joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180047080
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x13], r8b
je 0x1800470b4
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x12
jb 0x1800470a1
mov byte [rdx + 0x13], r8b
lea rcx, [rdx + 0x12]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800470dd
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180040b10
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800470f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0xd], r8b
je 0x180047124
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xc
jb 0x180047111
mov byte [rdx + 0xd], r8b
lea rcx, [rdx + 0xc]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004714d
mov r8d, recv
mov rcx, rbx
call fcn.180040b10
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180047160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x12], r8b
je 0x180047194
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x11
jb 0x180047181
mov byte [rdx + 0x12], r8b
lea rcx, [rdx + 0x11]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800471bd
mov r8d, reloc.WS2_32.dll_recvfrom
mov rcx, rbx
call fcn.180040b10
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800471d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 3], r8b
je 0x180047204
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 2
jb 0x1800471f1
mov byte [rdx + 3], r8b
lea rcx, [rdx + 2]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004722d
mov r8d, 2
mov rcx, rbx
call fcn.180040b10
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180047240
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x14], r8b
je 0x180047274
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x13
jb 0x180047261
mov byte [rdx + 0x14], r8b
lea rcx, [rdx + 0x13]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004729d
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180040b10
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800472b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 6], r8b
je 0x1800472e4
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 5
jb 0x1800472d1
mov byte [rdx + 6], r8b
lea rcx, [rdx + 5]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004730d
mov r8d, 5
mov rcx, rbx
call fcn.180040b10
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180047320
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 5], r8b
je 0x180047354
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 4
jb 0x180047341
mov byte [rdx + 5], r8b
lea rcx, [rdx + 4]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004737d
mov r8d, 4
mov rcx, rbx
call fcn.180040b10
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180047e40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x180047e73
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x180047e60
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180047e9d
mov r8d, 7
mov rcx, rbx
call fcn.180040b10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 8], 0
je 0x180047ec3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 7
jb 0x180047eb0
mov byte [rdi + 8], 0
lea r9, [rdi + 7]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180047ef1
mov r8d, 7
mov rdx, rdi
mov rcx, r10
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180047f00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 7], sil
je 0x180047f33
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 6
jb 0x180047f20
mov byte [rdx + 7], sil
lea rax, [rdx + 6]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180047f5d
mov r8d, 6
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 5], 0
je 0x180047f83
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 4
jb 0x180047f70
mov byte [rdi + 5], 0
lea r8, [rdi + 4]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180047fb1
mov r8d, 4
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180047fc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 8], r8b
je 0x180047ff4
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 7
jb 0x180047fe1
mov byte [rdx + 8], r8b
lea rax, [rdx + 7]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004801e
mov r8d, 7
mov rcx, rbx
call fcn.180040b10
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001e320
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180048090
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 7], sil
je 0x1800480c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 6
jb 0x1800480b0
mov byte [rdx + 7], sil
lea rax, [rdx + 6]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800480ed
mov r8d, 6
mov rcx, rbx
call fcn.180040b10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 7], 0
je 0x180048113
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x180048100
mov byte [rdi + 7], 0
lea r9, [rdi + 6]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048141
mov r8d, 6
mov rdx, rdi
mov rcx, r10
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048150
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180048183
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180048170
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800481ad
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x16], 0
je 0x1800481d3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x15
jb 0x1800481c0
mov byte [rdi + 0x16], 0
lea r8, [rdi + 0x15]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048201
mov r8d, reloc.WS2_32.dll_setsockopt
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048210
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xf], sil
je 0x180048243
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xe
jb 0x180048230
mov byte [rdx + 0xf], sil
lea rax, [rdx + 0xe]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004826d
mov r8d, recv
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x180048293
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180048280
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800482c1
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800482d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180048303
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x1800482f0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004832d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x14], 0
je 0x180048353
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x13
jb 0x180048340
mov byte [rdi + 0x14], 0
lea r8, [rdi + 0x13]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048381
mov r8d, reloc.WS2_32.dll_send
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048390
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x1800483c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x1800483b0
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800483ed
mov r8d, 5
mov rcx, rbx
call fcn.180040b10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 6], 0
je 0x180048413
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 5
jb 0x180048400
mov byte [rdi + 6], 0
lea r9, [rdi + 5]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048441
mov r8d, 5
mov rdx, rdi
mov rcx, r10
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048450
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180048483
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180048470
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800484ad
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x1800484d3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x1800484c0
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048501
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048510
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 5], sil
je 0x180048543
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 4
jb 0x180048530
mov byte [rdx + 5], sil
lea rax, [rdx + 4]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004856d
mov r8d, 4
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x180048593
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x180048580
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800485c1
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800485d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180048603
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1800485f0
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004862d
mov r8d, recv
mov rcx, rbx
call fcn.180040b10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0xc], 0
je 0x180048653
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xb
jb 0x180048640
mov byte [rdi + 0xc], 0
lea r9, [rdi + 0xb]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048681
mov r8d, recv
mov rdx, rdi
mov rcx, r10
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048690
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e320
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xd], dl
je 0x1800486e2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x70]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xc
jb 0x1800486d0
mov byte [rbx + 0xd], dl
lea r8, [rbx + 0xc]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004870f
mov r8d, recv
mov rdx, rbx
mov rcx, r9
call fcn.180040b10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180048720
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x180048753
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x180048740
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004877d
mov r8d, 7
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 6], 0
je 0x1800487a3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 5
jb 0x180048790
mov byte [rdi + 6], 0
lea r8, [rdi + 5]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800487d1
mov r8d, 5
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800487e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 5], sil
je 0x180048813
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 4
jb 0x180048800
mov byte [rdx + 5], sil
lea rax, [rdx + 4]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004883d
mov r8d, 4
mov rcx, rbx
call fcn.180040b10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 5], 0
je 0x180048863
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 4
jb 0x180048850
mov byte [rdi + 5], 0
lea r9, [rdi + 4]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048891
mov r8d, 4
mov rdx, rdi
mov rcx, r10
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800488a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e320
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xb], dl
je 0x1800488f2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x70]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xa
jb 0x1800488e0
mov byte [rbx + 0xb], dl
lea r8, [rbx + 0xa]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004891f
mov r8d, 0xa
mov rdx, rbx
mov rcx, r9
call fcn.180040b10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180048930
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180048963
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180048950
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004898d
mov r8d, recv
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x1800489b3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x1800489a0
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800489e1
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800489f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x18], sil
je 0x180048a23
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x17
jb 0x180048a10
mov byte [rdx + 0x18], sil
lea rax, [rdx + 0x17]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048a4d
mov r8d, reloc.WS2_32.dll_socket
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1e], 0
je 0x180048a73
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1d
jb 0x180048a60
mov byte [rdi + 0x1e], 0
lea r8, [rdi + 0x1d]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048aa1
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048ab0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1a], sil
je 0x180048ae3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x19
jb 0x180048ad0
mov byte [rdx + 0x1a], sil
lea rax, [rdx + 0x19]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048b0d
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x20], 0
je 0x180048b33
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1f
jb 0x180048b20
mov byte [rdi + 0x20], 0
lea r8, [rdi + 0x1f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048b61
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048b70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov rdx, rcx
mov rcx, rax
call fcn.180051570
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x30], r9
xor edx, edx
cmp byte [rbx + 0x1f], dl
je 0x180048bc2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x70]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0x1e
jb 0x180048bb0
mov byte [rbx + 0x1f], dl
lea r8, [rbx + 0x1e]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x180048bef
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov rdx, rbx
mov rcx, r9
call fcn.180040b10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret