joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004abd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xf], sil
je 0x18004ac03
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xe
jb 0x18004abf0
mov byte [rdx + 0xf], sil
lea rax, [rdx + 0xe]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004ac2d
mov r8d, recv
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x13], 0
je 0x18004ac53
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x12
jb 0x18004ac40
mov byte [rdi + 0x13], 0
lea r8, [rdi + 0x12]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ac81
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004ac90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x18004acc3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x18004acb0
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004aced
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1d], 0
je 0x18004ad13
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1c
jb 0x18004ad00
mov byte [rdi + 0x1d], 0
lea r8, [rdi + 0x1c]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ad41
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004ad50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004ad83
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004ad70
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004adad
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004add3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004adc0
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ae01
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004ae10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x18004ae43
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x18004ae30
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004ae6d
mov r8d, 5
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x18004ae93
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x18004ae80
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004aec1
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004aed0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x14], sil
je 0x18004af03
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x13
jb 0x18004aef0
mov byte [rdx + 0x14], sil
lea rax, [rdx + 0x13]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004af2d
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x21], 0
je 0x18004af53
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x20
jb 0x18004af40
mov byte [rdi + 0x21], 0
lea r8, [rdi + 0x20]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004af81
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004af90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e1e0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 6], dl
je 0x18004afe2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x70]
xor byte [rax + rbx], cl
inc rax
cmp rax, 5
jb 0x18004afd0
mov byte [rbx + 6], dl
lea r8, [rbx + 5]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004b00f
mov r8d, 5
mov rdx, rbx
mov rcx, r9
call fcn.180040b10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b020
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xe], sil
je 0x18004b053
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x18004b040
mov byte [rdx + 0xe], sil
lea rax, [rdx + 0xd]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b07d
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x18004b0a3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x18004b090
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b0d1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004b130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x18], r8b
je 0x18004b164
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x17
jb 0x18004b151
mov byte [rdx + 0x18], r8b
lea rax, [rdx + 0x17]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b18e
mov r8d, reloc.WS2_32.dll_socket
mov rcx, rbx
call fcn.180040b10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051860
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b1b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 6], r8b
je 0x18004b1e4
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 5
jb 0x18004b1d1
mov byte [rdx + 6], r8b
lea rax, [rdx + 5]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b20e
mov r8d, 5
mov rcx, rbx
call fcn.180040b10
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001e1e0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1f], r8b
je 0x18004b264
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1e
jb 0x18004b251
mov byte [rdx + 0x1f], r8b
lea rax, [rdx + 0x1e]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b28e
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov rcx, rbx
call fcn.180040b10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003ae10
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004b2b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x15], sil
je 0x18004b2e3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x14
jb 0x18004b2d0
mov byte [rdx + 0x15], sil
lea rax, [rdx + 0x14]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b30d
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x18004b333
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x18004b320
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b361
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b370
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x16], sil
je 0x18004b3a3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x18004b390
mov byte [rdx + 0x16], sil
lea rax, [rdx + 0x15]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b3cd
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x21], 0
je 0x18004b3f3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x20
jb 0x18004b3e0
mov byte [rdi + 0x21], 0
lea r8, [rdi + 0x20]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b421
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004b430
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x18004b463
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x18004b450
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b48d
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x13], 0
je 0x18004b4b3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x12
jb 0x18004b4a0
mov byte [rdi + 0x13], 0
lea r8, [rdi + 0x12]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b4e1
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b4f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1d], r8b
je 0x18004b524
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1c
jb 0x18004b511
mov byte [rdx + 0x1d], r8b
lea rax, [rdx + 0x1c]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b54e
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040b10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051570
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b570
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x13], sil
je 0x18004b5a3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x12
jb 0x18004b590
mov byte [rdx + 0x13], sil
lea rax, [rdx + 0x12]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b5cd
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x18004b5f3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x18004b5e0
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b621
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004b630
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e1e0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 7], dl
je 0x18004b682
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x70]
xor byte [rax + rbx], cl
inc rax
cmp rax, 6
jb 0x18004b670
mov byte [rbx + 7], dl
lea r8, [rbx + 6]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004b6af
mov r8d, 6
mov rdx, rbx
mov rcx, r9
call fcn.180040b10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b700
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov rdx, rcx
mov rcx, rax
call fcn.180051500
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x30], r9
xor edx, edx
cmp byte [rbx + 0x2a], dl
je 0x18004b752
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x70]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0x29
jb 0x18004b740
mov byte [rbx + 0x2a], dl
lea r8, [rbx + 0x29]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004b77f
mov r8d, reloc.WLDAP32.dll_Ordinal_41
mov rdx, rbx
mov rcx, r9
call fcn.180040b10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b790
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x16], sil
je 0x18004b7c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x18004b7b0
mov byte [rdx + 0x16], sil
lea rax, [rdx + 0x15]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b7ed
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1d], 0
je 0x18004b813
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1c
jb 0x18004b800
mov byte [rdi + 0x1d], 0
lea r8, [rdi + 0x1c]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b841
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004b850
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 5], r8b
je 0x18004b884
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 4
jb 0x18004b871
mov byte [rdx + 5], r8b
lea rax, [rdx + 4]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004b8ae
mov r8d, 4
mov rcx, rbx
call fcn.180040b10
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001e1e0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004b8d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1c], sil
je 0x18004b903
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1b
jb 0x18004b8f0
mov byte [rdx + 0x1c], sil
lea rax, [rdx + 0x1b]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004b92d
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x17], 0
je 0x18004b953
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x16
jb 0x18004b940
mov byte [rdi + 0x17], 0
lea r8, [rdi + 0x16]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004b981
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004b990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e1e0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xc], dl
je 0x18004b9e2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x70]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xb
jb 0x18004b9d0
mov byte [rbx + 0xc], dl
lea r8, [rbx + 0xb]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004ba0f
mov r8d, recv
mov rdx, rbx
mov rcx, r9
call fcn.180040b10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004ba20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e1e0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xb], dl
je 0x18004ba72
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x70]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xa
jb 0x18004ba60
mov byte [rbx + 0xb], dl
lea r8, [rbx + 0xa]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004ba9f
mov r8d, 0xa
mov rdx, rbx
mov rcx, r9
call fcn.180040b10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004bab0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 7], sil
je 0x18004bae3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 6
jb 0x18004bad0
mov byte [rdx + 7], sil
lea rax, [rdx + 6]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004bb0d
mov r8d, 6
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0xe], 0
je 0x18004bb33
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x18004bb20
mov byte [rdi + 0xe], 0
lea r8, [rdi + 0xd]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004bb61
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004bb70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 0xc], r8b
je 0x18004bba4
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xb
jb 0x18004bb91
mov byte [rdx + 0xc], r8b
lea rax, [rdx + 0xb]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004bbce
mov r8d, recv
mov rcx, rbx
call fcn.180040b10
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001e320
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret