]
and edx, 0x83b1e0dd
xor edx, 0xd822d129
sub edx, 0x7996dfae
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x391ca4db
je 0x180332911
jmp 0x180332949
ret
invalid
Function at 0x180333840
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x40bc7eb3
mov eax, dword [0x180784c20]
xor eax, dword [0x180784c24]
add eax, 0xee9a0423
xor eax, 0xc20409e9
sub eax, 0x1052ca2f
cmp eax, 0xb77edc6b
jbe 0x1803338ca
jmp 0x18033386b
mov r8d, dword [0x180784c28]
add r8d, dword [0x180784c2c]
sub r8d, 0x44fbdcf3
sub r8d, 0xa45b4a91
sub r8d, 0xf78cb455
mov rax, rdx
add rax, 0xfffffffff07f1862
shr rax, 0x15
mov r9d, 0xf80e79d
sub r9, rdx
xor rax, r9
mov r9, rax
rol r9, 6
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0xa0486637
ja 0x18033386b
movabs al, byte [0x7d5b4ac300eba477]
cmc
jmp 0x1803338c9
ret
pop rbx
jge 0x1803338c3
rcr byte [rcx], cl
int 0x6c
jmp 0x180333869

Function at 0x180333b60
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180784c80]
sub eax, dword [0x180784c84]
and eax, 0x7a7e3a72
and eax, 0x6564b7bd
mov r9d, 0xc53d7f2f
xor edx, edx
div r9d
cmp eax, 0xafaaa7e8
ja 0x180333c3b
mov eax, dword [0x180784c88]
xor edx, edx
div dword [0x180784c8c]
sub eax, 0x5d59f6b2
and eax, 0x43f78abe
or eax, 0xafd96cf0
imul rdx, r8, 0xfffffffff2f8e1db
mov r10, rdx
rol r10, 2
xor r10, rdx
mov r9d, 0x573aa270
sub r9, r10
cmp eax, 0x84b37320
jb 0x180333c3b
jmp 0x180333bcf
mov eax, dword [str.DGQ_]
or eax, dword [0x180784c94]
xor eax, 0xb8300789
or eax, 0x20d504a
imul eax, eax, 0xebe602b8
cmp eax, 0x819812c9
ja 0x180333c48
jmp 0x180333bf4
mov eax, dword [0x180784c98]
sub eax, dword [0x180784c9c]
mov r8d, 0x548204b4
xor edx, edx
div r8d
mov edx, eax
xor edx, 0x7e7e4ff4
sub edx, 0xeccd62ac
mov r8, r9
rol r8, 2
xor r8, r9
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0x29299153
jbe 0x180333bf4
jmp 0x180333c3a
ret
push 0xfffffffffffffff2
xchg ebp, eax
sbb eax, 0x10dbbaa5
jmp 0x180333b8f
sahf
stosd dword [rdi], eax
invalid

Function at 0x180333d10
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xffffffff85deac18
sub rax, rdx
imul rax, rax, 0x55c65e75
mov r9, rax
rol r9, 5
xor r9, rax
mov eax, dword [0x180784cb0]
sub eax, dword [0x180784cb4]
mov r8d, 0x8c0a4164
xor edx, edx
div r8d
and eax, 0xc503875b
or eax, 0xc5df06af
cmp eax, 0x8151d9c1
jbe 0x180333ddf
jmp 0x180333d59
mov eax, dword [0x180784cb8]
add eax, dword [0x180784cbc]
or eax, 0xcf263e5
sub eax, 0x21beb642
or eax, 0x9d8e40f3
mov r8, r9
and r8, 0xffff
cmp eax, 0x4f69f7f7
je 0x180333d59
jmp 0x180333d87
mov eax, dword [0x180784cc0]
or eax, dword [0x180784cc4]
and eax, 0x56f5dd17
and eax, 0x5a79a26c
add eax, 0x600eef0e
cmp eax, 0x7a6c36db
jbe 0x180333df0
jmp 0x180333dab
mov eax, dword [0x180784cc8]
imul eax, dword [0x180784ccc]
or eax, 0x6a7d4127
mov r9d, 0x674d63f9
xor edx, edx
div r9d
mov edx, eax
xor edx, 0xf1228235
mov rax, rcx
add rax, r8
cmp edx, 0x46db2bf8
jbe 0x180333dab
ret
in eax, dx
cld
sbb al, 0xa2
pop rsp
invalid
sub al, 0xb2
adc byte [r11 - 0x14c0d965], spl
scasd eax, dword [rdi]
int3
Function at 0x1803341a0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180784d20]
xor edx, edx
div dword [0x180784d24]
sub eax, 0x2217f448
and eax, 0xe1bdb13b
and eax, 0xfd7dc4f4
cmp eax, 0xa9cc7ce3
je 0x18033428f
jmp 0x1803341cd
mov eax, dword [0x180784d28]
sub eax, dword [0x180784d2c]
imul r9d, eax, 0xbb3c2128
xor r9d, 0x737ed429
and r9d, 0xb55f58e4
movabs rdx, 0xbabb038c95baaa8
mov rax, r8
imul rax, rdx
movabs rdx, 0xf5f80f606e9a5ce2
add rax, rdx
mov rdx, rax
rol rdx, 4
cmp r9d, 0x34003174
jae 0x1803341cd
jmp 0x18033421e
mov r8d, dword [0x180784d30]
imul r8d, dword [0x180784d34]
add r8d, 0xc9b03dd4
or r8d, 0xb2945101
xor r8d, 0xa65aa114
cmp r8d, 0x8976b744
ja 0x1803342a0
jmp 0x18033424d
mov r9d, dword [0x180784d38]
and r9d, dword [0x180784d3c]
xor r9d, 0x718c517a
and r9d, 0x6df2aacc
add r9d, 0x23ddd82f
mov r8, rdx
xor r8, rax
cmp r9d, 0x648a3e80
ja 0x18033424d
jmp 0x180334281
and r8, 0xffff
add rcx, r8
mov rax, rcx
ret
invalid
out dx, eax
xor dword [rdx], 0xffffffd2
retf

Function at 0x180334320
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
xor rax, 0xffffffffffffffff
rol rax, 1
xor rax, rdx
mov edx, dword [0x180784d40]
and edx, dword [0x180784d44]
add edx, 0x4bd35f8b
xor edx, 0x6343f0b0
or edx, 0xaeb530ee
cmp edx, 0x8a5bdc63
jbe 0x1803343f6
mov edx, dword [0x180784d48]
or edx, dword [str.FYNlE]
add edx, 0x57b3e7b6
imul edx, edx, 0x67e2afcc
or edx, 0x1c82161
mov r8, rax
add r8, 0x26847f1a
cmp edx, 0xb4f785f4
jb 0x1803343f6
jmp 0x180334389
mov eax, dword [0x180784d50]
add eax, dword [0x180784d54]
and eax, 0x2798b4a7
xor eax, 0xa7f6bc63
and eax, 0xfcc01115
cmp eax, 0x43bcf3f0
je 0x180334407
jmp 0x1803343ad
mov eax, dword [0x180784d58]
sub eax, dword [0x180784d5c]
mov r9d, 0x4009a5f
xor edx, edx
div r9d
add eax, 0x37c40495
mov r9d, 0x916635b3
xor edx, edx
div r9d
mov edx, eax
mov r9, r8
rol r9, 7
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xb65b7d5d
jae 0x1803343ad
ret
sahf
invalid
test eax, 0xe79bf7f
invalid

Function at 0x180334e00
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 3
xor rax, rdx
mov edx, 0x7f3c83a3
sub rdx, rax
imul rax, rdx, 0xfffffffff0be70a4
mov rdx, rax
rol rdx, 1
mov r8d, dword [0x180784e60]
sub r8d, dword [0x180784e64]
imul r8d, r8d, 0x3de3782a
xor r8d, 0xf3e6c39d
xor r8d, 0xd4252296
cmp r8d, 0x36483694
je 0x180334ee1
jmp 0x180334e51
mov r9d, dword [0x180784e68]
xor r9d, dword [0x180784e6c]
and r9d, 0xd729d1f7
and r9d, 0x3ff5efb1
xor r9d, 0xff76a803
mov r8, rdx
xor r8, rax
and r8, 0xfffd
cmp r9d, 0x6954acb6
je 0x180334e51
jmp 0x180334e8c
mov eax, dword [0x180784e70]
sub eax, dword [0x180784e74]
mov r9d, 0x64b497f8
xor edx, edx
div r9d
or eax, 0xf05ed3ae
add eax, 0x631edefe
cmp eax, 0xa9fe7137
ja 0x180334ef2
mov edx, dword [0x180784e78]
and edx, dword [0x180784e7c]
xor edx, 0x36e60cd9
add edx, 0xe1d10c8
sub edx, 0xa382bdfb
mov rax, rcx
add rax, r8
cmp edx, 0xb541b8ec
je 0x180334ef2
ret
sub eax, 0x870bc718
push rdx
insb byte [rdi], dx
movabs rbx, 0xffffff5de9348b14
jno 0x180334f06
loop 0x180334f4d
cmp al, 0xfb
test bl, ch
mov eax, 0xcccccccc
inc dword [rax + rax + 0xb]
add eax, 0x44ff75
mov ecx, 0x83e15b8e
Function at 0x180334f00
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180784e80]
or eax, dword [0x180784e84]
mov r9d, 0xf2041c9c
xor edx, edx
div r9d
xor eax, 0x6140645a
imul eax, eax, 0xdceaeaec
cmp eax, 0x72cf2451
je 0x180334f98
jmp 0x180334f2e
mov eax, dword [0x180784e88]
xor edx, edx
div dword [0x180784e8c]
sub eax, 0x5421b211
mov r9d, 0x3e9d8835
xor edx, edx
div r9d
mov r9d, 0x83e15b8e
xor edx, edx
div r9d
mov rdx, r8
shr rdx, 1
xor rdx, r8
cmp eax, 0x80d7351d
jae 0x180334f2e
jmp 0x180334f69
add rdx, 0xffffffffff47a999
xor rdx, 0xffffffffe96e7020
mov r8, rdx
rol r8, 6
xor r8, rdx
mov rax, r8
rol rax, 4
xor rax, r8
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
out 0x88, eax
sbb ch, bh
invalid

Function at 0x180335430
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, 0xffffffffbb59640b
sub rax, rdx
imul r8, rax, 0xffffffffc786749a
add r8, 0x4d75f1e3
mov r9, r8
rol r9, 3
mov eax, dword [0x180784f00]
add eax, dword [0x180784f04]
mov r10d, 0xa00bd928
xor edx, edx
div r10d
sub eax, 0x81ac88b9
sub eax, 0x38c604da
cmp eax, 0xbb75b26b
ja 0x1803354b4
jmp 0x180335479
mov eax, dword [0x180784f08]
add eax, dword [0x180784f0c]
imul edx, eax, 0x188825e9
and edx, 0xb9c2ff39
sub edx, 0xcec1c3b5
mov rax, r9
xor rax, r8
and rax, 0xffff
cmp edx, 0xac89176c
ja 0x180335479
jmp 0x1803354ad
add rcx, rax
mov rax, rcx
ret
pushfq
xchg r15d, eax
invalid

Function at 0x1803356f0
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffffbaf4b9da
mov r9, rdx
shr r9, 0xd
xor r9, rdx
mov r10, r9
rol r10, 2
mov eax, dword [0x180784f40]
xor eax, dword [0x180784f44]
sub eax, 0x6d041fd7
add eax, 0x7b01635e
add eax, 0x6c08cd9e
cmp eax, 0xde7972ea
je 0x1803357c2
jmp 0x180335730
mov eax, dword [0x180784f48]
xor eax, dword [0x180784f4c]
add eax, 0x7d06d1b3
imul eax, eax, 0x9e689e34
mov r8d, 0xc43d8b7e
xor edx, edx
div r8d
mov r8, r10
xor r8, r9
cmp eax, 0xfcff2e6e
ja 0x180335730
jmp 0x180335761
mov eax, dword [0x180784f50]
imul eax, dword [0x180784f54]
sub eax, 0x85184b32
add eax, 0xe2a8daf9
xor eax, 0xe65e316e
cmp eax, 0x9dfedccd
jb 0x1803357cf
jmp 0x180335786
mov eax, dword [0x180784f58]
or eax, dword [str.thqW]
sub eax, 0x775f31c3
add eax, 0xa9b1f993
mov r9d, 0x4f3aded
xor edx, edx
div r9d
mov edx, eax
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xf7591824
ja 0x180335786
ret
sti
retf 0x911e
sbb eax, 0xca12f3d1
and ebp, edx
xchg ebx, eax
jmp 0x180335784
Function at 0x180335e20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x180785000]
sub eax, dword [0x180785004]
xor eax, 0x9c11643d
xor eax, 0x525e1c6f
or eax, 0x8dbc9c8f
cmp eax, 0x408011d8
je 0x180335ee1
mov eax, dword [0x180785008]
xor eax, dword [0x18078500c]
add eax, 0x91648c19
and eax, 0x3bc34088
and eax, 0xd3126e7d
imul r8, rdx, 0xffffffffdd14663a
cmp eax, 0xc711e8da
je 0x180335ee1
jmp 0x180335e71
mov eax, dword [0x180785010]
sub eax, dword [0x180785014]
imul eax, eax, 0xafacc7bb
mov r9d, 0xc454e2f9
xor edx, edx
div r9d
or eax, 0xc6a7aee1
cmp eax, 0xbcc0edbb
je 0x180335eee
jmp 0x180335e9c
mov eax, dword [0x180785018]
add eax, dword [0x18078501c]
and eax, 0xc2c4ab75
imul edx, eax, 0x35020716
xor edx, 0x96a006e2
mov r9, r8
or r9, 1
mov rax, r9
rol rax, 5
xor rax, r9
cmp edx, 0xed577977
je 0x180335e9c
jmp 0x180335ed4
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
mov word [rsi], cs
invalid
mov edi, 0x166fa38a
invalid

Function at 0x180335f00
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x4cb8fe16
imul r9, rdx, 0x6aee48a8
add r9, 0x220d01b9
mov eax, dword [0x180785020]
add eax, dword [0x180785024]
mov r8d, 0x43c8d6f3
xor edx, edx
div r8d
mov r8d, 0xcf2c574
xor edx, edx
div r8d
imul eax, eax, 0x477887ab
cmp eax, 0xd2c2c075
jae 0x180335fd9
jmp 0x180335f4a
mov eax, dword [0x180785028]
xor eax, dword [0x18078502c]
mov r8d, 0xa32d0837
xor edx, edx
div r8d
and eax, 0x6f1642db
or eax, 0x32503d4a
mov rdx, r9
rol rdx, 3
xor rdx, r9
and rdx, 0xffff
mov r8, rcx
add r8, rdx
cmp eax, 0x9958b8de
ja 0x180335f4a
jmp 0x180335f8b
mov eax, dword [0x180785030]
and eax, dword [0x180785034]
mov ecx, 0x8f8e7c1
xor edx, edx
div ecx
xor eax, 0xcd0cd296
or eax, 0xa3ddcd51
cmp eax, 0x45a01c3
jbe 0x180335fe6
jmp 0x180335fb3
mov eax, dword [0x180785038]
or eax, dword [0x18078503c]
add eax, 0x2db61a65
and eax, 0xf194bccb
or eax, 0x28c7004b
cmp eax, 0x82694881
ja 0x180335fb3
mov rax, r8
ret
invalid
push 0x48
cmp eax, 0x1ec4563b
mov ch, 0x27
out 0x5b, al
imul ebx
mov ebp, 0xcccccccc
int3

Function at 0x180336310
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x5af9bb6e
add rdx, 0xffffffffc9556a56
mov rax, rdx
rol rax, 5
xor rax, rdx
mov r8, rax
rol r8, 5
xor r8, rax
mov rdx, r8
rol rdx, 3
xor rdx, r8
and rdx, 0xffff
mov eax, dword [0x180785090]
and eax, dword [0x180785094]
imul eax, eax, 0x87b317d6
and eax, 0xe62b361b
imul eax, eax, 0x6a9e6786
cmp eax, 0x942af96f
jae 0x18033639c
jmp 0x180336369
mov r8d, dword [0x180785098]
or r8d, dword [0x18078509c]
or r8d, 0x658b3509
xor r8d, 0x838e5010
or r8d, 0x53b781ea
mov rax, rcx
add rax, rdx
cmp r8d, 0x1c6fc20
jb 0x180336369
ret
push rsp
clc
call [rdi + 0x77]
int1
outsb dx, byte [rsi]
movsb byte [rdi], byte [rsi]
jmp 0x180336367
Function at 0x1803363b0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1807850a0]
imul eax, dword [0x1807850a4]
imul eax, eax, 0x7f038cb6
and eax, 0xadc49e0f
mov r9d, 0xdb520a6c
xor edx, edx
div r9d
cmp eax, 0x67278fd7
je 0x180336444
jmp 0x1803363df
mov eax, dword [0x1807850a8]
and eax, dword [0x1807850ac]
mov r9d, 0xaf5dee16
xor edx, edx
div r9d
imul r9d, eax, 0xde92c35f
or r9d, 0xbbd8e9f4
mov rax, r8
add rax, 0x3c665497
mov rdx, rax
rol rdx, 7
xor rdx, rax
mov rax, rdx
rol rax, 4
xor rax, rdx
mov rdx, rax
rol rdx, 6
cmp r9d, 0xb4f64db
je 0x1803363df
jmp 0x180336433
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
clc
lodsb al, byte [rsi]
in al, dx
sub r8, qword [r8 - 0x4a]
sbb al, 0xeb
invalid

Function at 0x1803369a0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180785140]
xor edx, edx
div dword [0x180785144]
add eax, 0x966b813c
sub eax, 0x7920860d
xor eax, 0x724919ee
cmp eax, 0xaaa62274
ja 0x180336a85
mov eax, dword [0x180785148]
sub eax, dword [0x18078514c]
xor eax, 0x617776e1
xor eax, 0xda342e34
mov r9d, 0x8f7a9342
xor edx, edx
div r9d
mov rdx, r8
shr rdx, 0xb
xor rdx, r8
cmp eax, 0x3db3acea
ja 0x180336a85
jmp 0x180336a03
mov r8, rdx
rol r8, 7
mov eax, dword [0x180785150]
imul eax, dword [0x180785154]
add eax, 0xf16beb6
or eax, 0x8bbeee4
add eax, 0x965276d1
cmp eax, 0xb73b48a2
je 0x180336a92
jmp 0x180336a2f
mov r9d, dword [0x180785158]
imul r9d, dword [0x18078515c]
and r9d, 0xc79ceb93
add r9d, 0xf5e37894
and r9d, 0xaf30036e
mov rax, rdx
xor rax, r8
xor rax, 0xffffffffd1915e90
add rax, 0xffffffff9dfc2af2
mov r10, rax
rol r10, 1
xor r10, rax
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r9d, 0xba2f28e6
jae 0x180336a2f
ret
sub al, 0x56
ror byte [rsi - 0x5d], 1
jrcxz 0x180336af2
invalid
cmp al, 0xb2
sahf
sbb ch, byte [rsi + 0x16]
std
jmp 0x180336a2d
Function at 0x180336e00
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1807851c0]
sub eax, dword [0x1807851c4]
add eax, 0x931067df
or eax, 0x8e83803
add eax, 0x7e548574
cmp eax, 0x6405160
jb 0x180336f22
jmp 0x180336e28
mov eax, dword [0x1807851c8]
and eax, dword [0x1807851cc]
sub eax, 0x2f99aada
xor eax, 0xc07b3697
imul eax, eax, 0x6f877c9e
mov r8, rdx
shr r8, 0xa
xor r8, rdx
cmp eax, 0x43711fbf
je 0x180336e28
jmp 0x180336e57
mov eax, dword [0x1807851d0]
imul eax, dword [0x1807851d4]
mov r9d, 0x6848e9a
xor edx, edx
div r9d
or eax, 0x15297611
and eax, 0xc0b6d040
cmp eax, 0x17f68570
je 0x180336f33
mov eax, dword [0x1807851d8]
add eax, dword [0x1807851dc]
or eax, 0x5b6e88ab
add eax, 0xd1a559f9
imul eax, eax, 0x6152aa3f
mov r9, r8
rol r9, 7
xor r9, r8
add r9, 0xfffffffff0923414
mov rdx, r9
rol rdx, 1
xor rdx, r9
cmp eax, 0x85f27ce9
jbe 0x180336f33
jmp 0x180336ec3
mov eax, dword [0x1807851e0]
add eax, dword [0x1807851e4]
add eax, 0x5da256bf
xor eax, 0xadfbfac1
sub eax, 0xeae114b2
cmp eax, 0x530b035a
jae 0x180336f44
mov r8d, dword [0x1807851e8]
sub r8d, dword [0x1807851ec]
and r8d, 0xc0ffd3dc
add r8d, 0x683dd727
or r8d, 0x35103def
mov r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0xbe28d961
ja 0x180336f44
ret
and edi, dword [rcx]
js 0x180336efa
and eax, 0x1353cc41
or dh, al
jmp 0x180336e26
invalid
push rsp
jbe 0x180336f7c
div byte [rcx - 0x142c30a2]
xchg edi, eax
int3
out dx, eax

Function at 0x1803371d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180785230]
and eax, dword [0x180785234]
mov r9d, 0x5047a761
xor edx, edx
div r9d
and eax, 0x5cdb4d9c
imul eax, eax, 0x8463ab50
cmp eax, 0x9c80d22c
je 0x1803372b6
mov eax, dword [0x180785238]
imul eax, dword [0x18078523c]
mov r9d, 0xb739df2f
xor edx, edx
div r9d
add eax, 0x63d1c2bc
add eax, 0xf3ad2ddd
mov rdx, r8
shr rdx, 0x1d
xor rdx, r8
add rdx, 0xffffffffb0a82a79
mov r9, rdx
rol r9, 7
xor r9, rdx
cmp eax, 0x24211524
jbe 0x1803372b6
jmp 0x180337246
mov eax, dword [0x180785240]
add eax, dword [0x180785244]
sub eax, 0x23db5309
imul eax, eax, 0xb58f8bf
mov r8d, 0xe0151dc6
xor edx, edx
div r8d
cmp eax, 0x5f2ac5ff
jae 0x1803372c3
jmp 0x180337271
mov edx, dword [0x180785248]
sub edx, dword [str.eaI290]
or edx, 0x8f4cfb49
add edx, 0xdca4eb8
sub edx, 0xbe129f13
xor r8d, r8d
sub r8, r9
mov rax, r8
rol rax, 4
xor rax, r8
and rax, 0xffff
cmp edx, 0xa594e41e
jae 0x180337271
jmp 0x1803372af
add rcx, rax
mov rax, rcx
ret
xchg esp, eax
invalid
pop rsp
or al, 0xe6
sbb eax, 0xb0337669
adc al, 0x93
cdq
jmp 0x18033726f