joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003e100
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 0x13], dl
je 0x18003e144
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 0x12
jb 0x18003e130
mov byte [r8 + 0x13], dl
add r8, 0x12
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e170
mov r8d, reloc.WS2_32.dll_select
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e180
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 0xc], dl
je 0x18003e1c4
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 0xb
jb 0x18003e1b0
mov byte [r8 + 0xc], dl
add r8, 0xb
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e1f0
mov r8d, recv
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e200
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 7], dl
je 0x18003e244
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 6
jb 0x18003e230
mov byte [r8 + 7], dl
add r8, 6
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e270
mov r8d, 6
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e280
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 0xa], dl
je 0x18003e2c4
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 9
jb 0x18003e2b0
mov byte [r8 + 0xa], dl
add r8, 9
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e2f0
mov r8d, 9
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x18003e300
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 8], dl
je 0x18003e344
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 7
jb 0x18003e330
mov byte [r8 + 8], dl
add r8, 7
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e370
mov r8d, 7
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e380
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 4], dl
je 0x18003e3c4
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 3
jb 0x18003e3b0
mov byte [r8 + 4], dl
add r8, 3
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e3f0
mov r8d, 3
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e400
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 0xe], dl
je 0x18003e444
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 0xd
jb 0x18003e430
mov byte [r8 + 0xe], dl
add r8, 0xd
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e470
mov r8d, reloc.WS2_32.dll_listen
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e480
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 0xd], dl
je 0x18003e4c4
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 0xc
jb 0x18003e4b0
mov byte [r8 + 0xd], dl
add r8, 0xc
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e4f0
mov r8d, recv
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x18003e500
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r11, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r10, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r11
cmp byte [r8 + 0x10], dl
je 0x18003e544
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 0xf
jb 0x18003e530
mov byte [r8 + 0x10], dl
lea r9, [r8 + 0xf]
mov qword [r11], rdx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r11], dl
cmp r10, r9
je 0x18003e570
mov r8d, reloc.WS2_32.dll_ntohs
mov rdx, r10
mov rcx, r11
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e580
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 0x14], dl
je 0x18003e5c4
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 0x13
jb 0x18003e5b0
mov byte [r8 + 0x14], dl
add r8, 0x13
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e5f0
mov r8d, reloc.WS2_32.dll_send
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e600
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 9], dl
je 0x18003e644
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 8
jb 0x18003e630
mov byte [r8 + 9], dl
add r8, 8
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e670
mov r8d, 8
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e680
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 0xb], dl
je 0x18003e6c4
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 0xa
jb 0x18003e6b0
mov byte [r8 + 0xb], dl
add r8, 0xa
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e6f0
mov r8d, 0xa
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x18003e700
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 0xf], dl
je 0x18003e744
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 0xe
jb 0x18003e730
mov byte [r8 + 0xf], dl
add r8, 0xe
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e770
mov r8d, recv
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e780
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 0x11], dl
je 0x18003e7c4
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 0x10
jb 0x18003e7b0
mov byte [r8 + 0x11], dl
add r8, 0x10
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e7f0
mov r8d, reloc.WS2_32.dll_recv
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e800
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 0x16], dl
je 0x18003e844
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 0x15
jb 0x18003e830
mov byte [r8 + 0x16], dl
add r8, 0x15
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e870
mov r8d, reloc.WS2_32.dll_setsockopt
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e880
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 0x15], dl
je 0x18003e8c4
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 0x14
jb 0x18003e8b0
mov byte [r8 + 0x15], dl
add r8, 0x14
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e8f0
mov r8d, reloc.WS2_32.dll_sendto
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x18003e900
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 0x17], dl
je 0x18003e944
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 0x16
jb 0x18003e930
mov byte [r8 + 0x17], dl
add r8, 0x16
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e970
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003e980
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
lea r10, [rcx + 8]
xor edx, edx
mov dword [rcx], eax
mov r9, r8
mov qword [rsp + 0x20], rcx
mov rbx, rcx
mov qword [rsp + 0x20], r10
cmp byte [r8 + 6], dl
je 0x18003e9c4
mov eax, edx
nop dword [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rax + r8], cl
inc rax
cmp rax, 5
jb 0x18003e9b0
mov byte [r8 + 6], dl
add r8, 5
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp r9, r8
je 0x18003e9f0
mov r8d, 5
mov rdx, r9
mov rcx, r10
call fcn.180038d80
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18003ea00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0xb], r8b
je 0x18003ea34
mov eax, r8d
lea ecx, [rax - 0x35]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xa
jb 0x18003ea21
mov byte [rdx + 0xb], r8b
lea rcx, [rdx + 0xa]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003ea5d
mov r8d, 0xa
mov rcx, rbx
call fcn.180038d80
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18003ea70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 9], r8b
je 0x18003eaa4
mov eax, r8d
lea ecx, [rax - 0x35]
xor byte [rax + rdx], cl
inc rax
cmp rax, 8
jb 0x18003ea91
mov byte [rdx + 9], r8b
lea rcx, [rdx + 8]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003eacd
mov r8d, 8
mov rcx, rbx
call fcn.180038d80
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18003eae0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x10], r8b
je 0x18003eb14
mov eax, r8d
lea ecx, [rax - 0x35]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xf
jb 0x18003eb01
mov byte [rdx + 0x10], r8b
lea rcx, [rdx + 0xf]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003eb3d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180038d80
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18003eb50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0xe], r8b
je 0x18003eb84
mov eax, r8d
lea ecx, [rax - 0x35]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xd
jb 0x18003eb71
mov byte [rdx + 0xe], r8b
lea rcx, [rdx + 0xd]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003ebad
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180038d80
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18003ebc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0xc], r8b
je 0x18003ebf4
mov eax, r8d
lea ecx, [rax - 0x35]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xb
jb 0x18003ebe1
mov byte [rdx + 0xc], r8b
lea rcx, [rdx + 0xb]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003ec1d
mov r8d, recv
mov rcx, rbx
call fcn.180038d80
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18003ec30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0xa], r8b
je 0x18003ec64
mov eax, r8d
lea ecx, [rax - 0x35]
xor byte [rax + rdx], cl
inc rax
cmp rax, 9
jb 0x18003ec51
mov byte [rdx + 0xa], r8b
lea rcx, [rdx + 9]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003ec8d
mov r8d, 9
mov rcx, rbx
call fcn.180038d80
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18003ece0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 7], r8b
je 0x18003ed14
mov eax, r8d
lea ecx, [rax - 0x35]
xor byte [rax + rdx], cl
inc rax
cmp rax, 6
jb 0x18003ed01
mov byte [rdx + 7], r8b
lea rcx, [rdx + 6]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003ed3d
mov r8d, 6
mov rcx, rbx
call fcn.180038d80
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18003ed50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 4], r8b
je 0x18003ed84
mov eax, r8d
lea ecx, [rax - 0x35]
xor byte [rax + rdx], cl
inc rax
cmp rax, 3
jb 0x18003ed71
mov byte [rdx + 4], r8b
lea rcx, [rdx + 3]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003edad
mov r8d, 3
mov rcx, rbx
call fcn.180038d80
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18003edc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 8], r8b
je 0x18003edf4
mov eax, r8d
lea ecx, [rax - 0x35]
xor byte [rax + rdx], cl
inc rax
cmp rax, 7
jb 0x18003ede1
mov byte [rdx + 8], r8b
lea rcx, [rdx + 7]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003ee1d
mov r8d, 7
mov rcx, rbx
call fcn.180038d80
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18003ee30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0xf], r8b
je 0x18003ee64
mov eax, r8d
lea ecx, [rax - 0x35]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xe
jb 0x18003ee51
mov byte [rdx + 0xf], r8b
lea rcx, [rdx + 0xe]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003ee8d
mov r8d, recv
mov rcx, rbx
call fcn.180038d80
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18003eea0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x11], r8b
je 0x18003eed4
mov eax, r8d
lea ecx, [rax - 0x35]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x10
jb 0x18003eec1
mov byte [rdx + 0x11], r8b
lea rcx, [rdx + 0x10]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003eefd
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180038d80
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18003ef10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x17], r8b
je 0x18003ef44
mov eax, r8d
lea ecx, [rax - 0x35]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x16
jb 0x18003ef31
mov byte [rdx + 0x17], r8b
lea rcx, [rdx + 0x16]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003ef6d
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180038d80
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18003ef80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x15], r8b
je 0x18003efb4
mov eax, r8d
lea ecx, [rax - 0x35]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x14
jb 0x18003efa1
mov byte [rdx + 0x15], r8b
lea rcx, [rdx + 0x14]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003efdd
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.180038d80
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18003eff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x13], r8b
je 0x18003f024
mov eax, r8d
lea ecx, [rax - 0x35]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x12
jb 0x18003f011
mov byte [rdx + 0x13], r8b
lea rcx, [rdx + 0x12]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18003f04d
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180038d80
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret