joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802c9e90
Capabilities:
Encode data using xor

Disassembly:
imul r8, rdx, 0xffffffff9e77df19
mov eax, dword [0x180779e70]
add eax, dword [0x180779e74]
or eax, 0xec42834d
mov r9d, 0x10ff8112
xor edx, edx
div r9d
xor eax, 0xd22eef81
cmp eax, 0x3cf06736
jbe 0x1802c9f14
jmp 0x1802c9ec1
mov eax, dword [0x180779e78]
and eax, dword [0x180779e7c]
and eax, 0x7a9c869d
and eax, 0x7506547d
imul r9d, eax, 0xdda49367
mov rdx, r8
add rdx, 0xffffffffb0e28c1c
mov rax, rdx
rol rax, 1
cmp r9d, 0x9e5b6136
je 0x1802c9ec1
jmp 0x1802c9ef9
xor rax, rdx
mov rdx, rax
rol rdx, 3
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
rol ebx, 0x66
imul ecx, dword [rsi], 0xffffffdf
ror byte [rdx], 1
jo 0x1802c9f67
cli
jmp 0x1802c9ebf
mov r9d, 0xbdb8544e
xor edx, edx
div r9d
imul edx, eax, 0x39dc8201
or edx, 0x1bbddb9b
mov eax, 0x332c7fef
sub rax, r8
cmp edx, 0xae7af47f
je 0x1802c9ffe
jmp 0x1802c9f90
mov edx, dword [0x180779e90]
or edx, dword [0x180779e94]
imul edx, edx, 0xd86df256
add edx, 0xb7360786
imul edx, edx, 0x67166a0b
cmp edx, 0x77fe2067
jae 0x1802ca00f
jmp 0x1802c9fb8
mov r8d, dword [0x180779e98]
or r8d, dword [0x180779e9c]
xor r8d, 0x4760c8f3
add r8d, 0x2333102
xor r8d, 0x64c4e952
mov rdx, rax
rol rdx, 6
xor rdx, rax
cmp r8d, 0x87787aee
jae 0x1802c9fb8
jmp 0x1802c9ff0
add byte [rax - 0x7f], cl
loop 0x1802c9ff3
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
invalid
inc dword [rax]
add byte [rax + 1], cl
ror dword [rax - 0x77], 1
enter 0x75c3, 0x47
jne 0x1802ca047
sub edx, dword [rdx]
js 0x1802c9fae
loop 0x1802c9fef
sub dword [rdx + rdx*2 - 0xb41626], 0xffffffff
call rsp
sub eax, dword [rax + 0x159685ec]
mov ebx, ebp
popfq
int3
invalid
div r9d
cmp eax, 0x335ad3d6
ja 0x1802ca0b2
jmp 0x1802ca053
mov eax, dword [0x180779ea8]
and eax, dword [0x180779eac]
imul eax, eax, 0xed64453d
imul eax, eax, 0x69e676a9
mov r9d, 0xa1e85f32
xor edx, edx
div r9d
mov rdx, 0xffffffffc5edad05
sub rdx, r8
mov r9, rdx
rol r9, 4
xor r9, rdx
add r9, 0xffffffffbe68edc7
mov rdx, r9
rol rdx, 2
xor rdx, r9
cmp eax, 0xbdd200c3
je 0x1802ca053
jmp 0x1802ca0a4
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
invalid

Function at 0x1802ca020
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [str.__V3w]
add eax, dword [0x180779ea4]
mov r9d, 0x6c627886
xor edx, edx
div r9d
and eax, 0x1e246294
mov r9d, 0xf929f968
xor edx, edx

Function at 0x1802ca0c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
movabs rcx, 0x23d5b5e9a1d9d350
imul rdx, rcx
mov rcx, rdx
rol rcx, 6
xor rcx, rdx
mov edx, dword [0x180779eb0]
xor edx, dword [str._a_tL:8]
or edx, 0x9e946519
or edx, 0x5169fbcd
and edx, 0x64fd1293
cmp edx, 0x42bc2076
jbe 0x1802ca13f
jmp 0x1802ca103
mov r8d, dword [0x180779eb8]
add r8d, dword [0x180779ebc]
xor r8d, 0xfd167ab3
xor r8d, 0x72ff6afa
or r8d, 0xe70c5cc1
mov rdx, rcx
and rdx, 0xffff
cmp r8d, 0xb5fcf047
jb 0x1802ca103
jmp 0x1802ca13b
add rax, rdx
ret
push rsi
movabs eax, dword [0xb8eb29fb01e2641b]
int3
Function at 0x1802ca430
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180779f00]
sub eax, dword [0x180779f04]
add eax, 0x9c3489a5
imul eax, eax, 0x18f6b0cd
mov r9d, 0x7164ad85
xor edx, edx
div r9d
cmp eax, 0xaa23abc8
ja 0x1802ca4b7
jmp 0x1802ca45e
mov eax, dword [0x180779f08]
or eax, dword [0x180779f0c]
mov r9d, 0xb4e9c9a3
xor edx, edx
div r9d
xor eax, 0x7577f6c1
and eax, 0xbca3b525
mov r9, r8
rol r9, 1
xor r9, r8
movabs rdx, 0x22ae5e6bdd914dd9
imul r9, rdx
mov rdx, r9
rol rdx, 2
xor rdx, r9
cmp eax, 0x785941f0
je 0x1802ca45e
jmp 0x1802ca4a9
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
invalid

Function at 0x1802cabb0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x180779fc0]
sub eax, dword [0x180779fc4]
or eax, 0x61b77c9a
and eax, 0xe535605a
mov r9d, 0x8c3f94fb
xor edx, edx
div r9d
cmp eax, 0xc5e84f28
ja 0x1802cac3b
jmp 0x1802cabdd
mov eax, dword [0x180779fc8]
add eax, dword [0x180779fcc]
xor eax, 0x91df7d4d
or eax, 0x19c06ad9
imul edx, eax, 0x88a548df
mov rax, r8
rol rax, 7
xor rax, r8
cmp edx, 0x10a2ba78
jbe 0x1802cabdd
jmp 0x1802cac0d
movabs rdx, 0xffffffff79fd800b
add rax, rdx
mov rdx, rax
shr rdx, 0x17
xor rdx, rax
mov rax, rdx
rol rax, 4
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
int1
outsb dx, byte [rsi]
push rbx
pop rbx
and eax, 0x7bd8fc03
invalid

Function at 0x1802cafe0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077a040]
or eax, dword [0x18077a044]
sub eax, 0x7c735868
or eax, 0x4b563626
or eax, 0x10bf7044
cmp eax, 0xa3f6a915
je 0x1802cb05a
jmp 0x1802cb007
mov eax, dword [0x18077a048]
or eax, dword [0x18077a04c]
add eax, 0x3c2200a
mov r9d, 0xdc8557fd
xor edx, edx
div r9d
imul edx, eax, 0x330b3434
mov rax, r8
add rax, 0x15d08b31
xor rax, 0x56bda029
cmp edx, 0x11ec93c9
je 0x1802cb007
jmp 0x1802cb042
mov rdx, rax
rol rdx, 3
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
pushfq
retf

Function at 0x1802cb110
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077a060]
sub eax, dword [0x18077a064]
and eax, 0x543ade5
mov r9d, 0x9991a6a4
xor edx, edx
div r9d
imul eax, eax, 0xd9c3f042
cmp eax, 0x1e83f729
je 0x1802cb1dd
jmp 0x1802cb142
mov eax, dword [0x18077a068]
xor edx, edx
div dword [0x18077a06c]
and eax, 0x253b9a5e
add eax, 0x25d1e844
add eax, 0x59fea914
mov r9d, 0x31e3058d
sub r9, r8
mov rdx, r9
rol rdx, 5
xor rdx, r9
and rdx, 0xffff
cmp eax, 0xee54849f
ja 0x1802cb142
jmp 0x1802cb182
add rcx, rdx
mov eax, dword [0x18077a070]
and eax, dword [0x18077a074]
add eax, 0xcf8666b7
imul eax, eax, 0xc2e774b8
imul eax, eax, 0xe66310db
cmp eax, 0x9d8034d4
ja 0x1802cb1ee
jmp 0x1802cb1ab
mov eax, dword [0x18077a078]
sub eax, dword [0x18077a07c]
add byte [rbx], bpl
add eax, 0x4aeec5
xor eax, 0x4f4a2120
mov r8d, 0xdd2e73bc
xor edx, edx
div r8d
mov r8d, 0x1d8b9222
xor edx, edx
div r8d
cmp eax, 0xff34f473
ja 0x1802cb1ab
mov rax, rcx
ret
jg 0x1802cb1af
sbb byte [rdx + 0x47], bh
and eax, 0x4ccb57f2
lahf
int 0xe9
push rdx
invalid
xchg ecx, eax
in al, dx
test byte [rax + 0x1d], 0x71
iretd
Function at 0x1802cb720
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077a120]
xor edx, edx
div dword [0x18077a124]
mov r9d, 0xc1963fc0
xor edx, edx
div r9d
add eax, 0xdefbb3b9
and eax, 0xf368d06f
cmp eax, 0x5ff8a5c2
jb 0x1802cb7ab
jmp 0x1802cb74f
mov eax, dword [0x18077a128]
sub eax, dword [0x18077a12c]
and eax, 0x1b5df15c
imul r9d, eax, 0x747339b4
or r9d, 0xc09214d8
mov rax, r8
rol rax, 3
xor rax, r8
xor edx, edx
sub rdx, rax
cmp r9d, 0x39cc8771
jb 0x1802cb74f
jmp 0x1802cb788
rol rdx, 2
add rax, 0xffffffffffffffff
xor rax, rdx
mov rdx, rax
rol rdx, 3
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
mov bl, 0x95
fcompi st(0)
invalid

Function at 0x1802cbb00
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x18077a180]
xor ecx, dword [0x18077a184]
imul ecx, ecx, 0xb34244c6
imul ecx, ecx, 0x369017ef
imul ecx, ecx, 0xbfb11580
cmp ecx, 0xb5ff8f1b
jbe 0x1802cbb84
jmp 0x1802cbb2b
mov ecx, dword [0x18077a188]
or ecx, dword [0x18077a18c]
imul r9d, ecx, 0xdc190953
add r9d, 0x85a042f
xor r9d, 0x71e80c1c
movabs r8, 0x1e5705b9083534f0
mov rcx, rdx
imul rcx, r8
xor rcx, 0xffffffff888e0792
mov r8, rcx
rol r8, 6
cmp r9d, 0xf691573b
jae 0x1802cbb2b
jmp 0x1802cbb76
xor r8, rcx
and r8, 0xffff
add rax, r8
ret
xor byte [rsi], ch
lodsd eax, dword [rsi]
cdq
push r15w
jmp 0x1802cbb29

Function at 0x1802cc1f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 2
mov r8d, dword [0x18077a240]
imul r8d, dword [0x18077a244]
add r8d, 0x3ed3c550
and r8d, 0xded71ccb
imul r8d, r8d, 0x3dd03ef5
cmp r8d, 0xd2ff2d0d
ja 0x1802cc2d2
mov r8d, dword [0x18077a248]
or r8d, dword [0x18077a24c]
and r8d, 0xd2191666
imul r9d, r8d, 0xc81784f
xor r9d, 0x913f32be
mov r8, rax
xor r8, rdx
imul r8, r8, 0xffffffffbfe02be0
movabs r10, 0x1c9e874b7457fa4b
add r8, r10
cmp r9d, 0x8c4fe812
je 0x1802cc2d2
jmp 0x1802cc270
mov eax, dword [0x18077a250]
and eax, dword [0x18077a254]
imul eax, eax, 0xc8e703cc
or eax, 0x6924dcf
and eax, 0x1401ec47
cmp eax, 0x76b54408
jae 0x1802cc2df
xchg r10, rax
invalid
jmp 0x1802cc295
mov eax, dword [0x18077a258]
imul eax, dword [0x18077a25c]
add eax, 0x9f3603b
sub eax, 0x60148a37
imul edx, eax, 0x1a4fc60e
mov r9, r8
rol r9, 6
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xf9a4ccbd
ja 0x1802cc295
ret
add al, byte [rbp + rdi - 0x764916a6]
sub eax, 0xffff49e9
push qword [rax - 0x5d]
jo 0x1802cc284
invalid
Function at 0x1802ccd90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x18077a380]
add eax, dword [0x18077a384]
add eax, 0x64e5f561
or eax, 0x5a88e84c
xor eax, 0x2fab8c8
cmp eax, 0x18f575d1
jb 0x1802cce4b
jmp 0x1802ccdb8
mov eax, dword [0x18077a388]
add eax, dword [0x18077a38c]
xor eax, 0x6f7d8c35
sub eax, 0xc688f85c
and eax, 0x96e8d382
mov r9, rdx
add r9, 0x1e3db3f4
mov r8, r9
rol r8, 2
xor r8, r9
cmp eax, 0x9ca334ed
jae 0x1802ccdb8
jmp 0x1802ccdf0
and r8, 0xffff
mov eax, dword [0x18077a390]
xor eax, dword [0x18077a394]
add eax, 0x9602d563
mov r9d, 0x77d9b1d5
xor edx, edx
div r9d
add eax, 0xa6a5a122
cmp eax, 0xd802b847
jae 0x1802cce5c
mov eax, dword [0x18077a398]
xor eax, dword [0x18077a39c]
add eax, 0x70e3f000
imul edx, eax, 0x29970187
or edx, 0x2a1ae16c
mov rax, rcx
add rax, r8
cmp edx, 0x29c9ec7e
je 0x1802cce5c
ret
test rax, 0xffffffffbbe9bf05
jp 0x1802ccea1
pop rax
and eax, dword [rbp - 0xa51699]
invalid
cdqe
sahf
invalid
invalid

Function at 0x1802cce70
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov r9, r8
shr r9, 6
mov eax, dword [0x18077a3a0]
and eax, dword [0x18077a3a4]
xor eax, 0xa06124fe
sub eax, 0xf00098fa
sub eax, 0xea0509e3
cmp eax, 0x5bd128fc
je 0x1802ccefa
jmp 0x1802cce9e
mov eax, dword [0x18077a3a8]
xor edx, edx
div dword [0x18077a3ac]
and eax, 0xe666b26
sub eax, 0xe58579da
and eax, 0x35cc4d8b
mov rdx, r9
xor rdx, r8
add rdx, 0xffffffffd99a8513
mov r10, rdx
rol r10, 1
xor r10, rdx
mov r11d, 0x6e16cec8
sub r11, r10
mov rdx, r11
rol rdx, 1
xor rdx, r11
and rdx, 0xffff
cmp eax, 0x629e165
je 0x1802cce9e
jmp 0x1802ccef3
add rcx, rdx
mov rax, rcx
ret
fcom dword [r8 + 0x58]
in al, dx
cmp al, byte [rax]
std
in eax, 0xc0
invalid

Function at 0x1802cdca0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x18077a500]
add eax, dword [0x18077a504]
and eax, 0x23eb694f
or eax, 0x59860f6e
or eax, 0xa99b20c6
cmp eax, 0xd6ad87a5
je 0x1802cdd77
jmp 0x1802cdcc8
mov eax, dword [0x18077a508]
sub eax, dword [0x18077a50c]
or eax, 0xbec86695
imul eax, eax, 0x8cf211b2
and eax, 0x570eb901
mov r8, rdx
xor r8, 0xffffffffd05e6976
add r8, 0x535d2aae
mov r9, r8
shr r9, 0x12
xor r8, r9
xor r8, 0x47451da9
mov r9, r8
rol r9, 5
cmp eax, 0xd8bb319a
je 0x1802cdcc8
jmp 0x1802cdd16
mov eax, dword [0x18077a510]
xor eax, dword [0x18077a514]
imul eax, eax, 0x20159aa8
or eax, 0xad0a89d8
and eax, 0xf98d44a5
cmp eax, 0xc1371419
je 0x1802cdd84
mov eax, dword [0x18077a518]
or eax, dword [0x18077a51c]
and eax, 0x593f3564
mov r10d, 0x5f31ddc5
xor edx, edx
div r10d
sub eax, 0x5101c71d
mov rdx, r9
xor rdx, r8
and rdx, 0xffff
cmp eax, 0x1e34c23f
jb 0x1802cdd84
jmp 0x1802cdd70
add rcx, rdx
mov rax, rcx
ret
cmp eax, 0xd97a1f0a
invalid
push rsi
mov esp, dword [rsi]
ficom dword [rsi + rax*2 - 0x5414c98e]
int3
Function at 0x1802ce260
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [0x18077a5a0]
and ecx, dword [0x18077a5a4]
or ecx, 0x79228983
add ecx, 0x506c1f5f
xor ecx, 0x5570f20e
cmp ecx, 0x4a21492b
jae 0x1802ce2e5
jmp 0x1802ce28b
mov r8d, dword [0x18077a5a8]
add r8d, dword [0x18077a5ac]
xor r8d, 0xc66bbb26
add r8d, 0x9bacb0cd
or r8d, 0xbb174db0
mov rcx, 0xffffffffa8ebbe54
sub rcx, rdx
xor rcx, 0xffffffffcb378cc0
cmp r8d, 0x7bb68ec
jbe 0x1802ce28b
jmp 0x1802ce2ca
add rcx, 0xffffffffe6968e4d
mov rdx, rcx
rol rdx, 1
xor rdx, rcx
and rdx, 0xffff
add rax, rdx
ret
adc edi, dword [rax + 0x1a]
out 0x52, al
imul ebx, dword [rax - 0x64], 0xeb8582b2
xchg esi, eax
int3

Function at 0x1802cedc0
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffffffffffff
imul r8, rdx, 0x41469668
mov eax, dword [0x18077a6e0]
or eax, dword [0x18077a6e4]
add eax, 0x49fa390f
xor eax, 0x763f03c5
and eax, 0x1a869867
cmp eax, 0xe47164c0
jae 0x1802cee45
jmp 0x1802cedef
mov eax, dword [0x18077a6e8]
xor eax, dword [0x18077a6ec]
mov r9d, 0x357bd06b
xor edx, edx
div r9d
and eax, 0xfc4c6429
xor eax, 0xb0f3f6d0
mov r9, r8
rol r9, 6
xor r9, r8
mov rdx, r9
rol rdx, 6
xor rdx, r9
mov r9, rdx
rol r9, 5
cmp eax, 0xe5ea12b9
je 0x1802cedef
jmp 0x1802cee34
xor r9, rdx
and r9, 0xffff
add rcx, r9
mov rax, rcx
ret
movabs dword [0x5eb241b937bcb00b], eax
xlatb
xchg ecx, eax
push rbp
jmp 0x1802ceded

Function at 0x1802cf450
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
imul rax, rdx, 0x66767056
movabs rdx, 0x205d36b93e088b72
add rax, rdx
mov r8, rax
rol r8, 2
xor r8, rax
and r8, 0xffff
mov eax, dword [0x18077a780]
xor eax, dword [0x18077a784]
mov r9d, 0xcaf9787b
xor edx, edx
div r9d
or eax, 0x77675ccc
imul eax, eax, 0x59d5e811
cmp eax, 0x792d93a1
jb 0x1802cf4d5
jmp 0x1802cf4a0
mov eax, dword [0x18077a788]
imul eax, dword [0x18077a78c]
mov r9d, 0x49b8c2d2
xor edx, edx
div r9d
mov edx, eax
xor edx, 0xc75067c0
sub edx, 0xf7711e66
mov rax, rcx
add rax, r8
cmp edx, 0xc459c555
je 0x1802cf4a0
ret
lodsb al, byte [rsi]
bnd retf

Function at 0x1802cf880
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077a7d0]
and eax, dword [0x18077a7d4]
add eax, 0x2e80ea52
mov r9d, 0x6ad0078b
xor edx, edx
div r9d
sub eax, 0x95b0f5e7
cmp eax, 0xf52edb26
jae 0x1802cf90b
jmp 0x1802cf8ad
mov eax, dword [0x18077a7d8]
sub eax, dword [0x18077a7dc]
sub eax, 0xefe1713f
add eax, 0x46f0f16c
mov r9d, 0x43627685
xor edx, edx
div r9d
mov rdx, r8
rol rdx, 1
xor rdx, r8
mov r10, rdx
rol r10, 3
xor r10, rdx
mov r9, 0xfffffffff03243b3
sub r9, r10
mov rdx, r9
rol rdx, 1
cmp eax, 0x7fd30239
jae 0x1802cf8ad
jmp 0x1802cf8fa
xor rdx, r9
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
pop rcx
sbb esi, ebx
pop rbp
sbb al, 0xab
jmp 0x1802cf8ab
Function at 0x1802cf9b0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077a7f0]
sub eax, dword [0x18077a7f4]
mov r9d, 0xf532c31e
xor edx, edx
div r9d
or eax, 0x7f463f8a
sub eax, 0xc716778
cmp eax, 0xf116c7dd
ja 0x1802cfa8d
mov eax, dword [0x18077a7f8]
and eax, dword [0x18077a7fc]
imul edx, eax, 0x1a840fd1
sub edx, 0x868b30ce
and edx, 0x9b36f9cb
imul r9, r8, 0x148a613
mov rax, r9
rol rax, 2
cmp edx, 0x65d6d365
je 0x1802cfa8d
jmp 0x1802cfa15
xor r9, rax
mov eax, dword [0x18077a800]
xor eax, dword [0x18077a804]
mov r8d, 0xf691b1cc
xor edx, edx
div r8d
imul eax, eax, 0xf6f3bb40
sub eax, 0x1df346b3
cmp eax, 0x5ffd0a9f
jb 0x1802cfa9e
jmp 0x1802cfa43
mov eax, dword [0x18077a808]
xor eax, dword [0x18077a80c]
mov r8d, 0xcd414b50
xor edx, edx
div r8d
or eax, 0x353f661f
imul edx, eax, 0xc492a0c3
mov rax, r9
xor rax, 0xffffffffe4e191bf
mov r8, rax
rol r8, 1
xor r8, rax
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0x7cab09cc
jae 0x1802cfa43
ret
pop rax
invalid
movabs eax, dword [0xebce4a4f0205c69f]
cdq
int3

Function at 0x1802cfd30
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0xfffffffff39bfa98
xor rdx, 0x6a891f6c
mov r8, rdx
rol r8, 2
xor r8, rdx
mov eax, dword [0x18077a850]
or eax, dword [0x18077a854]
xor eax, 0x78e1544
add eax, 0xae83c0e8
xor eax, 0x920dfdfd
cmp eax, 0xd4c27133
ja 0x1802cfda3
jmp 0x1802cfd6c
mov edx, dword [0x18077a858]
sub edx, dword [0x18077a85c]
xor edx, 0xc886ceba
add edx, 0x29b404fc
sub edx, 0x362d9a6a
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x1d47fa9b
jbe 0x1802cfd6c
ret
invalid

Function at 0x1802d0490
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x313bdddf
mov rax, rdx
rol rax, 5
xor rax, rdx
imul r8, rax, 0xffffffffe7f34688
mov eax, dword [0x18077a910]
and eax, dword [0x18077a914]
mov r9d, 0x7033b01d
xor edx, edx
div r9d
xor eax, 0x31a06398
mov r9d, 0xe72bd70e
xor edx, edx
div r9d
cmp eax, 0x2c67893c
jae 0x1802d052d
jmp 0x1802d04d8
mov eax, dword [0x18077a918]
or eax, dword [str._E9]
mov r9d, 0xf097094a
xor edx, edx
div r9d
mov edx, eax
and edx, 0x2ce1278f
or edx, 0x2ce6e74e
movabs rax, 0x4a43a76e1b11a80
mov r9, r8
add r9, rax
mov r10, r9
rol r10, 3
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xebd89222
je 0x1802d04d8
ret
fistp qword es:[rdi + 0x162ad0e0]
sub ebx, ebp
lahf
int3
Function at 0x1802d0540
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x18077a920]
or eax, dword [0x18077a924]
imul eax, eax, 0x49370373
imul eax, eax, 0x1f2ddc38
sub eax, 0x42885a0b
cmp eax, 0xc6460793
je 0x1802d060f
jmp 0x1802d056a
mov r8d, dword [0x18077a928]
and r8d, dword [0x18077a92c]
and r8d, 0x716171a1
add r8d, 0xf217ca3e
sub r8d, 0x422cd24e
mov rax, rdx
shr rax, 1
xor rax, rdx
cmp r8d, 0x85da196c
jb 0x1802d056a
jmp 0x1802d05a1
add rax, 0xffffffff95c6e6c1
mov r8, rax
rol r8, 5
xor r8, rax
mov eax, dword [0x18077a930]
or eax, dword [0x18077a934]
xor eax, 0xdef92b4b
and eax, 0x3577786e
xor eax, 0x2e208c28
cmp eax, 0xa8dc2866
jae 0x1802d061c
mov eax, dword [0x18077a938]
or eax, dword [0x18077a93c]
xor eax, 0x3d50a2f5
sub eax, 0x68067376
mov r9d, 0x11f39770
xor edx, edx
div r9d
mov edx, eax
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xc657b854
jae 0x1802d061c
ret
jp 0x1802d0637
movabs dword [0xff4ce984ae365898], eax
invalid
pop rax
js 0x1802d064c
sub ebx, dword [rbp - 0x1454969a]
lodsd eax, dword [rsi]
int3
cmp dword [rdi + rbp + 0x4c], eax
mov eax, eax
shr rax, 0xf
xor r8, rax
mov eax, dword [0x18077a940]
sub eax, dword [0x18077a944]
imul eax, eax, 0x3834d8cc
and eax, 0xccb83c3c
xor eax, 0xd755719
cmp eax, 0x9c5edc87
ja 0x1802d06b7
hlt
mov eax, dword [0x18077a948]
imul eax, dword [0x18077a94c]
sub eax, 0x48a9db3f
add eax, 0xb1f36d87
mov r9d, 0x48b2639b
xor edx, edx
div r9d
mov rdx, r8
xor rdx, 0xffffffffda9fa2d8
add rdx, 1
cmp eax, 0x675ee6d4
jae 0x1802d06b7
jmp 0x1802d06a0
mov rax, rdx
rol rax, 7
xor rax, rdx
and rax, 0xffff
add rcx, rax
mov rax, rcx
ret
mov al, 0x46
fisub word [rsi]
nop
ret

Function at 0x1802d0a90
Capabilities:
Encode data using xor

Disassembly:
movabs rax, 0xab1f91a26322594
imul rdx, rax
xor rdx, 0xffffffffbbef73e2
mov r8, rdx
rol r8, 1
xor r8, rdx
mov eax, dword [0x18077a9b0]
xor eax, dword [0x18077a9b4]
add eax, 0xda5b75e8
imul eax, eax, 0xea58221c
add eax, 0x9af73d6
cmp eax, 0x71f3d8ec
ja 0x1802d0b0c
jmp 0x1802d0ad3
mov edx, dword [0x18077a9b8]
xor edx, dword [0x18077a9bc]
add edx, 0x90520be4
or edx, 0xc25d5332
add edx, 0xdd0a2084
mov r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xc2034818
jae 0x1802d0ad3
jmp 0x1802d0b0b
ret
xchg esp, eax
xchg dword [rdx - 0x5a], esi
xchg ebp, eax
sbb eax, 0x33743bd
movabs eax, dword [0xccccccccccb7eb78]
int3
Function at 0x1802d0e10
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x18077aa00]
xor eax, dword [0x18077aa04]
or eax, 0xa7d9775c
add eax, 0xbf9b145a
mov r9d, 0x336d642f
xor edx, edx
div r9d
cmp eax, 0xec4ee7a6
ja 0x1802d0f49
mov eax, dword [0x18077aa08]
xor eax, dword [0x18077aa0c]
mov r9d, 0x75471f9b
xor edx, edx
div r9d
mov r9d, 0x8e1a7d1f
xor edx, edx
div r9d
add eax, 0x5d17260c
mov r9, r8
xor r9, 0xffffffff88348d8e
add r9, 0xffffffffec16b262
cmp eax, 0xa997622e
ja 0x1802d0f49
jmp 0x1802d0e84
mov eax, dword [0x18077aa10]
and eax, dword [0x18077aa14]
or eax, 0x99bb3eaf
mov r8d, 0x4f7a52c4
xor edx, edx
div r8d
and eax, 0xb5957a7d
cmp eax, 0x8c06907
je 0x1802d0f5a
jmp 0x1802d0eb2
mov eax, dword [0x18077aa18]
or eax, dword [0x18077aa1c]
sub eax, 0xe5e7400e
imul edx, eax, 0x9be9df2d
and edx, 0x2e705100
mov rax, r9
shr rax, 0x10
xor rax, r9
mov r8, rax
rol r8, 6
xor r8, rax
and r8, 0xffff
mov rax, rcx
add rax, r8
cmp edx, 0xdb03ce0e
ja 0x1802d0eb2
jmp 0x1802d0efa
mov ecx, dword [0x18077aa20]
sub ecx, dword [0x18077aa24]
and ecx, 0x696b241d
xor ecx, 0xdc973dda
or ecx, 0x3bd2a6b0
cmp ecx, 0x88b731fb
je 0x1802d0f6b
jmp 0x1802d0f22
mov ecx, dword [0x18077aa28]
xor ecx, dword [0x18077aa2c]
sub ecx, 0xcd922390
and ecx, 0x3054f32c
or ecx, 0x955624f7
cmp ecx, 0x3310af5b
jbe 0x1802d0f22
ret
cmp eax, 0xa52b1d9d
add byte [rbx], cl
scasd eax, dword [rdi]
push 0xffffffffe9a7a9b0
in eax, 0xfe
invalid
pop rcx
invalid
test dword [rdi + 0x25], ebx
sti
int1
fsubr qword [rax]
ror r9, cl
invalid

Function at 0x1802d10d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rdx
xor rax, 0xffffffffffffffff
rol rax, 1
xor rax, rdx
xor rax, 0xffffffffd495734b
imul rax, rax, 0x389ead3d
mov r8, rax
rol r8, 1
xor r8, rax
and r8, 0xffff
mov eax, dword [0x18077aa50]
sub eax, dword [0x18077aa54]
mov r9d, 0x5615f25
xor edx, edx
div r9d
imul eax, eax, 0xf7a48b35
mov r9d, 0x56799caa
xor edx, edx
div r9d
cmp eax, 0x4accd12b
jae 0x1802d1158
jmp 0x1802d112b
mov edx, dword [0x18077aa58]
and edx, dword [0x18077aa5c]
sub edx, 0x9b56a316
and edx, 0xf2423f6b
xor edx, 0xcfd61c6f
mov rax, rcx
add rax, r8
cmp edx, 0xd78d578a
jae 0x1802d112b
ret
and dword [rsi - 0x6b], edi
pop rdi
int 0x66
invalid

Function at 0x1802d1170
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0x9d7ad75
mov r9, r8
add r9, 1
mov eax, dword [0x18077aa60]
add eax, dword [0x18077aa64]
sub eax, 0xcce6360d
and eax, 0xf10b64af
mov r10d, 0x611603ad
xor edx, edx
div r10d
cmp eax, 0x3008df01
je 0x1802d11fe
jmp 0x1802d11ab
mov eax, dword [0x18077aa68]
and eax, dword [0x18077aa6c]
or eax, 0x314a6bde
xor eax, 0xeaf1b5
imul r10d, eax, 0x3bf88bbb
mov rax, r9
shr rax, 1
mov rdx, 0xfffffffffffffffe
sub rdx, r8
cmp r10d, 0x6e54ae8b
ja 0x1802d11ab
jmp 0x1802d11e3
xor rax, rdx
mov rdx, rax
rol rdx, 4
xor rdx, rax
and rdx, 0xffff
add rcx, rdx
mov rax, rcx
ret
outsb dx, byte fs:[rsi]
div dword [rax - 0x4a]
xchg ecx, eax
mov dword [rdx], ebp
retfq
Function at 0x1802d1510
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x18077aac0]
or eax, dword [0x18077aac4]
and eax, 0x89c3bb7c
and eax, 0xd15722ea
imul eax, eax, 0x3d646bcf
cmp eax, 0xacbd1c85
ja 0x1802d1624
jmp 0x1802d1539
mov eax, dword [0x18077aac8]
xor eax, dword [0x18077aacc]
sub eax, 0x2e45435b
or eax, 0x7c8f7719
imul eax, eax, 0x4e73da93
mov r8, rdx
xor r8, 0x5a209ac5
cmp eax, 0x5879586b
je 0x1802d1539
jmp 0x1802d1568
mov eax, dword [0x18077aad0]
xor edx, edx
div dword [0x18077aad4]
and eax, 0x81e9b862
or eax, 0x24a9de5b
mov r9d, 0x1772e0ed
xor edx, edx
div r9d
cmp eax, 0xf3c91ac3
jae 0x1802d1635
jmp 0x1802d1598
mov edx, dword [0x18077aad8]
or edx, dword [0x18077aadc]
or edx, 0x9aef7aae
and edx, 0xef913c21
sub edx, 0xa816c13f
mov r9, r8
rol r9, 4
xor r9, r8
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xc0f34f48
jae 0x1802d1598
jmp 0x1802d15d7
mov ecx, dword [0x18077aae0]
xor ecx, dword [0x18077aae4]
sub ecx, 0x15b149e2
add ecx, 0x22056530
xor ecx, 0x630eaaad
cmp ecx, 0x2f2c4e40
je 0x1802d1646
mov ecx, dword [0x18077aae8]
or ecx, dword [0x18077aaec]
add ecx, 0xb7904d99
imul ecx, ecx, 0x240758cd
imul ecx, ecx, 0xf48e0684
cmp ecx, 0x7bac8ae4
je 0x1802d1646
ret
mov esp, 0x2543c7db
rol dword [rdi + rbp + 0x38], 1
mov byte [rcx], dl
adc eax, 0xffff02e9
jmp [rsp + rdi + 0x3e88aa0]
lodsb al, byte [rsi]
cmp al, 0xa0
mov ch, al
add esp, dword [rbx - 0x6a9ba82a]
pop rdi
jmp 0x1802d1596
loope 0x1802d1647
call qword [rax - 0x6e556160]
mov al, 0xeb
lodsd eax, dword [rsi]
nop
movabs al, byte [0x8949adebb091aa9e]
mov r8, rdx
mov eax, dword [0x18077aaf0]
imul eax, dword [0x18077aaf4]