joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801dd460
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180518688]
and eax, dword [0x18051868c]
xor eax, 0xfcbe75d8
mov r9d, 0x4ee86b9c
xor edx, edx
div r9d
imul eax, eax, 0xe596b8ae
cmp eax, 0xe53def4b
jae 0x1801dd4d8
jmp 0x1801dd48e
mov edx, dword [0x180518690]
imul edx, dword [0x180518694]
and edx, 0x932591f9
sub edx, 0x6ed45f1
add edx, 0xf1517f67
mov r9, r8
xor r9, 0xffffffffa7f9d9fa
mov rax, r9
rol rax, 6
xor rax, r9
cmp edx, 0x366dfc88
jbe 0x1801dd48e
jmp 0x1801dd4cb
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
mov r10d, 0x5d78c760
or al, byte [rax]
enter 0x7eaa, 0xfffffffffffffffb
jmp 0x1801dd48c

Function at 0x1801de630
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0xffffffffe58f48dd
movabs rax, 0x16582e52a95ae0e0
imul r8, rax
movabs rax, 0xa33c3a4f35e19500
add r8, rax
mov eax, dword [0x180518788]
imul eax, dword [0x18051878c]
mov r9d, 0x6b176bcc
xor edx, edx
div r9d
or eax, 0xff21736e
xor eax, 0x3bb6f174
cmp eax, 0x5036eacf
jb 0x1801de6bf
jmp 0x1801de680
mov eax, dword [0x180518790]
xor edx, edx
div dword [0x180518794]
sub eax, 0x35eb827f
imul edx, eax, 0x4a418f86
sub edx, 0xe2cf1481
mov r9, r8
rol r9, 6
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xaf93e34c
ja 0x1801de680
ret
retf

Function at 0x1801df1a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0x500aa8bf
sub rax, rdx
mov r8, rax
rol r8, 6
xor r8, rax
mov r9, r8
rol r9, 1
mov eax, dword [0x180518828]
xor eax, dword [0x18051882c]
add eax, 0x5be4776
mov r10d, 0x2301dd3a
xor edx, edx
div r10d
and eax, 0xdf71bc2b
cmp eax, 0xf9de9a45
je 0x1801df232
jmp 0x1801df1e2
mov eax, dword [0x180518830]
and eax, dword [0x180518834]
sub eax, 0x2afcba5e
mov r10d, 0xe2a188f4
xor edx, edx
div r10d
mov edx, eax
and edx, 0xa79cbb31
mov rax, r9
xor rax, r8
imul rax, rax, 0x4e1a451b
mov r10, rax
rol r10, 1
xor r10, rax
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x26481eac
je 0x1801df1e2
ret
stosb byte [rdi], al
xor byte [rax], al
invalid

Function at 0x1801e0eb0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
add r8, 0xffffffffc2c7d904
mov r9, r8
rol r9, 2
mov eax, dword [0x1805189d8]
sub eax, dword [0x1805189dc]
xor eax, 0x2f1db806
and eax, 0x2cff5802
sub eax, 0xeb022a1b
cmp eax, 0xa59b9a25
ja 0x1801e0f27
jmp 0x1801e0ee5
mov eax, dword [0x1805189e0]
xor edx, edx
div dword [0x1805189e4]
mov r10d, 0x46acc4e
xor edx, edx
div r10d
imul edx, eax, 0x88643a76
add edx, 0x6f58de9d
mov rax, r9
xor rax, r8
and rax, 0xffff
cmp edx, 0x575635f3
jbe 0x1801e0ee5
jmp 0x1801e0f20
add rcx, rax
mov rax, rcx
ret
stosd dword [rdi], eax
sbb al, 0x5f
in eax, dx
int 0x94
pop rax
add ebx, ebp
mov dl, 0xcc
int3
Function at 0x1801e12d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180518a18]
add eax, dword [0x180518a1c]
and eax, 0xa3ab5704
mov r9d, 0xb6b0ebe4
xor edx, edx
div r9d
or eax, 0x4a4e9a0c
cmp eax, 0xb3f2716c
jae 0x1801e13ed
mov eax, dword [0x180518a20]
xor edx, edx
div dword [0x180518a24]
add eax, 0xcc936bd6
add eax, 0xfbf271ee
add eax, 0x350b9371
mov edx, 0xc6dc88b
sub rdx, r8
mov r9, rdx
rol r9, 1
cmp eax, 0x12d3c4e
jb 0x1801e13ed
jmp 0x1801e1337
mov eax, dword [0x180518a28]
and eax, dword [0x180518a2c]
xor eax, 0x9ed56145
or eax, 0xfa0bb6d9
xor eax, 0xd29ef39e
cmp eax, 0xb2a0ee2a
ja 0x1801e13fe
jmp 0x1801e135f
mov eax, dword [0x180518a30]
xor eax, dword [0x180518a34]
or eax, 0xef12448d
and eax, 0x3e7124fb
imul eax, eax, 0x6d532295
mov r8, r9
xor r8, rdx
and r8, 0xffff
cmp eax, 0xa859ac70
jb 0x1801e135f
jmp 0x1801e1391
mov eax, dword [0x180518a38]
and eax, dword [0x180518a3c]
mov r9d, 0x1269dfb7
xor edx, edx
div r9d
or eax, 0xfa6a547c
imul eax, eax, 0xaadfe55e
cmp eax, 0x673e17dd
ja 0x1801e140b
jmp 0x1801e13bc
mov eax, dword [0x180518a40]
xor edx, edx
div dword [0x180518a44]
mov edx, eax
sub edx, 0xad2ce83f
add edx, 0xaac11221
xor edx, 0x7484c60e
mov rax, rcx
add rax, r8
cmp edx, 0x893cecca
jae 0x1801e13bc
ret
jne 0x1801e13f7
movabs byte [0xa6526a4c743d3c99], al
cmpsb byte [rsi], byte [rdi]
xor eax, 0xffff01e9
jmp [rbx + 0x39]
imul edi, dword [rcx], 0x4f
sub cl, byte [rax]
mov ch, 0x79
jmp 0x1801e135d
shl dword [rax + 0x42], 1
invalid

Function at 0x1801e2360
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x6df3bd05
sub rax, rdx
imul r8, rax, 0xffffffffa077b89c
mov r9, r8
shr r9, 0x13
mov eax, dword [0x180518b68]
sub eax, dword [0x180518b6c]
add eax, 0x860e1ab1
mov r10d, 0x7e187622
xor edx, edx
div r10d
sub eax, 0x782454b4
cmp eax, 0xf987ba78
je 0x1801e23e4
jmp 0x1801e23a0
mov eax, dword [0x180518b70]
and eax, dword [0x180518b74]
sub eax, 0x89f6138b
imul edx, eax, 0x9ef413b2
and edx, 0x3e99c424
mov rax, r9
xor rax, r8
cmp edx, 0xa55a5844
jae 0x1801e23a0
jmp 0x1801e23cd
mov rdx, rax
rol rdx, 1
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
add byte [rax + 1], cl
ror dword [rax - 0x77], 1
enter 0x70c3, 0xfffffffffffffff6
jo 0x1801e23dc
sub eax, 0x6837b039
xchg ecx, eax
xchg edx, eax
invalid

Function at 0x1801e2860
Capabilities:
Encode data using xor

Disassembly:
add rdx, 1
mov rax, rdx
rol rax, 1
rol eax, 1
xor rax, rdx
xor edx, edx
sub rdx, rax
mov r8, rdx
rol r8, 1
xor r8, rdx
mov eax, dword [0x180518bb8]
sub eax, dword [0x180518bbc]
and eax, 0xf9102b7b
xor eax, 0x2ca9e825
xor eax, 0x2421894f
cmp eax, 0x96835c14
jae 0x1801e28dd
jmp 0x1801e289f
mov eax, dword [0x180518bc0]
or eax, dword [0x180518bc4]
mov r9d, 0xcf1a6f43
xor edx, edx
div r9d
mov edx, eax
or edx, 0x79d9f327
xor edx, 0x400bb7fb
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x958fe29b
cli
wait
loop 0x1801e2868
xchg ebp, eax
ja 0x1801e289f
ret
push rdi
sub eax, 0x9c21bf9d
cmp byte [rbp + 0x51], cl
push rdx
stosb byte [rdi], al
jl 0x1801e28d5
mov dl, 0xcc
int3
Function at 0x1801e2aa0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180518be8]
xor eax, dword [0x180518bec]
add eax, 0xacdea5c5
sub eax, 0xcb85102e
imul eax, eax, 0xc10e7170
cmp eax, 0xd7c43bd7
ja 0x1801e2b21
jmp 0x1801e2ac8
mov eax, dword [0x180518bf0]
xor edx, edx
div dword [0x180518bf4]
imul eax, eax, 0xb11e4eda
sub eax, 0x552925e8
mov r9d, 0xdaf4d485
xor edx, edx
div r9d
mov rdx, r8
xor rdx, 0x1812d50d
add rdx, 1
cmp eax, 0x2f77840b
ja 0x1801e2ac8
jmp 0x1801e2b03
xor rdx, 0xffffffffaf80f241
mov rax, rdx
rol rax, 2
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
sal dword [rbx], 0x79
sbb al, 0xc2
shrd dword [rbx], edi, cl
jmp 0x1801e2ac6

Function at 0x1801e2e20
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180518c38]
add eax, dword [0x180518c3c]
and eax, 0x49ce0b12
sub eax, 0x6d2c3dee
mov r9d, 0x773b83c0
xor edx, edx
div r9d
cmp eax, 0xe7b536c4
je 0x1801e2f59
jmp 0x1801e2e51
mov eax, dword [0x180518c40]
xor eax, dword [0x180518c44]
xor eax, 0x43647fca
mov r9d, 0xadb657c5
xor edx, edx
div r9d
mov r9d, 0xc9cbcbbf
xor edx, edx
div r9d
mov rdx, r8
add rdx, 0xffffffffc1180c97
mov r9, rdx
shr r9, 0x19
xor r9, rdx
add r9, 1
cmp eax, 0x656eed33
je 0x1801e2e51
jmp 0x1801e2e99
mov eax, dword [0x180518c48]
add eax, dword [0x180518c4c]
xor eax, 0xd19079a3
and eax, 0x5edaab8
xor eax, 0xd4bace47
cmp eax, 0x5a8b78c9
je 0x1801e2f6a
jmp 0x1801e2ec1
mov eax, dword [0x180518c50]
add eax, dword [0x180518c54]
mov r8d, 0x55244f1b
xor edx, edx
div r8d
sub eax, 0xc1b3f4
or eax, 0x9236d541
mov r8, r9
rol r8, 2
xor r8, r9
cmp eax, 0x1ff1aca
jb 0x1801e2ec1
jmp 0x1801e2ef5
mov eax, dword [0x180518c58]
xor edx, edx
div dword [0x180518c5c]
imul eax, eax, 0xdd26e161
and eax, 0x8441c5bf
frstor dword es:[0x1045ff4cd]
mov r9d, 0xaae106d3
xor edx, edx
div r9d
cmp eax, 0xa2f5ede3
je 0x1801e2f77
jmp 0x1801e2f22
mov edx, dword [0x180518c60]
sub edx, dword [0x180518c64]
or edx, 0xa52a90a6
and edx, 0xb415873b
sub edx, 0xd85e5bba
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
loope 0x1801e2f46
invalid
inc dword [rax]
add byte [rax - 0x77], cl
enter 0x14c, 0xffffffffffffffc8
cmp edx, 0x421f12b4
jbe 0x1801e2f22
ret
invalid
jl 0x1801e2f07
sbb eax, 0x7970bdea
jmp 0x1801e2f45
lodsd eax, dword [rsi]
lodsd eax, dword [rsi]
sbb dword [rbx - 0x76], eax
stc
jmp 0x1801e2f5c
xlatb
test byte [rdi], ah
wait
ja 0x1801e2fea
and edx, dword [rbx + rbp*8 - 0x33333361]
int3
mov rdx, rcx
rol rdx, 7
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret
Function at 0x1801e4a30
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0x2d32d76
mov rax, rdx
rol rax, 6
xor rax, rdx
imul rax, rax, 0x231f1052
mov r8, rax
rol r8, 1
xor r8, rax
mov eax, dword [0x180518dd8]
and eax, dword [0x180518ddc]
imul eax, eax, 0x68ed5c51
mov r9d, 0x9e3124c5
xor edx, edx
div r9d
and eax, 0xc0671b1a
cmp eax, 0xbc06be2c
jae 0x1801e4ac4
jmp 0x1801e4a7c
mov eax, dword [0x180518de0]
imul eax, dword [0x180518de4]
and eax, 0x8f1ba4ef
mov r9d, 0x42eee876
xor edx, edx
div r9d
mov r9d, 0xef8b0362
xor edx, edx
div r9d
mov rdx, r8
rol rdx, 1
xor rdx, r8
cmp eax, 0x5c422c30
je 0x1801e4a7c
jmp 0x1801e4ab6
and rdx, 0xffff
add rcx, rdx
add ecx, edx
mov rax, rcx
ret
loope 0x1801e4abe
stosb byte [rdi], al
xlatb
invalid

Function at 0x1801e5230
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xffffffffff6487f3
sub rax, rdx
mov r8, rax
shr r8, 0xd
xor r8, rax
mov eax, dword [0x180518e48]
sub eax, dword [0x180518e4c]
sub eax, 0x5102669f
mov r9d, 0xc51cd139
xor edx, edx
div r9d
imul eax, eax, 0x4231951c
cmp eax, 0x9443aed8
je 0x1801e52b6
jmp 0x1801e526f
mov eax, dword [0x180518e50]
sub eax, dword [0x180518e54]
imul eax, eax, 0x952a8774
imul edx, eax, 0x8399962a
sub edx, 0xa95926e3
mov rax, r8
add rax, 0xffffffffbc24b89f
mov r9, rax
rol r9, 3
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x28271fd6
jb 0x1801e526f
ret
invalid

Function at 0x1801e5300
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x180518e58]
imul ecx, dword [0x180518e5c]
or ecx, 0xcd4adad9
sub ecx, 0xb3c6fc3
xor ecx, 0x38682574
cmp ecx, 0x358ee054
jb 0x1801e5386
jmp 0x1801e532c
mov r8d, dword [0x180518e60]
and r8d, dword [0x180518e64]
and r8d, 0x5d96e90
xor r8d, 0x3c63cfa5
and r8d, 0x504ae1d3
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
cmp r8d, 0x3355818d
jae 0x1801e532c
jmp 0x1801e5363
movabs rdx, 0x22ae5e6bdd914dd9
imul rcx, rdx
imul ecx, edx
mov rdx, rcx
rol rdx, 2
xor rdx, rcx
and rdx, 0xffff
add rax, rdx
ret
loope 0x1801e536e
test eax, 0x7461458e
push rax
invalid

Function at 0x1801e57e0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180518ea8]
xor edx, edx
div dword [0x180518eac]
imul eax, eax, 0x2bddc496
add eax, 0xde2105a0
sub eax, 0xcf59a608
cmp eax, 0x2e0c3e49
je 0x1801e586e
jmp 0x1801e580a
mov eax, dword [0x180518eb0]
xor edx, edx
div dword [0x180518eb4]
mov r9d, 0xe2d79b31
xor edx, edx
div r9d
add eax, 0x78282bcb
add eax, 0x9029a1a2
mov rdx, r8
rol rdx, 4
xor rdx, r8
imul r9, rdx, 0x3968b8f4
mov rdx, r9
rol rdx, 1
xor rdx, r9
cmp eax, 0xfe5fbd96
je 0x1801e580a
jmp 0x1801e5850
add rdx, 0xffffffffef3bcd88
mov rax, rdx
rol rax, 4
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
and ebp, dword [rsp + rsi - 0x6126e294]
movabs dword [0xcccc8cebb8e7f630], eax
int3
Function at 0x1801e6640
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 2
xor rax, rdx
mov rdx, rax
shr rdx, 0x1a
xor rdx, rax
imul r8, rdx, 0xffffffffb645ee96
mov r9, r8
rol r9, 6
mov eax, dword [0x180518fa8]
xor edx, edx
div dword [0x180518fac]
sub eax, 0x4c9930e3
and eax, 0xde5282cd
sub eax, 0x3ae224df
cmp eax, 0x248f7d2
jb 0x1801e66c3
jmp 0x1801e6688
mov edx, dword [0x180518fb0]
and edx, dword [0x180518fb4]
and edx, 0x1bf34c1b
and edx, 0xb57de419
add edx, 0x30735ad5
mov rax, r9
xor rax, r8
and rax, 0xffff
cmp edx, 0x9db17968
je 0x1801e6688
jmp 0x1801e66bc
add rcx, rax
mov rax, rcx
ret
invalid

Function at 0x1801e6760
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
mov r9, r8
shr r9, 0x17
mov eax, dword [0x180518fb8]
and eax, dword [0x180518fbc]
and eax, 0x5c8232ed
add eax, 0x4b7e267
imul eax, eax, 0x708b2049
cmp eax, 0x61d2f96f
je 0x1801e67e6
jmp 0x1801e678f
mov eax, dword [0x180518fc0]
and eax, dword [0x180518fc4]
imul eax, eax, 0xed652eb8
sub eax, 0xaf217049
mov r10d, 0xeffee8c
xor edx, edx
div r10d
mov r10, r9
xor r10, r8
xor r10, 0xffffffffa05fed1c
add r10, 0x58b8813
mov rdx, r10
rol rdx, 2
xor rdx, r10
cmp eax, 0x4fdd4e3c
je 0x1801e678f
jmp 0x1801e67d8
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
rcr dword [rdi + 0xd], 0x70
mov bh, 0x66
mov cl, 0xb0
call 0x11a0a2ff5
int3

Function at 0x1801e6d20
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180519008]
add eax, dword [0x18051900c]
or eax, 0x2dd1f858
and eax, 0x3a737c4d
mov r9d, 0xf34f36c0
xor edx, edx
div r9d
cmp eax, 0x9bc04210
jae 0x1801e6d99
jmp 0x1801e6d4d
mov eax, dword [0x180519010]
imul eax, dword [0x180519014]
or eax, 0xc750da9c
mov r9d, 0x4f091264
xor edx, edx
div r9d
xor eax, 0xfed052c9
mov r9d, 0x18b905c
sub r9, r8
mov rdx, r9
rol rdx, 6
xor rdx, r9
and rdx, 0xffff
cmp eax, 0x62030d09
jbe 0x1801e6d4d
jmp 0x1801e6d92
add rcx, rdx
mov rax, rcx
ret
cmp byte [rdx], ch
invalid

Function at 0x1801e7050
Capabilities:
Encode data using xor

Disassembly:
imul r8, rdx, 0x77b0a8c2
mov r9, r8
shr r9, 0x11
mov eax, dword [0x180519038]
and eax, dword [0x18051903c]
and eax, 0x6e2531a2
and eax, 0x18c05412
or eax, 0x2b0f5cf2
cmp eax, 0x308a3fc8
je 0x1801e70df
jmp 0x1801e7082
mov eax, dword [0x180519040]
add eax, dword [0x180519044]
xor eax, 0x9100ec68
mov r10d, 0x666217c3
xor edx, edx
div r10d
mov edx, eax
and edx, 0x8b58659d
mov rax, r9
xor rax, r8
mov r10, rax
rol r10, 3
xor r10, rax
mov eax, 0x45ca20e1
sub rax, r10
mov r10, rax
rol r10, 1
xor r10, rax
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xae1af5ab
jae 0x1801e7082
jmp 0x1801e70de
ret
invalid
Function at 0x1801e72b0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180519068]
add eax, dword [0x18051906c]
or eax, 0xc82b00d4
imul eax, eax, 0x4116a7ae
and eax, 0x963a1cbd
cmp eax, 0x69dede8e
je 0x1801e738b
jmp 0x1801e72dc
mov eax, dword [0x180519070]
sub eax, dword [0x180519074]
xor eax, 0xba21bc9
mov r9d, 0x85ee7f4b
xor edx, edx
div r9d
and eax, 0x1e627252
mov rdx, r8
xor rdx, 0xffffffffc5e24064
imul r9, rdx, 0x4eb04384
add r9, 0x7ab7dd82
mov rdx, r9
rol rdx, 5
cmp eax, 0xb7eadf15
jae 0x1801e72dc
jmp 0x1801e7325
xor rdx, r9
mov eax, dword [0x180519078]
sub eax, dword [0x18051907c]
xor eax, 0x3d2b453a
imul eax, eax, 0x48d81895
imul eax, eax, 0xb87019a3
cmp eax, 0x7032f69a
jbe 0x1801e7398
shl byte [rbx + 0x3db87019], 0x9a
div byte [rdx]
jo 0x1801e73c1
jmp 0x1801e734e
jmp 0x1801e734e
mov r8d, dword [0x180519080]
and r8d, dword [0x180519084]
sub r8d, 0x5e081eba
sub r8d, 0xbaa57ed4
add r8d, 0x5c856365
mov r9, rdx
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0xc3327f13
jbe 0x1801e734e
ret
iretd
fist word [rdx]
loopne 0x1801e7340
or dh, byte [rbp - 0x7765094]
jmp 0x1801e734c
rol ecx, 7

Function at 0x1801e8650
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1805191b8]
add eax, dword [0x1805191bc]
add eax, 0x6b7bade
add eax, 0x9e5ea32e
sub eax, 0x17b16dbc
cmp eax, 0xfbf4e0cd
ja 0x1801e8721
jmp 0x1801e8678
mov eax, dword [0x1805191c0]
imul eax, dword [0x1805191c4]
imul eax, eax, 0x9797ad2c
and eax, 0x4c3c936c
imul eax, eax, 0x348ab57b
movabs r9, 0xaa4432f80290590
mov r8, rdx
imul r8, r9
cmp eax, 0xe6119af9
jb 0x1801e8678
jmp 0x1801e86b0
xor r8, 0xffffffff948c03ef
mov eax, dword [0x1805191c8]
xor edx, edx
div dword [0x1805191cc]
add eax, 0x85e2f469
or eax, 0x20426398
imul eax, eax, 0xee803c82
cmp eax, 0x360082b3
je 0x1801e872e
jmp 0x1801e86de
mov eax, dword [0x1805191d0]
imul eax, dword [0x1805191d4]
xor eax, 0x7e03fdbf
mov r9d, 0x4b7961a
xor edx, edx
div r9d
imul edx, eax, 0x15b7acf
mov r9, r8
rol r9, 3
xor r9, r8
and r9, 0xfff7
mov rax, rcx
add rax, r9
cmp edx, 0x82ade5
je 0x1801e86de
ret
invalid
sub dword [rsi + rcx*8 + 0x15], eax
invalid
Function at 0x1801e9800
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 0x1c
xor rax, rdx
mov r8d, 0x729fb9c3
sub r8, rax
mov eax, dword [0x1805192d8]
xor eax, dword [0x1805192dc]
mov r9d, 0x6a0d4ab1
xor edx, edx
div r9d
xor eax, 0x53fc24cb
add eax, 0xf7fdf00a
cmp eax, 0x84db7b02
jae 0x1801e98dc
jmp 0x1801e9841
mov eax, dword [0x1805192e0]
add eax, dword [0x1805192e4]
mov r9d, 0x8ca36e50
xor edx, edx
div r9d
sub eax, 0xefc321fa
mov r9d, 0xa61d5cf6
xor edx, edx
div r9d
mov rdx, r8
rol rdx, 3
cmp eax, 0x95e8a8ad
jae 0x1801e9841
jmp 0x1801e9878
mov eax, dword [0x1805192e8]
and eax, dword [0x1805192ec]
add eax, 0x10768dc5
sub eax, 0xd05aef25
sub eax, 0x4961fdad
cmp eax, 0x493b09d4
ja 0x1801e98e9
jmp 0x1801e989c
mov r9d, dword [0x1805192f0]
and r9d, dword [0x1805192f4]
or r9d, 0xea01254f
and r9d, 0x2e66931c
add r9d, 0x81d9b86a
mov r10, rdx
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r9d, 0x750bb152
jb 0x1801e989c
ret
xor al, al
adc dword [rbp + rdx*4 - 0x1639cde9], edi
push rsi
invalid
movabs dword [0xeb059b051b3dbc40], eax
cmpsd dword [rsi], dword [rdi]
int3

Function at 0x1801ea2d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
shr r8, 3
xor r8, rdx
mov eax, dword [0x180519398]
imul eax, dword [0x18051939c]
imul eax, eax, 0x631baa42
mov r9d, 0x798f3f91
xor edx, edx
div r9d
sub eax, 0xfa7cb81d
cmp eax, 0x81d36cec
je 0x1801ea351
jmp 0x1801ea306
mov edx, dword [0x1805193a0]
and edx, dword [str.Tg7]
add edx, 0x832bdc6f
sub edx, 0x8e7a6ab6
and edx, 0xc62f127d
xor eax, eax
sub rax, r8
xor rax, 0x1823f50e
cmp edx, 0x84c7be43
jbe 0x1801ea306
jmp 0x1801ea339
mov rdx, rax
rol rdx, 3
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
sbb eax, 0xd91be4d6
cdq
mov ebx, 0x82128b8e
xor eax, 0x4ccca5eb
imul r8, rdx, 0x726147de

Function at 0x1801eb940
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180519508]
and eax, dword [0x18051950c]
sub eax, 0xe197a14c
imul eax, eax, 0x32ea58a0
add eax, 0xa50c8390
cmp eax, 0x1258f1ae
jb 0x1801eb9b8
jmp 0x1801eb968
mov eax, dword [0x180519510]
or eax, dword [0x180519514]
xor eax, 0xab39968b
mov r9d, 0xda8791d3
xor edx, edx
div r9d
or eax, 0x8d942e9e
mov rdx, r8
rol rdx, 1
cmp eax, 0x38fa4f29
jbe 0x1801eb968
jmp 0x1801eb998
xor rdx, r8
add rdx, 0x54ce0c10
mov rax, rdx
rol rax, 1
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
invalid

Function at 0x1801eba00
Capabilities:
Encode data using xor

Disassembly:
imul rax, rdx, 0x7b7694ab
mov r8, rax
shr r8, 1
xor r8, rax
mov eax, dword [0x180519518]
and eax, dword [0x18051951c]
mov r9d, 0xf9f6a9ac
xor edx, edx
div r9d
sub eax, 0xf767846c
or eax, 0xbb56c084
cmp eax, 0xa5b84907
jbe 0x1801eba85
jmp 0x1801eba3a
mov edx, dword [0x180519520]
imul edx, dword [0x180519524]
xor edx, 0x9b57fd4d
or edx, 0xdb3e5049
or edx, 0x12f77d6d
xor eax, eax
sub rax, r8
cmp edx, 0x3842ec45
jbe 0x1801eba3a
jmp 0x1801eba68
xor rax, 0xffffffff8207628e
mov rdx, rax
rol rdx, 1
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
invalid
Function at 0x1801ec6a0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0xffffffffce22ead3
mov eax, dword [0x1805195f8]
sub eax, dword [0x1805195fc]
add eax, 0x9d5ccfee
mov r9d, 0xad795bff
xor edx, edx
div r9d
xor eax, 0xa0ba22e3
cmp eax, 0xb28faf2d
jae 0x1801ec71d
jmp 0x1801ec6d4
mov edx, dword [0x180519600]
sub edx, dword [0x180519604]
sub edx, 0x542f1d1c
or edx, 0xd846cac0
or edx, 0x33083ca5
mov r9, r8
add r9, 0x249fec5c
mov rax, r9
rol rax, 3
xor rax, r9
and rax, 0xffff
cmp edx, 0x8b277db5
jb 0x1801ec6d4
jmp 0x1801ec716
add rcx, rax
mov rax, rcx
ret
leave
mov edx, 0x7c2b7e4b
invalid

Function at 0x1801eeaa0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, 0xe2b923c7
sub r8, rdx
mov r9, r8
rol r9, 7
mov eax, dword [0x180519878]
and eax, dword [0x18051987c]
add eax, 0x15ff5959
mov r10d, 0xa8f1c412
xor edx, edx
div r10d
or eax, 0x99d3b1df
cmp eax, 0x2afc3ae5
je 0x1801eeb18
jmp 0x1801eeada
mov eax, dword [0x180519880]
xor edx, edx
div dword [str._WLExR]
mov edx, eax
or edx, 0x370e0946
xor edx, 0xdfa169c5
add edx, 0xbc88c464
mov r10, r9
xor r10, r8
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xddcec3d5
ja 0x1801eeada
ret
invalid

Function at 0x1801ef630
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180519918]
and eax, dword [0x18051991c]
xor eax, 0xa328e6de
mov r9d, 0xcb7b0146
xor edx, edx
div r9d
and eax, 0x5559f65f
cmp eax, 0xc044e4bb
je 0x1801ef71b
jmp 0x1801ef661
mov eax, dword [0x180519920]
add eax, dword [0x180519924]
imul eax, eax, 0xe09292
imul eax, eax, 0xb7358e1d
sub eax, 0x9e4fd423
mov rdx, r8
rol rdx, 4
xor rdx, r8
imul rdx, rdx, 0xffffffffb229cffc
mov r9, rdx
rol r9, 7
xor r9, rdx
cmp eax, 0xe321f2c4
jae 0x1801ef661
jmp 0x1801ef6a2
mov eax, dword [0x180519928]
xor eax, dword [0x18051992c]
mov r8d, 0x46250811
xor edx, edx
div r8d
mov r8d, 0x838ed16f
xor edx, edx
div r8d
sub eax, 0xac2cbbdc
cmp eax, 0x54cb5646
je 0x1801ef72c
mov eax, dword [0x180519930]
sub eax, dword [0x180519934]
imul eax, eax, 0xe8a4ada8
imul eax, eax, 0x6d8145cb
imul r8d, eax, 0x6b5b61ab
mov rax, r9
rol rax, 4
xor rax, r9
mov rdx, rax
rol rdx, 1
cmp r8d, 0xec8f50de
je 0x1801ef72c
jmp 0x1801ef70a
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
fadd st(2)
rcl edi, 0x15
fmul qword [rdi]
stc
pop rbx
xchg esi, eax
jmp 0x1801ef765
or dl, bl
add edi, ebp
mov esi, 0x28cf40e4
rcr byte [rdx - 0x4d], cl
jmp 0x1801ef6d0
imul eax, eax, 0x189cf96f
cmp eax, 0x4acc7db3
jbe 0x1801ef7bc
mov edx, dword [0x180519940]
imul edx, dword [0x180519944]
add edx, 0xb05940a6
xor edx, 0xd4d195cf
sub edx, 0x5aae86cc
mov r9, r8
rol r9, 4
xor r9, r8
mov rax, r9
rol rax, 1
xor rax, r9
and rax, 0xffff
cmp edx, 0xa774c601
ja 0x1801ef7bc
jmp 0x1801ef7b5
add rcx, rax
mov rax, rcx
ret
fimul word [0x17692d4c9]
out 0x2a, al
mov esi, 0xebf74d71
test eax, 0xcccccccc
int3
Function at 0x1801eff80
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 5
xor rax, rdx
imul rdx, rax, 0xffffffff848d68b7
mov rax, rdx
rol rax, 4
xor rdx, rax
xor rdx, 0xffffffff8d079f1e
mov r8, rdx
rol r8, 4
mov eax, dword [0x180519998]
and eax, dword [0x18051999c]
xor eax, 0x83dfabce
imul eax, eax, 0x236bbfc3
add eax, 0x5677d136
cmp eax, 0xa098b84d
jae 0x1801f000e
jmp 0x1801effce
mov r9d, dword [0x1805199a0]
xor r9d, dword [0x1805199a4]
add r9d, 0xce2bedcb
and r9d, 0xd81b0f4b
sub r9d, 0x82202950
mov r10, r8
xor r10, rdx
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r9d, 0xf65c807b
jae 0x1801effce
ret
or dl, bl
ret

Function at 0x1801f0020
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1805199a8]
or eax, dword [0x1805199ac]
imul eax, eax, 0x4a289681
and eax, 0x76d3a287
xor eax, 0x62371041
cmp eax, 0xe6ad4d6c
jae 0x1801f00a7
jmp 0x1801f0048
mov eax, dword [0x1805199b0]
xor edx, edx
div dword [0x1805199b4]
sub eax, 0x1744efef
imul edx, eax, 0x595c08e5
xor edx, 0xc7385ec8
mov rax, r8
rol rax, 7
cmp edx, 0x8419fa4a
jae 0x1801f0048
jmp 0x1801f0078
xor rax, r8
imul rax, rax, 0xffffffffc35c369d
movabs rdx, 0xf01be0d6b4559222
add rax, rdx
mov rdx, rax
rol rdx, 2
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
nop
invalid

Function at 0x1801f0190
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x1805199c8]
xor ecx, dword [0x1805199cc]
xor ecx, 0x2f9d61f7
xor ecx, 0x9d28ddbf
imul ecx, ecx, 0xc26c5e4
cmp ecx, 0xd2350997
jae 0x1801f0223
jmp 0x1801f01bb
mov r8d, dword [0x1805199d0]
xor r8d, dword [0x1805199d4]
and r8d, 0xd5588670
add r8d, 0xc6fa615e
and r8d, 0x1cd61b4f
imul rcx, rdx, 0x4b2353d6
cmp r8d, 0xfdcbab0d
ja 0x1801f01bb
jmp 0x1801f01f0
mov rdx, rcx
shr rdx, 0x1f
xor rdx, rcx
mov rcx, 0xffffffffe8e3dff6
sub rcx, rdx
mov rdx, rcx
shr rdx, 0xd
xor rdx, rcx
mov rcx, rdx
rol rcx, 5
xor rcx, rdx
and rcx, 0xffff
add rax, rcx
ret
nop
invalid

Function at 0x1801f0d40
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x7179ca92
add rdx, 0x7685568d
mov rax, rdx
rol rax, 3
xor rax, rdx
mov r8, rax
rol r8, 3
xor r8, rax
mov eax, dword [0x180519a58]
xor eax, dword [0x180519a5c]
add eax, 0x45a2dda0
xor eax, 0x2502d384
imul eax, eax, 0xfd0eb2ab
cmp eax, 0x304dc954
jae 0x1801f0dc1
mov eax, dword [0x180519a60]
or eax, dword [0x180519a64]
add eax, 0x4443230b
or eax, 0xb1317f2f
mov r9d, 0xd7d54c6f
xor edx, edx
div r9d
mov edx, eax
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x3a0b2a7e
ja 0x1801f0dc1
ret
mov esp, 0x7003c636
movabs eax, dword [0xccb6ebe130f9aa94]