joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004aa60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x18004aa93
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x18004aa80
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004aabd
mov r8d, 7
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x18004aae3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x18004aad0
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ab11
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004ab20
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x14], sil
je 0x18004ab53
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x13
jb 0x18004ab40
mov byte [rdx + 0x14], sil
lea rax, [rdx + 0x13]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004ab7d
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004aba3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004ab90
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004abd1
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004abe0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x19], r8b
je 0x18004ac14
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x18
jb 0x18004ac01
mov byte [rdx + 0x19], r8b
lea rax, [rdx + 0x18]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004ac3e
mov r8d, Ordinal_26
mov rcx, rbx
call fcn.180040f40
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003b2b0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004ac60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x18004ac93
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x18004ac80
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004acbd
mov r8d, 5
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 8], 0
je 0x18004ace3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 7
jb 0x18004acd0
mov byte [rdi + 8], 0
lea r8, [rdi + 7]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ad11
mov r8d, 7
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004ad20
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x17], sil
je 0x18004ad53
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x16
jb 0x18004ad40
mov byte [rdx + 0x17], sil
lea rax, [rdx + 0x16]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004ad7d
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1c], 0
je 0x18004ada3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1b
jb 0x18004ad90
mov byte [rdi + 0x1c], 0
lea r8, [rdi + 0x1b]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004add1
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004ade0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e5d0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0x11], dl
je 0x18004ae32
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x46]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0x10
jb 0x18004ae20
mov byte [rbx + 0x11], dl
lea r8, [rbx + 0x10]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004ae5f
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rbx
mov rcx, r9
call fcn.180040f40
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004ae70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 4], sil
je 0x18004aea3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 3
jb 0x18004ae90
mov byte [rdx + 4], sil
lea rax, [rdx + 3]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004aecd
mov r8d, 3
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 6], 0
je 0x18004aef3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 5
jb 0x18004aee0
mov byte [rdi + 6], 0
lea r8, [rdi + 5]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004af21
mov r8d, 5
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004af30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004af63
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004af50
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004af8d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x18004afb3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x18004afa0
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004afe1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004aff0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xf], sil
je 0x18004b023
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xe
jb 0x18004b010
mov byte [rdx + 0xf], sil
lea rax, [rdx + 0xe]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b04d
mov r8d, recv
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x13], 0
je 0x18004b073
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x12
jb 0x18004b060
mov byte [rdi + 0x13], 0
lea r8, [rdi + 0x12]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b0a1
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b0b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x18004b0e3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x18004b0d0
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b10d
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1d], 0
je 0x18004b133
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1c
jb 0x18004b120
mov byte [rdi + 0x1d], 0
lea r8, [rdi + 0x1c]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b161
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004b170
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004b1a3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004b190
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b1cd
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004b1f3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004b1e0
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b221
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b230
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x18004b263
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x18004b250
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b28d
mov r8d, 5
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x18004b2b3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x18004b2a0
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b2e1
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004b2f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x14], sil
je 0x18004b323
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x13
jb 0x18004b310
mov byte [rdx + 0x14], sil
lea rax, [rdx + 0x13]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b34d
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x21], 0
je 0x18004b373
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x20
jb 0x18004b360
mov byte [rdi + 0x21], 0
lea r8, [rdi + 0x20]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b3a1
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b3b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e490
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 6], dl
je 0x18004b402
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x46]
xor byte [rax + rbx], cl
inc rax
cmp rax, 5
jb 0x18004b3f0
mov byte [rbx + 6], dl
lea r8, [rbx + 5]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004b42f
mov r8d, 5
mov rdx, rbx
mov rcx, r9
call fcn.180040f40
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b440
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xe], sil
je 0x18004b473
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x18004b460
mov byte [rdx + 0xe], sil
lea rax, [rdx + 0xd]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b49d
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x18004b4c3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x18004b4b0
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b4f1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004b550
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x18], r8b
je 0x18004b584
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x17
jb 0x18004b571
mov byte [rdx + 0x18], r8b
lea rax, [rdx + 0x17]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b5ae
mov r8d, reloc.WS2_32.dll_socket
mov rcx, rbx
call fcn.180040f40
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051cf0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b5d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 6], r8b
je 0x18004b604
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 5
jb 0x18004b5f1
mov byte [rdx + 6], r8b
lea rax, [rdx + 5]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b62e
mov r8d, 5
mov rcx, rbx
call fcn.180040f40
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001e490
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1f], r8b
je 0x18004b684
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1e
jb 0x18004b671
mov byte [rdx + 0x1f], r8b
lea rax, [rdx + 0x1e]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b6ae
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov rcx, rbx
call fcn.180040f40
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003b2b0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004b6d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x15], sil
je 0x18004b703
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x14
jb 0x18004b6f0
mov byte [rdx + 0x15], sil
lea rax, [rdx + 0x14]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b72d
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x18004b753
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x18004b740
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b781
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b790
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x16], sil
je 0x18004b7c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x18004b7b0
mov byte [rdx + 0x16], sil
lea rax, [rdx + 0x15]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b7ed
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x21], 0
je 0x18004b813
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x20
jb 0x18004b800
mov byte [rdi + 0x21], 0
lea r8, [rdi + 0x20]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b841
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004b850
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x18004b883
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x18004b870
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b8ad
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x13], 0
je 0x18004b8d3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x12
jb 0x18004b8c0
mov byte [rdi + 0x13], 0
lea r8, [rdi + 0x12]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b901
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b910
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1d], r8b
je 0x18004b944
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1c
jb 0x18004b931
mov byte [rdx + 0x1d], r8b
lea rax, [rdx + 0x1c]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b96e
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040f40
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051a00
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b990
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x13], sil
je 0x18004b9c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x12
jb 0x18004b9b0
mov byte [rdx + 0x13], sil
lea rax, [rdx + 0x12]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b9ed
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x18004ba13
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x18004ba00
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ba41
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret