joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003b920
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18003b942
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x18003b958
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18003b974
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18003b976
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x18003b9b0
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18003ba57
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x18003b9eb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x18003ba31
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x18003ba70
cmp rbx, rax
ja 0x18003ba00
mov r8, rdi
test rdi, rdi
je 0x18003ba57
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x18003ba5a
Function at 0x18003be50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18003be7d
xor eax, eax
jmp 0x18003bfd2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x18003bea8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x18003bea8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x18003bfd2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18003bfc5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x18003beeb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18003bf16
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18003bfca
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18003bf85
sub eax, 1
je 0x18003bf85
cmp eax, 2
jne 0x18003bfc5
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18003bfca
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18003bfb3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18003bfc5
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x18003bfca
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180112b70
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x18003c1b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x26], r8b
je 0x18003c1e3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x25
jb 0x18003c1d0
mov byte [rdx + 0x26], r8b
lea rcx, [rdx + 0x25]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003c20c
mov r8d, Ordinal_41
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x18003c220
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x22], r8b
je 0x18003c253
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x21
jb 0x18003c240
mov byte [rdx + 0x22], r8b
lea rcx, [rdx + 0x21]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003c27c
mov r8d, reloc.WLDAP32.dll_Ordinal_33
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003c290
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x20], r8b
je 0x18003c2c3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x1f
jb 0x18003c2b0
mov byte [rdx + 0x20], r8b
lea rcx, [rdx + 0x1f]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003c2ec
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003c300
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x18003c323
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x19
jb 0x18003c310
mov byte [rcx + 0x1a], 0
ret

Function at 0x18003c330
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x1a], r8b
je 0x18003c363
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x19
jb 0x18003c350
mov byte [rdx + 0x1a], r8b
lea rcx, [rdx + 0x19]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003c38c
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003c3a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x2b], r8b
je 0x18003c3d3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x2a
jb 0x18003c3c0
mov byte [rdx + 0x2b], r8b
lea rcx, [rdx + 0x2a]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003c3fc
mov r8d, Ordinal_46
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003c580
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x21], 0
je 0x18003c5a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x20
jb 0x18003c590
mov byte [rcx + 0x21], 0
ret
Function at 0x18003c5b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x21], r8b
je 0x18003c5e3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x20
jb 0x18003c5d0
mov byte [rdx + 0x21], r8b
lea rcx, [rdx + 0x20]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003c60c
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003d760
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 5], r8b
je 0x18003d793
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 4
jb 0x18003d780
mov byte [rdx + 5], r8b
lea rcx, [rdx + 4]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003d7bc
mov r8d, 4
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003d960
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x17], r8b
je 0x18003d993
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x16
jb 0x18003d980
mov byte [rdx + 0x17], r8b
lea rcx, [rdx + 0x16]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003d9bc
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003d9d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x13], r8b
je 0x18003da03
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x12
jb 0x18003d9f0
mov byte [rdx + 0x13], r8b
lea rcx, [rdx + 0x12]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003da2c
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003da40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x18003da63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x18003da50
mov byte [rcx + 0x14], 0
ret
Function at 0x18003da70
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x14], r8b
je 0x18003daa3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x13
jb 0x18003da90
mov byte [rdx + 0x14], r8b
lea rcx, [rdx + 0x13]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003dacc
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003dae0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xf], r8b
je 0x18003db13
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xe
jb 0x18003db00
mov byte [rdx + 0xf], r8b
lea rcx, [rdx + 0xe]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003db3c
mov r8d, recv
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003db50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xb], r8b
je 0x18003db83
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xa
jb 0x18003db70
mov byte [rdx + 0xb], r8b
lea rcx, [rdx + 0xa]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003dbac
mov r8d, 0xa
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003dbe0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x10], r8b
je 0x18003dc13
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xf
jb 0x18003dc00
mov byte [rdx + 0x10], r8b
lea rcx, [rdx + 0xf]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003dc3c
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003dc50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xd], r8b
je 0x18003dc83
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xc
jb 0x18003dc70
mov byte [rdx + 0xd], r8b
lea rcx, [rdx + 0xc]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003dcac
mov r8d, recv
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x18003dcc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xe], r8b
je 0x18003dcf3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xd
jb 0x18003dce0
mov byte [rdx + 0xe], r8b
lea rcx, [rdx + 0xd]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003dd1c
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003dd30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x12], r8b
je 0x18003dd63
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x11
jb 0x18003dd50
mov byte [rdx + 0x12], r8b
lea rcx, [rdx + 0x11]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003dd8c
mov r8d, reloc.WS2_32.dll_recvfrom
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003ddc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xc], r8b
je 0x18003ddf3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xb
jb 0x18003dde0
mov byte [rdx + 0xc], r8b
lea rcx, [rdx + 0xb]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003de1c
mov r8d, recv
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003de30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x11], r8b
je 0x18003de63
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x10
jb 0x18003de50
mov byte [rdx + 0x11], r8b
lea rcx, [rdx + 0x10]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003de8c
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e060
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x18003e083
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1d
jb 0x18003e070
mov byte [rcx + 0x1e], 0
ret
Function at 0x18003e090
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x1e], r8b
je 0x18003e0c3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x1d
jb 0x18003e0b0
mov byte [rdx + 0x1e], r8b
lea rcx, [rdx + 0x1d]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003e0ec
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e100
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 4], r8b
je 0x18003e133
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 3
jb 0x18003e120
mov byte [rdx + 4], r8b
lea rcx, [rdx + 3]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003e15c
mov r8d, 3
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e170
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x1c], r8b
je 0x18003e1a3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x1b
jb 0x18003e190
mov byte [rdx + 0x1c], r8b
lea rcx, [rdx + 0x1b]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003e1cc
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e1e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x1b], r8b
je 0x18003e213
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x1a
jb 0x18003e200
mov byte [rdx + 0x1b], r8b
lea rcx, [rdx + 0x1a]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003e23c
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e250
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 3], r8b
je 0x18003e283
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 2
jb 0x18003e270
mov byte [rdx + 3], r8b
lea rcx, [rdx + 2]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003e2ac
mov r8d, 2
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x18003e2c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 6], r8b
je 0x18003e2f3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 5
jb 0x18003e2e0
mov byte [rdx + 6], r8b
lea rcx, [rdx + 5]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003e31c
mov r8d, 5
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e330
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x16], r8b
je 0x18003e363
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x15
jb 0x18003e350
mov byte [rdx + 0x16], r8b
lea rcx, [rdx + 0x15]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003e38c
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e3a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x15], r8b
je 0x18003e3d3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x14
jb 0x18003e3c0
mov byte [rdx + 0x15], r8b
lea rcx, [rdx + 0x14]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003e3fc
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003ea30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 8], r8b
je 0x18003ea63
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 7
jb 0x18003ea50
mov byte [rdx + 8], r8b
lea rcx, [rdx + 7]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003ea8c
mov r8d, 7
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003eab0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 7], r8b
je 0x18003eae3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 6
jb 0x18003ead0
mov byte [rdx + 7], r8b
lea rcx, [rdx + 6]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003eb0c
mov r8d, 6
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret