joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180048c00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xe], sil
je 0x180048c33
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x180048c20
mov byte [rdx + 0xe], sil
lea rax, [rdx + 0xd]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048c5d
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180040990
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0xe], 0
je 0x180048c83
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x180048c70
mov byte [rdi + 0xe], 0
lea r9, [rdi + 0xd]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048cb1
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r10
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e2b0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 8], dl
je 0x180048d12
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 3]
xor byte [rax + rbx], cl
inc rax
cmp rax, 7
jb 0x180048d00
mov byte [rbx + 8], dl
lea r8, [rbx + 7]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x180048d3f
mov r8d, 7
mov rdx, rbx
mov rcx, r9
call fcn.180040990
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180048d50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x15], sil
je 0x180048d83
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x14
jb 0x180048d70
mov byte [rdx + 0x15], sil
lea rax, [rdx + 0x14]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048dad
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.180040990
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0x15], 0
je 0x180048dd3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x14
jb 0x180048dc0
mov byte [rdi + 0x15], 0
lea r9, [rdi + 0x14]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048e01
mov r8d, reloc.WS2_32.dll_sendto
mov rdx, rdi
mov rcx, r10
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048e10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x180048e43
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x180048e30
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048e6d
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x180048e93
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x180048e80
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048ec1
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048ed0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1b], r8b
je 0x180048f04
mov eax, r8d
lea ecx, [rax - 3]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1a
jb 0x180048ef1
mov byte [rdx + 0x1b], r8b
lea rax, [rdx + 0x1a]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x180048f2e
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040990
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003be30
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180048f50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180048f83
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180048f70
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048fad
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x180048fd3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x180048fc0
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049001
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049010
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1c], sil
je 0x180049043
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1b
jb 0x180049030
mov byte [rdx + 0x1c], sil
lea rax, [rdx + 0x1b]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004906d
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x20], 0
je 0x180049093
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1f
jb 0x180049080
mov byte [rdi + 0x20], 0
lea r8, [rdi + 0x1f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800490c1
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800490d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x17], sil
je 0x180049103
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x16
jb 0x1800490f0
mov byte [rdx + 0x17], sil
lea rax, [rdx + 0x16]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004912d
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x19], 0
je 0x180049153
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x18
jb 0x180049140
mov byte [rdi + 0x19], 0
lea r8, [rdi + 0x18]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049181
mov r8d, Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049190
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x27], sil
je 0x1800491c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x26
jb 0x1800491b0
mov byte [rdx + 0x27], sil
lea rax, [rdx + 0x26]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800491ed
mov r8d, Ordinal_41
mov rcx, rbx
call fcn.180040990
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0x27], 0
je 0x180049213
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x26
jb 0x180049200
mov byte [rdi + 0x27], 0
lea r9, [rdi + 0x26]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180049241
mov r8d, Ordinal_41
mov rdx, rdi
mov rcx, r10
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049250
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x26], r8b
je 0x180049284
mov eax, r8d
lea ecx, [rax - 3]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x25
jb 0x180049271
mov byte [rdx + 0x26], r8b
lea rax, [rdx + 0x25]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x1800492ae
mov r8d, Ordinal_41
mov rcx, rbx
call fcn.180040990
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003ac20
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1800492d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x180049303
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1800492f0
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004932d
mov r8d, 0xa
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x180049353
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180049340
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049381
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049390
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xd], sil
je 0x1800493c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x1800493b0
mov byte [rdx + 0xd], sil
lea rax, [rdx + 0xc]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800493ed
mov r8d, recv
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0xe], 0
je 0x180049413
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x180049400
mov byte [rdi + 0xe], 0
lea r8, [rdi + 0xd]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049441
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049450
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x180049483
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x180049470
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800494ad
mov r8d, 0xa
mov rcx, rbx
call fcn.180040990
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0xb], 0
je 0x1800494d3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xa
jb 0x1800494c0
mov byte [rdi + 0xb], 0
lea r9, [rdi + 0xa]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180049501
mov r8d, 0xa
mov rdx, rdi
mov rcx, r10
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049510
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x180049543
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x180049530
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004956d
mov r8d, 7
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x14], 0
je 0x180049593
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x13
jb 0x180049580
mov byte [rdi + 0x14], 0
lea r8, [rdi + 0x13]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800495c1
mov r8d, reloc.WS2_32.dll_send
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800495d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1a], sil
je 0x180049603
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x19
jb 0x1800495f0
mov byte [rdx + 0x1a], sil
lea rax, [rdx + 0x19]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004962d
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x180049653
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x180049640
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049681
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049690
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x16], sil
je 0x1800496c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x1800496b0
mov byte [rdx + 0x16], sil
lea rax, [rdx + 0x15]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800496ed
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x180049713
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x180049700
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049741
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049750
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x180049783
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x180049770
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800497ad
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040990
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0x11], 0
je 0x1800497d3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x1800497c0
mov byte [rdi + 0x11], 0
lea r9, [rdi + 0x10]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180049801
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r10
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049810
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x32], sil
je 0x180049843
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x31
jb 0x180049830
mov byte [rdx + 0x32], sil
lea rax, [rdx + 0x31]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004986d
mov r8d, Ordinal_50
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x30], 0
je 0x180049893
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x2f
jb 0x180049880
mov byte [rdi + 0x30], 0
lea r8, [rdi + 0x2f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800498c1
mov r8d, Ordinal_50
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800498d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180049903
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1800498f0
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004992d
mov r8d, recv
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x180049953
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180049940
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049981
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1b], r8b
je 0x1800499c4
mov eax, r8d
lea ecx, [rax - 3]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1a
jb 0x1800499b1
mov byte [rdx + 0x1b], r8b
lea rax, [rdx + 0x1a]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x1800499ee
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040990
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.1800516e0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180049a10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xd], sil
je 0x180049a43
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x180049a30
mov byte [rdx + 0xd], sil
lea rax, [rdx + 0xc]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049a6d
mov r8d, recv
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x15], 0
je 0x180049a93
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x14
jb 0x180049a80
mov byte [rdi + 0x15], 0
lea r8, [rdi + 0x14]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049ac1
mov r8d, reloc.WS2_32.dll_sendto
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049ad0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1e], r8b
je 0x180049b04
mov eax, r8d
lea ecx, [rax - 3]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1d
jb 0x180049af1
mov byte [rdx + 0x1e], r8b
lea rax, [rdx + 0x1d]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x180049b2e
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040990
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.1800513f0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180049b50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1b], sil
je 0x180049b83
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1a
jb 0x180049b70
mov byte [rdx + 0x1b], sil
lea rax, [rdx + 0x1a]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049bad
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x180049bd3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x180049bc0
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049c01
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049c10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x20], r8b
je 0x180049c44
mov eax, r8d
lea ecx, [rax - 3]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1f
jb 0x180049c31
mov byte [rdx + 0x20], r8b
lea rax, [rdx + 0x1f]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x180049c6e
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040990
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003be30
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret