joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004b0d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x14], sil
je 0x18004b103
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x13
jb 0x18004b0f0
mov byte [rdx + 0x14], sil
lea rax, [rdx + 0x13]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b12d
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x21], 0
je 0x18004b153
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x20
jb 0x18004b140
mov byte [rdi + 0x21], 0
lea r8, [rdi + 0x20]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b181
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e2a0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 6], dl
je 0x18004b1e2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax + 0x33]
xor byte [rax + rbx], cl
inc rax
cmp rax, 5
jb 0x18004b1d0
mov byte [rbx + 6], dl
lea r8, [rbx + 5]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004b20f
mov r8d, 5
mov rdx, rbx
mov rcx, r9
call fcn.180040d10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b220
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xe], sil
je 0x18004b253
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x18004b240
mov byte [rdx + 0xe], sil
lea rax, [rdx + 0xd]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b27d
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x18004b2a3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x18004b290
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b2d1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004b330
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x18], r8b
je 0x18004b364
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x17
jb 0x18004b351
mov byte [rdx + 0x18], r8b
lea rax, [rdx + 0x17]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b38e
mov r8d, reloc.WS2_32.dll_socket
mov rcx, rbx
call fcn.180040d10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051a60
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b3b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 6], r8b
je 0x18004b3e4
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 5
jb 0x18004b3d1
mov byte [rdx + 6], r8b
lea rax, [rdx + 5]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b40e
mov r8d, 5
mov rcx, rbx
call fcn.180040d10
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001e2a0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b430
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1f], r8b
je 0x18004b464
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1e
jb 0x18004b451
mov byte [rdx + 0x1f], r8b
lea rax, [rdx + 0x1e]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b48e
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov rcx, rbx
call fcn.180040d10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003b010
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004b4b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x15], sil
je 0x18004b4e3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x14
jb 0x18004b4d0
mov byte [rdx + 0x15], sil
lea rax, [rdx + 0x14]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b50d
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x18004b533
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x18004b520
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b561
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b570
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x16], sil
je 0x18004b5a3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x18004b590
mov byte [rdx + 0x16], sil
lea rax, [rdx + 0x15]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b5cd
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x21], 0
je 0x18004b5f3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x20
jb 0x18004b5e0
mov byte [rdi + 0x21], 0
lea r8, [rdi + 0x20]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b621
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004b630
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x18004b663
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x18004b650
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b68d
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x13], 0
je 0x18004b6b3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x12
jb 0x18004b6a0
mov byte [rdi + 0x13], 0
lea r8, [rdi + 0x12]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b6e1
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b6f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1d], r8b
je 0x18004b724
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1c
jb 0x18004b711
mov byte [rdx + 0x1d], r8b
lea rax, [rdx + 0x1c]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b74e
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040d10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051770
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b770
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x13], sil
je 0x18004b7a3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x12
jb 0x18004b790
mov byte [rdx + 0x13], sil
lea rax, [rdx + 0x12]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b7cd
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x18004b7f3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x18004b7e0
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b821
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004b830
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e2a0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 7], dl
je 0x18004b882
mov eax, edx
nop word [rax + rax]
lea ecx, [rax + 0x33]
xor byte [rax + rbx], cl
inc rax
cmp rax, 6
jb 0x18004b870
mov byte [rbx + 7], dl
lea r8, [rbx + 6]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004b8af
mov r8d, 6
mov rdx, rbx
mov rcx, r9
call fcn.180040d10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b900
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov rdx, rcx
mov rcx, rax
call fcn.180051700
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x30], r9
xor edx, edx
cmp byte [rbx + 0x2a], dl
je 0x18004b952
mov eax, edx
nop word [rax + rax]
lea ecx, [rax + 0x33]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0x29
jb 0x18004b940
mov byte [rbx + 0x2a], dl
lea r8, [rbx + 0x29]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004b97f
mov r8d, reloc.WLDAP32.dll_Ordinal_41
mov rdx, rbx
mov rcx, r9
call fcn.180040d10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b990
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x16], sil
je 0x18004b9c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x18004b9b0
mov byte [rdx + 0x16], sil
lea rax, [rdx + 0x15]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b9ed
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1d], 0
je 0x18004ba13
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1c
jb 0x18004ba00
mov byte [rdi + 0x1d], 0
lea r8, [rdi + 0x1c]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ba41
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004ba50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 5], r8b
je 0x18004ba84
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 4
jb 0x18004ba71
mov byte [rdx + 5], r8b
lea rax, [rdx + 4]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004baae
mov r8d, 4
mov rcx, rbx
call fcn.180040d10
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001e2a0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004bad0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1c], sil
je 0x18004bb03
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1b
jb 0x18004baf0
mov byte [rdx + 0x1c], sil
lea rax, [rdx + 0x1b]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004bb2d
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x17], 0
je 0x18004bb53
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x16
jb 0x18004bb40
mov byte [rdi + 0x17], 0
lea r8, [rdi + 0x16]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004bb81
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004bb90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e2a0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xc], dl
je 0x18004bbe2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax + 0x33]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xb
jb 0x18004bbd0
mov byte [rbx + 0xc], dl
lea r8, [rbx + 0xb]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004bc0f
mov r8d, recv
mov rdx, rbx
mov rcx, r9
call fcn.180040d10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004bc20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e2a0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xb], dl
je 0x18004bc72
mov eax, edx
nop word [rax + rax]
lea ecx, [rax + 0x33]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xa
jb 0x18004bc60
mov byte [rbx + 0xb], dl
lea r8, [rbx + 0xa]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004bc9f
mov r8d, 0xa
mov rdx, rbx
mov rcx, r9
call fcn.180040d10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004bcb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 7], sil
je 0x18004bce3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 6
jb 0x18004bcd0
mov byte [rdx + 7], sil
lea rax, [rdx + 6]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004bd0d
mov r8d, 6
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0xe], 0
je 0x18004bd33
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x18004bd20
mov byte [rdi + 0xe], 0
lea r8, [rdi + 0xd]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004bd61
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004bd70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 0xc], r8b
je 0x18004bda4
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xb
jb 0x18004bd91
mov byte [rdx + 0xc], r8b
lea rax, [rdx + 0xb]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004bdce
mov r8d, recv
mov rcx, rbx
call fcn.180040d10
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001e3e0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004bdf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x18004be23
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x18004be10
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004be4d
mov r8d, 0xa
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0xc], 0
je 0x18004be73
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xb
jb 0x18004be60
mov byte [rdi + 0xc], 0
lea r8, [rdi + 0xb]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004bea1
mov r8d, recv
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004beb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e2a0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xf], dl
je 0x18004bf02
mov eax, edx
nop word [rax + rax]
lea ecx, [rax + 0x33]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xe
jb 0x18004bef0
mov byte [rbx + 0xf], dl
lea r8, [rbx + 0xe]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004bf2f
mov r8d, recv
mov rdx, rbx
mov rcx, r9
call fcn.180040d10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004bf40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xd], sil
je 0x18004bf73
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x18004bf60
mov byte [rdx + 0xd], sil
lea rax, [rdx + 0xc]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004bf9d
mov r8d, recv
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x18004bfc3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x18004bfb0
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004bff1
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004c000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x20], r8b
je 0x18004c034
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1f
jb 0x18004c021
mov byte [rdx + 0x20], r8b
lea rax, [rdx + 0x1f]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004c05e
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040d10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051770
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004c080
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x18004c0b3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x18004c0a0
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004c0dd
mov r8d, 0xa
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x18004c103
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x18004c0f0
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004c131
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004c140
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x18004c173
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x18004c160
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004c19d
mov r8d, 5
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 4], 0
je 0x18004c1c3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 3
jb 0x18004c1b0
mov byte [rdi + 4], 0
lea r8, [rdi + 3]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004c1f1
mov r8d, 3
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret