joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180046fc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x10], r8b
je 0x180046ff4
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xf
jb 0x180046fe1
mov byte [rdx + 0x10], r8b
lea rcx, [rdx + 0xf]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004701d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180047030
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0xe], r8b
je 0x180047064
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xd
jb 0x180047051
mov byte [rdx + 0xe], r8b
lea rcx, [rdx + 0xd]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004708d
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800470a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0xc], r8b
je 0x1800470d4
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xb
jb 0x1800470c1
mov byte [rdx + 0xc], r8b
lea rcx, [rdx + 0xb]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800470fd
mov r8d, recv
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180047190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 7], r8b
je 0x1800471c4
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 6
jb 0x1800471b1
mov byte [rdx + 7], r8b
lea rcx, [rdx + 6]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800471ed
mov r8d, 6
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180047200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 4], r8b
je 0x180047234
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 3
jb 0x180047221
mov byte [rdx + 4], r8b
lea rcx, [rdx + 3]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004725d
mov r8d, 3
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180047270
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 8], r8b
je 0x1800472a4
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 7
jb 0x180047291
mov byte [rdx + 8], r8b
lea rcx, [rdx + 7]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800472cd
mov r8d, 7
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800472e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0xf], r8b
je 0x180047314
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xe
jb 0x180047301
mov byte [rdx + 0xf], r8b
lea rcx, [rdx + 0xe]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004733d
mov r8d, recv
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180047350
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x11], r8b
je 0x180047384
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x10
jb 0x180047371
mov byte [rdx + 0x11], r8b
lea rcx, [rdx + 0x10]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800473ad
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800473c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x17], r8b
je 0x1800473f4
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x16
jb 0x1800473e1
mov byte [rdx + 0x17], r8b
lea rcx, [rdx + 0x16]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004741d
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180047430
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x15], r8b
je 0x180047464
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x14
jb 0x180047451
mov byte [rdx + 0x15], r8b
lea rcx, [rdx + 0x14]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004748d
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800474a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x13], r8b
je 0x1800474d4
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x12
jb 0x1800474c1
mov byte [rdx + 0x13], r8b
lea rcx, [rdx + 0x12]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800474fd
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180047510
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0xd], r8b
je 0x180047544
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xc
jb 0x180047531
mov byte [rdx + 0xd], r8b
lea rcx, [rdx + 0xc]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004756d
mov r8d, recv
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180047580
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x12], r8b
je 0x1800475b4
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x11
jb 0x1800475a1
mov byte [rdx + 0x12], r8b
lea rcx, [rdx + 0x11]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800475dd
mov r8d, reloc.WS2_32.dll_recvfrom
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800475f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 3], r8b
je 0x180047624
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 2
jb 0x180047611
mov byte [rdx + 3], r8b
lea rcx, [rdx + 2]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004764d
mov r8d, 2
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180047660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x14], r8b
je 0x180047694
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x13
jb 0x180047681
mov byte [rdx + 0x14], r8b
lea rcx, [rdx + 0x13]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800476bd
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800476d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 6], r8b
je 0x180047704
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 5
jb 0x1800476f1
mov byte [rdx + 6], r8b
lea rcx, [rdx + 5]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004772d
mov r8d, 5
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180047740
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 5], r8b
je 0x180047774
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 4
jb 0x180047761
mov byte [rdx + 5], r8b
lea rcx, [rdx + 4]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004779d
mov r8d, 4
mov rcx, rbx
call fcn.180040f40
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180048260
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x180048293
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x180048280
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800482bd
mov r8d, 7
mov rcx, rbx
call fcn.180040f40
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 8], 0
je 0x1800482e3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 7
jb 0x1800482d0
mov byte [rdi + 8], 0
lea r9, [rdi + 7]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048311
mov r8d, 7
mov rdx, rdi
mov rcx, r10
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048320
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 7], sil
je 0x180048353
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 6
jb 0x180048340
mov byte [rdx + 7], sil
lea rax, [rdx + 6]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004837d
mov r8d, 6
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 5], 0
je 0x1800483a3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 4
jb 0x180048390
mov byte [rdi + 5], 0
lea r8, [rdi + 4]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800483d1
mov r8d, 4
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800483e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 8], r8b
je 0x180048414
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 7
jb 0x180048401
mov byte [rdx + 8], r8b
lea rax, [rdx + 7]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004843e
mov r8d, 7
mov rcx, rbx
call fcn.180040f40
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001e5d0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1800484b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 7], sil
je 0x1800484e3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 6
jb 0x1800484d0
mov byte [rdx + 7], sil
lea rax, [rdx + 6]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004850d
mov r8d, 6
mov rcx, rbx
call fcn.180040f40
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 7], 0
je 0x180048533
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x180048520
mov byte [rdi + 7], 0
lea r9, [rdi + 6]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048561
mov r8d, 6
mov rdx, rdi
mov rcx, r10
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048570
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x1800485a3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180048590
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800485cd
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x16], 0
je 0x1800485f3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x15
jb 0x1800485e0
mov byte [rdi + 0x16], 0
lea r8, [rdi + 0x15]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048621
mov r8d, reloc.WS2_32.dll_setsockopt
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048630
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xf], sil
je 0x180048663
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xe
jb 0x180048650
mov byte [rdx + 0xf], sil
lea rax, [rdx + 0xe]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004868d
mov r8d, recv
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x1800486b3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x1800486a0
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800486e1
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800486f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180048723
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180048710
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004874d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x14], 0
je 0x180048773
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x13
jb 0x180048760
mov byte [rdi + 0x14], 0
lea r8, [rdi + 0x13]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800487a1
mov r8d, reloc.WS2_32.dll_send
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800487b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x1800487e3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x1800487d0
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004880d
mov r8d, 5
mov rcx, rbx
call fcn.180040f40
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 6], 0
je 0x180048833
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 5
jb 0x180048820
mov byte [rdi + 6], 0
lea r9, [rdi + 5]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048861
mov r8d, 5
mov rdx, rdi
mov rcx, r10
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048870
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x1800488a3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180048890
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800488cd
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x1800488f3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x1800488e0
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048921
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048930
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 5], sil
je 0x180048963
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 4
jb 0x180048950
mov byte [rdx + 5], sil
lea rax, [rdx + 4]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004898d
mov r8d, 4
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x1800489b3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x1800489a0
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800489e1
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret