joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004ac90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x18004acc3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x18004acb0
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004aced
mov r8d, 5
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x18004ad13
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x18004ad00
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ad41
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004ad50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x14], sil
je 0x18004ad83
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x13
jb 0x18004ad70
mov byte [rdx + 0x14], sil
lea rax, [rdx + 0x13]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004adad
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x21], 0
je 0x18004add3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x20
jb 0x18004adc0
mov byte [rdi + 0x21], 0
lea r8, [rdi + 0x20]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ae01
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004ae10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e170
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 6], dl
je 0x18004ae62
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 3]
xor byte [rax + rbx], cl
inc rax
cmp rax, 5
jb 0x18004ae50
mov byte [rbx + 6], dl
lea r8, [rbx + 5]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004ae8f
mov r8d, 5
mov rdx, rbx
mov rcx, r9
call fcn.180040990
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004aea0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xe], sil
je 0x18004aed3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x18004aec0
mov byte [rdx + 0xe], sil
lea rax, [rdx + 0xd]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004aefd
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x18004af23
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x18004af10
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004af51
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004afb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x18], r8b
je 0x18004afe4
mov eax, r8d
lea ecx, [rax - 3]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x17
jb 0x18004afd1
mov byte [rdx + 0x18], r8b
lea rax, [rdx + 0x17]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b00e
mov r8d, reloc.WS2_32.dll_socket
mov rcx, rbx
call fcn.180040990
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.1800516e0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b030
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 6], r8b
je 0x18004b064
mov eax, r8d
lea ecx, [rax - 3]
xor byte [rax + rdx], cl
inc rax
cmp rax, 5
jb 0x18004b051
mov byte [rdx + 6], r8b
lea rax, [rdx + 5]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b08e
mov r8d, 5
mov rcx, rbx
call fcn.180040990
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001e170
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004b0b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1f], r8b
je 0x18004b0e4
mov eax, r8d
lea ecx, [rax - 3]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1e
jb 0x18004b0d1
mov byte [rdx + 0x1f], r8b
lea rax, [rdx + 0x1e]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b10e
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov rcx, rbx
call fcn.180040990
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003ac20
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b130
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x15], sil
je 0x18004b163
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x14
jb 0x18004b150
mov byte [rdx + 0x15], sil
lea rax, [rdx + 0x14]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b18d
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x18004b1b3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x18004b1a0
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b1e1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b1f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x16], sil
je 0x18004b223
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x18004b210
mov byte [rdx + 0x16], sil
lea rax, [rdx + 0x15]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b24d
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x21], 0
je 0x18004b273
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x20
jb 0x18004b260
mov byte [rdi + 0x21], 0
lea r8, [rdi + 0x20]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b2a1
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004b2b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x18004b2e3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x18004b2d0
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b30d
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x13], 0
je 0x18004b333
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x12
jb 0x18004b320
mov byte [rdi + 0x13], 0
lea r8, [rdi + 0x12]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b361
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1d], r8b
je 0x18004b3a4
mov eax, r8d
lea ecx, [rax - 3]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1c
jb 0x18004b391
mov byte [rdx + 0x1d], r8b
lea rax, [rdx + 0x1c]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b3ce
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040990
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.1800513f0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b3f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x13], sil
je 0x18004b423
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x12
jb 0x18004b410
mov byte [rdx + 0x13], sil
lea rax, [rdx + 0x12]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b44d
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x18004b473
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x18004b460
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b4a1
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004b4b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e170
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 7], dl
je 0x18004b502
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 3]
xor byte [rax + rbx], cl
inc rax
cmp rax, 6
jb 0x18004b4f0
mov byte [rbx + 7], dl
lea r8, [rbx + 6]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004b52f
mov r8d, 6
mov rdx, rbx
mov rcx, r9
call fcn.180040990
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b580
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov rdx, rcx
mov rcx, rax
call fcn.180051380
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x30], r9
xor edx, edx
cmp byte [rbx + 0x2a], dl
je 0x18004b5d2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 3]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0x29
jb 0x18004b5c0
mov byte [rbx + 0x2a], dl
lea r8, [rbx + 0x29]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004b5ff
mov r8d, reloc.WLDAP32.dll_Ordinal_41
mov rdx, rbx
mov rcx, r9
call fcn.180040990
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b610
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x16], sil
je 0x18004b643
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x18004b630
mov byte [rdx + 0x16], sil
lea rax, [rdx + 0x15]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b66d
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1d], 0
je 0x18004b693
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1c
jb 0x18004b680
mov byte [rdi + 0x1d], 0
lea r8, [rdi + 0x1c]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b6c1
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004b6d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 5], r8b
je 0x18004b704
mov eax, r8d
lea ecx, [rax - 3]
xor byte [rax + rdx], cl
inc rax
cmp rax, 4
jb 0x18004b6f1
mov byte [rdx + 5], r8b
lea rax, [rdx + 4]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b72e
mov r8d, 4
mov rcx, rbx
call fcn.180040990
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001e170
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b750
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1c], sil
je 0x18004b783
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1b
jb 0x18004b770
mov byte [rdx + 0x1c], sil
lea rax, [rdx + 0x1b]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b7ad
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x17], 0
je 0x18004b7d3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x16
jb 0x18004b7c0
mov byte [rdi + 0x17], 0
lea r8, [rdi + 0x16]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b801
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b810
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e170
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xc], dl
je 0x18004b862
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 3]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xb
jb 0x18004b850
mov byte [rbx + 0xc], dl
lea r8, [rbx + 0xb]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004b88f
mov r8d, recv
mov rdx, rbx
mov rcx, r9
call fcn.180040990
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004b8a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e170
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xb], dl
je 0x18004b8f2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 3]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xa
jb 0x18004b8e0
mov byte [rbx + 0xb], dl
lea r8, [rbx + 0xa]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004b91f
mov r8d, 0xa
mov rdx, rbx
mov rcx, r9
call fcn.180040990
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b930
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 7], sil
je 0x18004b963
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 6
jb 0x18004b950
mov byte [rdx + 7], sil
lea rax, [rdx + 6]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b98d
mov r8d, 6
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0xe], 0
je 0x18004b9b3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x18004b9a0
mov byte [rdi + 0xe], 0
lea r8, [rdi + 0xd]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b9e1
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b9f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 0xc], r8b
je 0x18004ba24
mov eax, r8d
lea ecx, [rax - 3]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xb
jb 0x18004ba11
mov byte [rdx + 0xc], r8b
lea rax, [rdx + 0xb]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004ba4e
mov r8d, recv
mov rcx, rbx
call fcn.180040990
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001e2b0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004ba70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x18004baa3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x18004ba90
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004bacd
mov r8d, 0xa
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0xc], 0
je 0x18004baf3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xb
jb 0x18004bae0
mov byte [rdi + 0xc], 0
lea r8, [rdi + 0xb]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004bb21
mov r8d, recv
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004bb30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e170
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xf], dl
je 0x18004bb82
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 3]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xe
jb 0x18004bb70
mov byte [rbx + 0xf], dl
lea r8, [rbx + 0xe]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004bbaf
mov r8d, recv
mov rdx, rbx
mov rcx, r9
call fcn.180040990
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004bbc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xd], sil
je 0x18004bbf3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x18004bbe0
mov byte [rdx + 0xd], sil
lea rax, [rdx + 0xc]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004bc1d
mov r8d, recv
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x18004bc43
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x18004bc30
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004bc71
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret