joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800038d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x130
mov rax, qword [0x180046038]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov ebp, 0x100
mov rdi, rdx
mov qword [rdx + 8], rbp
mov r14, rcx
xor ebx, ebx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, ebp
mov esi, ebx
call fcn.18000e220
mov eax, ebx
mov byte [rsp + rax + 0x20], al
inc rax
cmp rax, rbp
jb 0x18000391b
mov r9, qword [rdi]
mov r8, rbx
mov dl, byte [rsp + r8 + 0x20]
mov cl, r8b
and cl, 7
mov rax, r9
shl cl, 3
shr rax, cl
add al, dl
add al, sil
movzx esi, al
xor dl, byte [rsp + rsi + 0x20]
mov byte [rsp + r8 + 0x20], dl
xor byte [rsp + rsi + 0x20], dl
mov al, byte [rsp + rsi + 0x20]
xor byte [rsp + r8 + 0x20], al
inc r8
cmp r8, rbp
jb 0x18000392d
mov r8, rbx
mov rdx, rbx
inc bl
movzx ebx, bl
mov cl, byte [rsp + rbx + 0x20]
lea eax, [r8 + rcx]
movzx r8d, al
xor cl, byte [rsp + r8 + 0x20]
mov byte [rsp + rbx + 0x20], cl
xor byte [rsp + r8 + 0x20], cl
mov al, byte [rsp + r8 + 0x20]
xor al, byte [rsp + rbx + 0x20]
movsx ecx, al
mov byte [rsp + rbx + 0x20], al
movsx eax, byte [rsp + r8 + 0x20]
add ecx, eax
and ecx, 0x800000ff
jge 0x1800039b6
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, cl
mov cl, byte [rsp + rax + 0x20]
mov byte [r14 + rdx], cl
inc rdx
cmp rdx, 0xf
jb 0x18000396d
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.18000ba30
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1800039f4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x230
mov rax, qword [0x180046038]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rdi, rdx
mov qword [rdx + 8], 0x10000
mov r14, rcx
xor ebx, ebx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x200
mov esi, ebx
call fcn.18000e220
mov eax, ebx
mov r9d, 0x100
mov word [rsp + rax*2 + 0x20], ax
inc rax
cmp rax, r9
jb 0x180003a42
mov r8, qword [rdi]
mov rdx, rbx
mov cl, dl
mov rax, r8
and cl, 7
shl cl, 3
shr rax, cl
add al, sil
add al, byte [rsp + rdx*2 + 0x20]
movzx esi, al
movzx eax, word [rsp + rsi*2 + 0x20]
xor ax, word [rsp + rdx*2 + 0x20]
mov word [rsp + rdx*2 + 0x20], ax
xor ax, word [rsp + rsi*2 + 0x20]
mov word [rsp + rsi*2 + 0x20], ax
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, r9
jb 0x180003a55
mov rdx, rbx
mov r8, rbx
inc bl
movzx ebx, bl
add dl, byte [rsp + rbx*2 + 0x20]
movzx edx, dl
movzx eax, word [rsp + rdx*2 + 0x20]
xor word [rsp + rbx*2 + 0x20], ax
movzx eax, word [rsp + rbx*2 + 0x20]
xor word [rsp + rdx*2 + 0x20], ax
movzx eax, word [rsp + rdx*2 + 0x20]
xor ax, word [rsp + rbx*2 + 0x20]
movzx ecx, ax
mov word [rsp + rbx*2 + 0x20], ax
movzx eax, word [rsp + rdx*2 + 0x20]
add rax, rcx
movzx eax, al
movzx ecx, word [rsp + rax*2 + 0x20]
mov word [r14 + r8*2], cx
inc r8
cmp r8, 5
jb 0x180003a99
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.18000ba30
mov rbx, qword [rsp + 0x260]
add rsp, 0x230
pop r14
pop rdi
pop rsi
ret
Function at 0x180003b10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x230
mov rax, qword [0x180046038]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rdi, rdx
mov qword [rdx + 8], 0x10000
mov r14, rcx
xor ebx, ebx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x200
mov esi, ebx
call fcn.18000e220
mov eax, ebx
mov r9d, 0x100
mov word [rsp + rax*2 + 0x20], ax
inc rax
cmp rax, r9
jb 0x180003b5e
mov r8, qword [rdi]
mov rdx, rbx
mov cl, dl
mov rax, r8
and cl, 7
shl cl, 3
shr rax, cl
add al, sil
add al, byte [rsp + rdx*2 + 0x20]
movzx esi, al
movzx eax, word [rsp + rsi*2 + 0x20]
xor ax, word [rsp + rdx*2 + 0x20]
mov word [rsp + rdx*2 + 0x20], ax
xor ax, word [rsp + rsi*2 + 0x20]
mov word [rsp + rsi*2 + 0x20], ax
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, r9
jb 0x180003b71
mov rdx, rbx
mov r8, rbx
inc bl
movzx ebx, bl
add dl, byte [rsp + rbx*2 + 0x20]
movzx edx, dl
movzx eax, word [rsp + rdx*2 + 0x20]
xor word [rsp + rbx*2 + 0x20], ax
movzx eax, word [rsp + rbx*2 + 0x20]
xor word [rsp + rdx*2 + 0x20], ax
movzx eax, word [rsp + rdx*2 + 0x20]
xor ax, word [rsp + rbx*2 + 0x20]
movzx ecx, ax
mov word [rsp + rbx*2 + 0x20], ax
movzx eax, word [rsp + rdx*2 + 0x20]
add rax, rcx
movzx eax, al
movzx ecx, word [rsp + rax*2 + 0x20]
mov word [r14 + r8*2], cx
inc r8
cmp r8, 0x14
jb 0x180003bb5
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.18000ba30
mov rbx, qword [rsp + 0x260]
add rsp, 0x230
pop r14
pop rdi
pop rsi
ret

Function at 0x180003c2c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x230
mov rax, qword [0x180046038]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rdi, rdx
mov qword [rdx + 8], 0x10000
mov r14, rcx
xor ebx, ebx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x200
mov esi, ebx
call fcn.18000e220
mov eax, ebx
mov r9d, 0x100
mov word [rsp + rax*2 + 0x20], ax
inc rax
cmp rax, r9
jb 0x180003c7a
mov r8, qword [rdi]
mov rdx, rbx
mov cl, dl
mov rax, r8
and cl, 7
shl cl, 3
shr rax, cl
add al, sil
add al, byte [rsp + rdx*2 + 0x20]
movzx esi, al
movzx eax, word [rsp + rsi*2 + 0x20]
xor ax, word [rsp + rdx*2 + 0x20]
mov word [rsp + rdx*2 + 0x20], ax
xor ax, word [rsp + rsi*2 + 0x20]
mov word [rsp + rsi*2 + 0x20], ax
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, r9
jb 0x180003c8d
mov rdx, rbx
mov r8, rbx
inc bl
movzx ebx, bl
add dl, byte [rsp + rbx*2 + 0x20]
movzx edx, dl
movzx eax, word [rsp + rdx*2 + 0x20]
xor word [rsp + rbx*2 + 0x20], ax
movzx eax, word [rsp + rbx*2 + 0x20]
xor word [rsp + rdx*2 + 0x20], ax
movzx eax, word [rsp + rdx*2 + 0x20]
xor ax, word [rsp + rbx*2 + 0x20]
movzx ecx, ax
mov word [rsp + rbx*2 + 0x20], ax
movzx eax, word [rsp + rdx*2 + 0x20]
add rax, rcx
movzx eax, al
movzx ecx, word [rsp + rax*2 + 0x20]
mov word [r14 + r8*2], cx
inc r8
cmp r8, 0x1d
jb 0x180003cd1
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.18000ba30
mov rbx, qword [rsp + 0x260]
add rsp, 0x230
pop r14
pop rdi
pop rsi
ret
Function at 0x180003d48
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x230
mov rax, qword [0x180046038]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rdi, rdx
mov qword [rdx + 8], 0x10000
mov r14, rcx
xor ebx, ebx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x200
mov esi, ebx
call fcn.18000e220
mov eax, ebx
mov r9d, 0x100
mov word [rsp + rax*2 + 0x20], ax
inc rax
cmp rax, r9
jb 0x180003d96
mov r8, qword [rdi]
mov rdx, rbx
mov cl, dl
mov rax, r8
and cl, 7
shl cl, 3
shr rax, cl
add al, sil
add al, byte [rsp + rdx*2 + 0x20]
movzx esi, al
movzx eax, word [rsp + rsi*2 + 0x20]
xor ax, word [rsp + rdx*2 + 0x20]
mov word [rsp + rdx*2 + 0x20], ax
xor ax, word [rsp + rsi*2 + 0x20]
mov word [rsp + rsi*2 + 0x20], ax
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, r9
jb 0x180003da9
mov rdx, rbx
mov r8, rbx
inc bl
movzx ebx, bl
add dl, byte [rsp + rbx*2 + 0x20]
movzx edx, dl
movzx eax, word [rsp + rdx*2 + 0x20]
xor word [rsp + rbx*2 + 0x20], ax
movzx eax, word [rsp + rbx*2 + 0x20]
xor word [rsp + rdx*2 + 0x20], ax
movzx eax, word [rsp + rdx*2 + 0x20]
xor ax, word [rsp + rbx*2 + 0x20]
movzx ecx, ax
mov word [rsp + rbx*2 + 0x20], ax
movzx eax, word [rsp + rdx*2 + 0x20]
add rax, rcx
movzx eax, al
movzx ecx, word [rsp + rax*2 + 0x20]
mov word [r14 + r8*2], cx
inc r8
cmp r8, 0x1f
jb 0x180003ded
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.18000ba30
mov rbx, qword [rsp + 0x260]
add rsp, 0x230
pop r14
pop rdi
pop rsi
ret

Function at 0x180003e64
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x230
mov rax, qword [0x180046038]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rdi, rdx
mov qword [rdx + 8], 0x10000
mov r14, rcx
xor ebx, ebx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x200
mov esi, ebx
call fcn.18000e220
mov eax, ebx
mov r9d, 0x100
mov word [rsp + rax*2 + 0x20], ax
inc rax
cmp rax, r9
jb 0x180003eb2
mov r8, qword [rdi]
mov rdx, rbx
mov cl, dl
mov rax, r8
and cl, 7
shl cl, 3
shr rax, cl
add al, sil
add al, byte [rsp + rdx*2 + 0x20]
movzx esi, al
movzx eax, word [rsp + rsi*2 + 0x20]
xor ax, word [rsp + rdx*2 + 0x20]
mov word [rsp + rdx*2 + 0x20], ax
xor ax, word [rsp + rsi*2 + 0x20]
mov word [rsp + rsi*2 + 0x20], ax
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, r9
jb 0x180003ec5
mov rdx, rbx
mov r8, rbx
inc bl
movzx ebx, bl
add dl, byte [rsp + rbx*2 + 0x20]
movzx edx, dl
movzx eax, word [rsp + rdx*2 + 0x20]
xor word [rsp + rbx*2 + 0x20], ax
movzx eax, word [rsp + rbx*2 + 0x20]
xor word [rsp + rdx*2 + 0x20], ax
movzx eax, word [rsp + rdx*2 + 0x20]
xor ax, word [rsp + rbx*2 + 0x20]
movzx ecx, ax
mov word [rsp + rbx*2 + 0x20], ax
movzx eax, word [rsp + rdx*2 + 0x20]
add rax, rcx
movzx eax, al
movzx ecx, word [rsp + rax*2 + 0x20]
mov word [r14 + r8*2], cx
inc r8
cmp r8, 0x3d
jb 0x180003f09
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.18000ba30
mov rbx, qword [rsp + 0x260]
add rsp, 0x230
pop r14
pop rdi
pop rsi
ret
Function at 0x180003f80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x230
mov rax, qword [0x180046038]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rdi, rdx
mov qword [rdx + 8], 0x10000
mov r14, rcx
xor ebx, ebx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x200
mov esi, ebx
call fcn.18000e220
mov eax, ebx
mov r9d, 0x100
mov word [rsp + rax*2 + 0x20], ax
inc rax
cmp rax, r9
jb 0x180003fce
mov r8, qword [rdi]
mov rdx, rbx
mov cl, dl
mov rax, r8
and cl, 7
shl cl, 3
shr rax, cl
add al, sil
add al, byte [rsp + rdx*2 + 0x20]
movzx esi, al
movzx eax, word [rsp + rsi*2 + 0x20]
xor ax, word [rsp + rdx*2 + 0x20]
mov word [rsp + rdx*2 + 0x20], ax
xor ax, word [rsp + rsi*2 + 0x20]
mov word [rsp + rsi*2 + 0x20], ax
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, r9
jb 0x180003fe1
mov rdx, rbx
mov r8, rbx
inc bl
movzx ebx, bl
add dl, byte [rsp + rbx*2 + 0x20]
movzx edx, dl
movzx eax, word [rsp + rdx*2 + 0x20]
xor word [rsp + rbx*2 + 0x20], ax
movzx eax, word [rsp + rbx*2 + 0x20]
xor word [rsp + rdx*2 + 0x20], ax
movzx eax, word [rsp + rdx*2 + 0x20]
xor ax, word [rsp + rbx*2 + 0x20]
movzx ecx, ax
mov word [rsp + rbx*2 + 0x20], ax
movzx eax, word [rsp + rdx*2 + 0x20]
add rax, rcx
movzx eax, al
movzx ecx, word [rsp + rax*2 + 0x20]
mov word [r14 + r8*2], cx
inc r8
cmp r8, 0x4c
jb 0x180004025
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.18000ba30
mov rbx, qword [rsp + 0x260]
add rsp, 0x230
pop r14
pop rdi
pop rsi
ret

Function at 0x18000409c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x230
mov rax, qword [0x180046038]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rdi, rdx
mov qword [rdx + 8], 0x10000
mov r14, rcx
xor ebx, ebx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x200
mov esi, ebx
call fcn.18000e220
mov eax, ebx
mov r9d, 0x100
mov word [rsp + rax*2 + 0x20], ax
inc rax
cmp rax, r9
jb 0x1800040ea
mov r8, qword [rdi]
mov rdx, rbx
mov cl, dl
mov rax, r8
and cl, 7
shl cl, 3
shr rax, cl
add al, sil
add al, byte [rsp + rdx*2 + 0x20]
movzx esi, al
movzx eax, word [rsp + rsi*2 + 0x20]
xor ax, word [rsp + rdx*2 + 0x20]
mov word [rsp + rdx*2 + 0x20], ax
xor ax, word [rsp + rsi*2 + 0x20]
mov word [rsp + rsi*2 + 0x20], ax
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, r9
jb 0x1800040fd
mov rdx, rbx
mov r8, rbx
inc bl
movzx ebx, bl
add dl, byte [rsp + rbx*2 + 0x20]
movzx edx, dl
movzx eax, word [rsp + rdx*2 + 0x20]
xor word [rsp + rbx*2 + 0x20], ax
movzx eax, word [rsp + rbx*2 + 0x20]
xor word [rsp + rdx*2 + 0x20], ax
movzx eax, word [rsp + rdx*2 + 0x20]
xor ax, word [rsp + rbx*2 + 0x20]
movzx ecx, ax
mov word [rsp + rbx*2 + 0x20], ax
movzx eax, word [rsp + rdx*2 + 0x20]
add rax, rcx
movzx eax, al
movzx ecx, word [rsp + rax*2 + 0x20]
mov word [r14 + r8*2], cx
inc r8
cmp r8, 0xc
jb 0x180004141
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.18000ba30
mov rbx, qword [rsp + 0x260]
add rsp, 0x230
pop r14
pop rdi
pop rsi
ret
Function at 0x1800041b8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r8, qword [rdx]
mov r10, rdx
mov rdi, rcx
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov qword [rdx + 0x10], 7
xor r9d, r9d
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r8
shl rax, cl
xor bl, bl
mov rcx, qword [r10 + 0x10]
xor r8, rax
mov rax, r8
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r8, rax
mov rax, r8
shl rax, cl
xor r8, rax
xor r11b, r11b
movzx ecx, r11b
mov rdx, r8
shl ecx, 3
inc r11b
shr rdx, cl
xor bl, dl
cmp r11b, 8
jb 0x180004212
mov byte [r9 + rdi], bl
inc r9
cmp r9, 8
jb 0x1800041e6
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x180004244
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r8, qword [rdx]
mov r10, rdx
mov rdi, rcx
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov qword [rdx + 0x10], 7
xor r9d, r9d
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r8
shl rax, cl
xor bl, bl
mov rcx, qword [r10 + 0x10]
xor r8, rax
mov rax, r8
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r8, rax
mov rax, r8
shl rax, cl
xor r8, rax
xor r11b, r11b
movzx ecx, r11b
mov rdx, r8
shl ecx, 3
inc r11b
shr rdx, cl
xor bl, dl
cmp r11b, 8
jb 0x18000429e
mov byte [r9 + rdi], bl
inc r9
cmp r9, 9
jb 0x180004272
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1800042d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r8, qword [rdx]
mov r10, rdx
mov rdi, rcx
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov qword [rdx + 0x10], 7
xor r9d, r9d
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r8
shl rax, cl
xor bl, bl
mov rcx, qword [r10 + 0x10]
xor r8, rax
mov rax, r8
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r8, rax
mov rax, r8
shl rax, cl
xor r8, rax
xor r11b, r11b
movzx ecx, r11b
mov rdx, r8
shl ecx, 3
inc r11b
shr rdx, cl
xor bl, dl
cmp r11b, 8
jb 0x18000432a
mov byte [r9 + rdi], bl
inc r9
cmp r9, 0xa
jb 0x1800042fe
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x18000435c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r8, qword [rdx]
mov r10, rdx
mov rdi, rcx
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov qword [rdx + 0x10], 7
xor r9d, r9d
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r8
shl rax, cl
xor bl, bl
mov rcx, qword [r10 + 0x10]
xor r8, rax
mov rax, r8
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r8, rax
mov rax, r8
shl rax, cl
xor r8, rax
xor r11b, r11b
movzx ecx, r11b
mov rdx, r8
shl ecx, 3
inc r11b
shr rdx, cl
xor bl, dl
cmp r11b, 8
jb 0x1800043b6
mov byte [r9 + rdi], bl
inc r9
cmp r9, 0x11
jb 0x18000438a
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1800043e8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r8, qword [rdx]
mov r10, rdx
mov rdi, rcx
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov qword [rdx + 0x10], 7
xor r9d, r9d
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r8
shl rax, cl
xor bl, bl
mov rcx, qword [r10 + 0x10]
xor r8, rax
mov rax, r8
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r8, rax
mov rax, r8
shl rax, cl
xor r8, rax
xor r11b, r11b
movzx ecx, r11b
mov rdx, r8
shl ecx, 3
inc r11b
shr rdx, cl
xor bl, dl
cmp r11b, 8
jb 0x180004442
mov byte [r9 + rdi], bl
inc r9
cmp r9, 0x39
jb 0x180004416
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x180004474
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r8, qword [rdx]
mov r10, rdx
mov rdi, rcx
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov qword [rdx + 0x10], 7
xor r9d, r9d
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r8
shl rax, cl
xor bl, bl
mov rcx, qword [r10 + 0x10]
xor r8, rax
mov rax, r8
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r8, rax
mov rax, r8
shl rax, cl
xor r8, rax
xor r11b, r11b
movzx ecx, r11b
mov rdx, r8
shl ecx, 3
inc r11b
shr rdx, cl
xor bl, dl
cmp r11b, 8
jb 0x1800044ce
mov byte [r9 + rdi], bl
inc r9
cmp r9, 0x4a
jb 0x1800044a2
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x180004500
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r8, qword [rdx]
mov r10, rdx
mov rdi, rcx
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov qword [rdx + 0x10], 7
xor r9d, r9d
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r8
shl rax, cl
xor bl, bl
mov rcx, qword [r10 + 0x10]
xor r8, rax
mov rax, r8
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r8, rax
mov rax, r8
shl rax, cl
xor r8, rax
xor r11b, r11b
movzx ecx, r11b
mov rdx, r8
shl ecx, 3
inc r11b
shr rdx, cl
xor bl, dl
cmp r11b, 8
jb 0x18000455a
mov byte [r9 + rdi], bl
inc r9
cmp r9, 0xc
jb 0x18000452e
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x18000458c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r8, qword [rdx]
mov r10, rdx
mov rdi, rcx
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov qword [rdx + 0x10], 7
xor r9d, r9d
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r8
shl rax, cl
xor bl, bl
mov rcx, qword [r10 + 0x10]
xor r8, rax
mov rax, r8
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r8, rax
mov rax, r8
shl rax, cl
xor r8, rax
xor r11b, r11b
movzx ecx, r11b
mov rdx, r8
shl ecx, 3
inc r11b
shr rdx, cl
xor bl, dl
cmp r11b, 8
jb 0x1800045e6
mov byte [r9 + rdi], bl
inc r9
cmp r9, 0xe
jb 0x1800045ba
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x180004618
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r8, qword [rdx]
mov r10, rdx
mov rdi, rcx
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov qword [rdx + 0x10], 7
xor r9d, r9d
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r8
shl rax, cl
xor bl, bl
mov rcx, qword [r10 + 0x10]
xor r8, rax
mov rax, r8
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r8, rax
mov rax, r8
shl rax, cl
xor r8, rax
xor r11b, r11b
movzx ecx, r11b
mov rdx, r8
shl ecx, 3
inc r11b
shr rdx, cl
xor bl, dl
cmp r11b, 8
jb 0x180004672
mov byte [r9 + rdi], bl
inc r9
cmp r9, 0xf
jb 0x180004646
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1800046a4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r9, qword [rdx]
xor esi, esi
mov r8d, esi
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov r10, rdx
mov qword [rdx + 0x10], 7
mov rdi, rcx
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r9
shl rax, cl
movzx ebx, si
mov rcx, qword [r10 + 0x10]
xor r9, rax
mov rax, r9
mov r11b, sil
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r9, rax
mov rax, r9
shl rax, cl
xor r9, rax
movzx ecx, r11b
mov rdx, r9
shl ecx, 4
inc r11b
shr rdx, cl
xor bx, dx
cmp r11b, 4
jb 0x180004706
mov word [rdi + r8*2], bx
inc r8
cmp r8, 5
jb 0x1800046d9
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x180004740
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r9, qword [rdx]
xor esi, esi
mov r8d, esi
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov r10, rdx
mov qword [rdx + 0x10], 7
mov rdi, rcx
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r9
shl rax, cl
movzx ebx, si
mov rcx, qword [r10 + 0x10]
xor r9, rax
mov rax, r9
mov r11b, sil
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r9, rax
mov rax, r9
shl rax, cl
xor r9, rax
movzx ecx, r11b
mov rdx, r9
shl ecx, 4
inc r11b
shr rdx, cl
xor bx, dx
cmp r11b, 4
jb 0x1800047a2
mov word [rdi + r8*2], bx
inc r8
cmp r8, 0x14
jb 0x180004775
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x1800047dc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r9, qword [rdx]
xor esi, esi
mov r8d, esi
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov r10, rdx
mov qword [rdx + 0x10], 7
mov rdi, rcx
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r9
shl rax, cl
movzx ebx, si
mov rcx, qword [r10 + 0x10]
xor r9, rax
mov rax, r9
mov r11b, sil
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r9, rax
mov rax, r9
shl rax, cl
xor r9, rax
movzx ecx, r11b
mov rdx, r9
shl ecx, 4
inc r11b
shr rdx, cl
xor bx, dx
cmp r11b, 4
jb 0x18000483e
mov word [rdi + r8*2], bx
inc r8
cmp r8, 0x1d
jb 0x180004811
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x180004878
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r9, qword [rdx]
xor esi, esi
mov r8d, esi
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov r10, rdx
mov qword [rdx + 0x10], 7
mov rdi, rcx
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r9
shl rax, cl
movzx ebx, si
mov rcx, qword [r10 + 0x10]
xor r9, rax
mov rax, r9
mov r11b, sil
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r9, rax
mov rax, r9
shl rax, cl
xor r9, rax
movzx ecx, r11b
mov rdx, r9
shl ecx, 4
inc r11b
shr rdx, cl
xor bx, dx
cmp r11b, 4
jb 0x1800048da
mov word [rdi + r8*2], bx
inc r8
cmp r8, 0x1f
jb 0x1800048ad
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x180004914
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r9, qword [rdx]
xor esi, esi
mov r8d, esi
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov r10, rdx
mov qword [rdx + 0x10], 7
mov rdi, rcx
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r9
shl rax, cl
movzx ebx, si
mov rcx, qword [r10 + 0x10]
xor r9, rax
mov rax, r9
mov r11b, sil
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r9, rax
mov rax, r9
shl rax, cl
xor r9, rax
movzx ecx, r11b
mov rdx, r9
shl ecx, 4
inc r11b
shr rdx, cl
xor bx, dx
cmp r11b, 4
jb 0x180004976
mov word [rdi + r8*2], bx
inc r8
cmp r8, 0x3d
jb 0x180004949
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x1800049b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r9, qword [rdx]
xor esi, esi
mov r8d, esi
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov r10, rdx
mov qword [rdx + 0x10], 7
mov rdi, rcx
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r9
shl rax, cl
movzx ebx, si
mov rcx, qword [r10 + 0x10]
xor r9, rax
mov rax, r9
mov r11b, sil
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r9, rax
mov rax, r9
shl rax, cl
xor r9, rax
movzx ecx, r11b
mov rdx, r9
shl ecx, 4
inc r11b
shr rdx, cl
xor bx, dx
cmp r11b, 4
jb 0x180004a12
mov word [rdi + r8*2], bx
inc r8
cmp r8, 0x4c
jb 0x1800049e5
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x180004a4c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r9, qword [rdx]
xor esi, esi
mov r8d, esi
mov qword [rdx + 8], reloc.WS2_32.dll_listen
mov r10, rdx
mov qword [rdx + 0x10], 7
mov rdi, rcx
mov qword [rdx + 0x18], socket
mov rcx, qword [r10 + 8]
mov rax, r9
shl rax, cl
movzx ebx, si
mov rcx, qword [r10 + 0x10]
xor r9, rax
mov rax, r9
mov r11b, sil
shr rax, cl
mov rcx, qword [r10 + 0x18]
xor r9, rax
mov rax, r9
shl rax, cl
xor r9, rax
movzx ecx, r11b
mov rdx, r9
shl ecx, 4
inc r11b
shr rdx, cl
xor bx, dx
cmp r11b, 4
jb 0x180004aae
mov word [rdi + r8*2], bx
inc r8
cmp r8, 0xc
jb 0x180004a81
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret