joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180049f90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x20], r8b
je 0x180049fc4
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1f
jb 0x180049fb1
mov byte [rdx + 0x20], r8b
lea rax, [rdx + 0x1f]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x180049fee
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040d10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003c220
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004a010
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x18004a043
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x18004a030
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a06d
mov r8d, 0xa
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x13], 0
je 0x18004a093
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x12
jb 0x18004a080
mov byte [rdi + 0x13], 0
lea r8, [rdi + 0x12]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a0c1
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a0d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x38], sil
je 0x18004a103
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x37
jb 0x18004a0f0
mov byte [rdx + 0x38], sil
lea rax, [rdx + 0x37]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a12d
mov r8d, gethostname
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x40], 0
je 0x18004a153
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x3f
jb 0x18004a140
mov byte [rdi + 0x40], 0
lea r8, [rdi + 0x3f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a181
mov r8d, 0x3f
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a1e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e2a0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xe], dl
je 0x18004a232
mov eax, edx
nop word [rax + rax]
lea ecx, [rax + 0x33]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xd
jb 0x18004a220
mov byte [rbx + 0xe], dl
lea r8, [rbx + 0xd]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004a25f
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rbx
mov rcx, r9
call fcn.180040d10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004a270
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x18004a2a3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x18004a290
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a2cd
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a2f3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a2e0
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a321
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a330
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e2a0
nop
lea r10, [rdi + 0x20]
mov qword [rsp + 0x20], r10
xor edx, edx
cmp byte [rbx + 0x10], dl
je 0x18004a382
mov eax, edx
nop word [rax + rax]
lea ecx, [rax + 0x33]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xf
jb 0x18004a370
mov byte [rbx + 0x10], dl
lea r9, [rbx + 0xf]
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp rbx, r9
je 0x18004a3af
mov r8d, reloc.WS2_32.dll_ntohs
mov rdx, rbx
mov rcx, r10
call fcn.180040d10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004a3c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004a3f3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004a3e0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a41d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x18004a443
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x18004a430
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a471
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a480
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004a4b3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004a4a0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a4dd
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x17], 0
je 0x18004a503
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x16
jb 0x18004a4f0
mov byte [rdi + 0x17], 0
lea r8, [rdi + 0x16]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a531
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a540
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x17], sil
je 0x18004a573
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x16
jb 0x18004a560
mov byte [rdx + 0x17], sil
lea rax, [rdx + 0x16]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a59d
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x18004a5c3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x18004a5b0
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a5f1
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a600
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x13], sil
je 0x18004a633
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x12
jb 0x18004a620
mov byte [rdx + 0x13], sil
lea rax, [rdx + 0x12]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a65d
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a683
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a670
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a6b1
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a6c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x12], sil
je 0x18004a6f3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x11
jb 0x18004a6e0
mov byte [rdx + 0x12], sil
lea rax, [rdx + 0x11]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a71d
mov r8d, reloc.WS2_32.dll_recvfrom
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a743
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a730
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a771
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a780
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1a], sil
je 0x18004a7b3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x19
jb 0x18004a7a0
mov byte [rdx + 0x1a], sil
lea rax, [rdx + 0x19]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a7dd
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x26], 0
je 0x18004a803
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x25
jb 0x18004a7f0
mov byte [rdi + 0x26], 0
lea r8, [rdi + 0x25]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a831
mov r8d, Ordinal_41
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a840
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x18004a873
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x18004a860
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a89d
mov r8d, 7
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x18004a8c3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x18004a8b0
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a8f1
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a900
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x14], sil
je 0x18004a933
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x13
jb 0x18004a920
mov byte [rdx + 0x14], sil
lea rax, [rdx + 0x13]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a95d
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a983
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a970
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a9b1
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a9c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x19], r8b
je 0x18004a9f4
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x18
jb 0x18004a9e1
mov byte [rdx + 0x19], r8b
lea rax, [rdx + 0x18]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004aa1e
mov r8d, Ordinal_26
mov rcx, rbx
call fcn.180040d10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003b010
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004aa40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x18004aa73
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x18004aa60
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004aa9d
mov r8d, 5
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 8], 0
je 0x18004aac3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 7
jb 0x18004aab0
mov byte [rdi + 8], 0
lea r8, [rdi + 7]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004aaf1
mov r8d, 7
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004ab00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x17], sil
je 0x18004ab33
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x16
jb 0x18004ab20
mov byte [rdx + 0x17], sil
lea rax, [rdx + 0x16]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004ab5d
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1c], 0
je 0x18004ab83
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1b
jb 0x18004ab70
mov byte [rdi + 0x1c], 0
lea r8, [rdi + 0x1b]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004abb1
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004abc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e3e0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0x11], dl
je 0x18004ac12
mov eax, edx
nop word [rax + rax]
lea ecx, [rax + 0x33]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0x10
jb 0x18004ac00
mov byte [rbx + 0x11], dl
lea r8, [rbx + 0x10]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004ac3f
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rbx
mov rcx, r9
call fcn.180040d10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004ac50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 4], sil
je 0x18004ac83
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 3
jb 0x18004ac70
mov byte [rdx + 4], sil
lea rax, [rdx + 3]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004acad
mov r8d, 3
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 6], 0
je 0x18004acd3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 5
jb 0x18004acc0
mov byte [rdi + 6], 0
lea r8, [rdi + 5]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ad01
mov r8d, 5
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004ad10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004ad43
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004ad30
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004ad6d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x18004ad93
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x18004ad80
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004adc1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004add0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xf], sil
je 0x18004ae03
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xe
jb 0x18004adf0
mov byte [rdx + 0xf], sil
lea rax, [rdx + 0xe]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004ae2d
mov r8d, recv
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x13], 0
je 0x18004ae53
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x12
jb 0x18004ae40
mov byte [rdi + 0x13], 0
lea r8, [rdi + 0x12]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ae81
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004ae90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x18004aec3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x18004aeb0
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004aeed
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1d], 0
je 0x18004af13
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1c
jb 0x18004af00
mov byte [rdi + 0x1d], 0
lea r8, [rdi + 0x1c]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004af41
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004af50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004af83
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004af70
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004afad
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004afd3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004afc0
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b001
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b010
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x18004b043
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x18004b030
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b06d
mov r8d, 5
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x18004b093
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x18004b080
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b0c1
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret