joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800333c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
cmp edx, 1
jne 0x1800334ee
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rax, [rbp - 0x30]
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x58], 0x87818284
mov dword [rbp - 0x54], 0x1009581
xor ebx, ebx
mov ecx, ebx
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rbp + rcx - 0x58], al
inc rcx
cmp rcx, 6
jb 0x180033400
mov byte [rbp - 0x51], bl
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov r8d, 6
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x30]
call fcn.180038d80
nop
mov dword [rbp - 0x60], 0xffe2fc
mov byte [rbp - 0x5c], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x35]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 3
jb 0x180033450
mov byte [rbp - 0x5c], 0
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov r8d, 3
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x50]
call fcn.180038d80
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.180018160
test al, al
je 0x1800334ee
lea rcx, [rbp - 0x50]
call fcn.18000ae30
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1800334e0
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800334db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800334db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180109380
call fcn.180015f90
test al, al
je 0x180033504
call fcn.180032f10
mov eax, 1
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret
xor eax, eax
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret

Function at 0x1800336b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x23], 0
je 0x1800336d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x22
jb 0x1800336c0
mov byte [rcx + 0x23], 0
ret

Function at 0x1800336e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1f], 0
je 0x180033703
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1e
jb 0x1800336f0
mov byte [rcx + 0x1f], 0
ret

Function at 0x180033710
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x1f], r8b
je 0x180033743
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x1e
jb 0x180033730
mov byte [rdx + 0x1f], r8b
lea rcx, [rdx + 0x1e]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003376c
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x180033780
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x1f], r8b
je 0x1800337b3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1e
jb 0x1800337a0
mov byte [rdx + 0x1f], r8b
lea rcx, [rdx + 0x1e]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800337dc
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180033ae0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x180033b17
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x180033b38
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180033b3a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180033b93
test ecx, ecx
jle 0x180033b73
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180033b93
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180033b93
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180033bc0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180033be2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x180033bf8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180033c14
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180033c16
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x180033c50
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180033cf7
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x180033c8b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x180033cd1
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x180033d10
cmp rbx, rax
ja 0x180033ca0
mov r8, rdi
test rdi, rdi
je 0x180033cf7
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x180033cfa
Function at 0x180034120
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1801471e0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18003414d
xor eax, eax
jmp 0x1800342a2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x180034178
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x180034178
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1800342a2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180034295
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1800341bb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1800341e6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18003429a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180034255
sub eax, 1
je 0x180034255
cmp eax, 2
jne 0x180034295
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18003429a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180034283
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x180034295
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x18003429a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180108c20
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x180034480
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x1a], r8b
je 0x1800344b3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x19
jb 0x1800344a0
mov byte [rdx + 0x1a], r8b
lea rcx, [rdx + 0x19]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800344dc
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1800344f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x2b], r8b
je 0x180034523
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x2a
jb 0x180034510
mov byte [rdx + 0x2b], r8b
lea rcx, [rdx + 0x2a]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003454c
mov r8d, Ordinal_46
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180034760
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x21], 0
je 0x180034783
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x20
jb 0x180034770
mov byte [rcx + 0x21], 0
ret

Function at 0x180035920
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 5], r8b
je 0x180035953
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 4
jb 0x180035940
mov byte [rdx + 5], r8b
lea rcx, [rdx + 4]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003597c
mov r8d, 4
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180035990
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x12], r8b
je 0x1800359c3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x11
jb 0x1800359b0
mov byte [rdx + 0x12], r8b
lea rcx, [rdx + 0x11]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800359ec
mov r8d, reloc.WS2_32.dll_recvfrom
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180035b80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x11], r8b
je 0x180035bb3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x10
jb 0x180035ba0
mov byte [rdx + 0x11], r8b
lea rcx, [rdx + 0x10]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180035bdc
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x180035bf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xf], r8b
je 0x180035c23
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xe
jb 0x180035c10
mov byte [rdx + 0xf], r8b
lea rcx, [rdx + 0xe]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180035c4c
mov r8d, recv
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180035c60
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xb], r8b
je 0x180035c93
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xa
jb 0x180035c80
mov byte [rdx + 0xb], r8b
lea rcx, [rdx + 0xa]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180035cbc
mov r8d, 0xa
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180035cd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 9], r8b
je 0x180035d03
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 8
jb 0x180035cf0
mov byte [rdx + 9], r8b
lea rcx, [rdx + 8]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180035d2c
mov r8d, 8
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180035d40
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x10], r8b
je 0x180035d73
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xf
jb 0x180035d60
mov byte [rdx + 0x10], r8b
lea rcx, [rdx + 0xf]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180035d9c
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180035db0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xd], r8b
je 0x180035de3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xc
jb 0x180035dd0
mov byte [rdx + 0xd], r8b
lea rcx, [rdx + 0xc]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180035e0c
mov r8d, recv
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x180035e20
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xe], r8b
je 0x180035e53
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xd
jb 0x180035e40
mov byte [rdx + 0xe], r8b
lea rcx, [rdx + 0xd]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180035e7c
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180035e90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x180035eb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x180035ea0
mov byte [rcx + 4], 0
ret

Function at 0x180035ec0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 4], r8b
je 0x180035ef3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 3
jb 0x180035ee0
mov byte [rdx + 4], r8b
lea rcx, [rdx + 3]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180035f1c
mov r8d, 3
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180035f30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x14], r8b
je 0x180035f63
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x13
jb 0x180035f50
mov byte [rdx + 0x14], r8b
lea rcx, [rdx + 0x13]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180035f8c
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180035fa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xa], r8b
je 0x180035fd3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 9
jb 0x180035fc0
mov byte [rdx + 0xa], r8b
lea rcx, [rdx + 9]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180035ffc
mov r8d, 9
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x180036010
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xc], r8b
je 0x180036043
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xb
jb 0x180036030
mov byte [rdx + 0xc], r8b
lea rcx, [rdx + 0xb]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003606c
mov r8d, recv
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180036080
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x13], r8b
je 0x1800360b3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x12
jb 0x1800360a0
mov byte [rdx + 0x13], r8b
lea rcx, [rdx + 0x12]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800360dc
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180036270
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 3], r8b
je 0x1800362a3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 2
jb 0x180036290
mov byte [rdx + 3], r8b
lea rcx, [rdx + 2]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800362cc
mov r8d, 2
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1800362e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 6], r8b
je 0x180036313
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 5
jb 0x180036300
mov byte [rdx + 6], r8b
lea rcx, [rdx + 5]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003633c
mov r8d, 5
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180036350
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x15], r8b
je 0x180036383
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x14
jb 0x180036370
mov byte [rdx + 0x15], r8b
lea rcx, [rdx + 0x14]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800363ac
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1800369e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x180036a03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x1800369f0
mov byte [rcx + 8], 0
ret

Function at 0x180036a10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 8], r8b
je 0x180036a43
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 7
jb 0x180036a30
mov byte [rdx + 8], r8b
lea rcx, [rdx + 7]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180036a6c
mov r8d, 7
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180036a90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 7], r8b
je 0x180036ac3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 6
jb 0x180036ab0
mov byte [rdx + 7], r8b
lea rcx, [rdx + 6]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180036aec
mov r8d, 6
mov rcx, rbx
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180037f60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1801471e0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180038033
cmp byte [rcx + 0x71], 0
je 0x180038033
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x18003802f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180037ff4
sub eax, 1
je 0x180037ff8
cmp eax, 2
jne 0x18003802f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180108c20
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180038026
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18003802f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180037fdc
xor al, al
jmp 0x180037fdc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180108c20
add rsp, 0x60
pop rbx
ret