joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004a040
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x18004a073
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x18004a060
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a09d
mov r8d, 7
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x18004a0c3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x18004a0b0
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a0f1
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a100
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x14], sil
je 0x18004a133
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x13
jb 0x18004a120
mov byte [rdx + 0x14], sil
lea rax, [rdx + 0x13]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a15d
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a183
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a170
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a1b1
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a1c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x19], r8b
je 0x18004a1f4
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x18
jb 0x18004a1e1
mov byte [rdx + 0x19], r8b
lea rax, [rdx + 0x18]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004a21e
mov r8d, Ordinal_26
mov rcx, rbx
call fcn.180040510
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003a7a0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004a240
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x18004a273
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x18004a260
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a29d
mov r8d, 5
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 8], 0
je 0x18004a2c3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 7
jb 0x18004a2b0
mov byte [rdi + 8], 0
lea r8, [rdi + 7]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a2f1
mov r8d, 7
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a300
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x17], sil
je 0x18004a333
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x16
jb 0x18004a320
mov byte [rdx + 0x17], sil
lea rax, [rdx + 0x16]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a35d
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1c], 0
je 0x18004a383
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1b
jb 0x18004a370
mov byte [rdi + 0x1c], 0
lea r8, [rdi + 0x1b]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a3b1
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a3c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e130
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0x11], dl
je 0x18004a412
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x2b]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0x10
jb 0x18004a400
mov byte [rbx + 0x11], dl
lea r8, [rbx + 0x10]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004a43f
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rbx
mov rcx, r9
call fcn.180040510
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004a450
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 4], sil
je 0x18004a483
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 3
jb 0x18004a470
mov byte [rdx + 4], sil
lea rax, [rdx + 3]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a4ad
mov r8d, 3
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 6], 0
je 0x18004a4d3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 5
jb 0x18004a4c0
mov byte [rdi + 6], 0
lea r8, [rdi + 5]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a501
mov r8d, 5
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a510
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004a543
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004a530
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a56d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x18004a593
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x18004a580
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a5c1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a5d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xf], sil
je 0x18004a603
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xe
jb 0x18004a5f0
mov byte [rdx + 0xf], sil
lea rax, [rdx + 0xe]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a62d
mov r8d, recv
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x13], 0
je 0x18004a653
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x12
jb 0x18004a640
mov byte [rdi + 0x13], 0
lea r8, [rdi + 0x12]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a681
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a690
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x18004a6c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x18004a6b0
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a6ed
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1d], 0
je 0x18004a713
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1c
jb 0x18004a700
mov byte [rdi + 0x1d], 0
lea r8, [rdi + 0x1c]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a741
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a750
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004a783
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004a770
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a7ad
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a7d3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a7c0
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a801
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a810
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x18004a843
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x18004a830
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a86d
mov r8d, 5
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x18004a893
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x18004a880
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a8c1
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a8d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x14], sil
je 0x18004a903
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x13
jb 0x18004a8f0
mov byte [rdx + 0x14], sil
lea rax, [rdx + 0x13]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a92d
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x21], 0
je 0x18004a953
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x20
jb 0x18004a940
mov byte [rdi + 0x21], 0
lea r8, [rdi + 0x20]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a981
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001dff0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 6], dl
je 0x18004a9e2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x2b]
xor byte [rax + rbx], cl
inc rax
cmp rax, 5
jb 0x18004a9d0
mov byte [rbx + 6], dl
lea r8, [rbx + 5]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004aa0f
mov r8d, 5
mov rdx, rbx
mov rcx, r9
call fcn.180040510
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004aa20
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xe], sil
je 0x18004aa53
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x18004aa40
mov byte [rdx + 0xe], sil
lea rax, [rdx + 0xd]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004aa7d
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x18004aaa3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x18004aa90
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004aad1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004ab30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x18], r8b
je 0x18004ab64
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x17
jb 0x18004ab51
mov byte [rdx + 0x18], r8b
lea rax, [rdx + 0x17]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004ab8e
mov r8d, reloc.WS2_32.dll_socket
mov rcx, rbx
call fcn.180040510
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051260
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004abb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 6], r8b
je 0x18004abe4
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 5
jb 0x18004abd1
mov byte [rdx + 6], r8b
lea rax, [rdx + 5]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004ac0e
mov r8d, 5
mov rcx, rbx
call fcn.180040510
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001dff0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004ac30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1f], r8b
je 0x18004ac64
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1e
jb 0x18004ac51
mov byte [rdx + 0x1f], r8b
lea rax, [rdx + 0x1e]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004ac8e
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov rcx, rbx
call fcn.180040510
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003a7a0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004acb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x15], sil
je 0x18004ace3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x14
jb 0x18004acd0
mov byte [rdx + 0x15], sil
lea rax, [rdx + 0x14]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004ad0d
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x18004ad33
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x18004ad20
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ad61
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004ad70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x16], sil
je 0x18004ada3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x18004ad90
mov byte [rdx + 0x16], sil
lea rax, [rdx + 0x15]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004adcd
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x21], 0
je 0x18004adf3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x20
jb 0x18004ade0
mov byte [rdi + 0x21], 0
lea r8, [rdi + 0x20]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ae21
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004ae30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x18004ae63
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x18004ae50
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004ae8d
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x13], 0
je 0x18004aeb3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x12
jb 0x18004aea0
mov byte [rdi + 0x13], 0
lea r8, [rdi + 0x12]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004aee1
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004aef0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1d], r8b
je 0x18004af24
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1c
jb 0x18004af11
mov byte [rdx + 0x1d], r8b
lea rax, [rdx + 0x1c]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004af4e
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040510
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180050f70
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004af70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x13], sil
je 0x18004afa3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x12
jb 0x18004af90
mov byte [rdx + 0x13], sil
lea rax, [rdx + 0x12]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004afcd
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x18004aff3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x18004afe0
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b021
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret