joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180047fd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180048003
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180047ff0
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004802d
mov r8d, recv
mov rcx, rbx
call fcn.180040510
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0xc], 0
je 0x180048053
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xb
jb 0x180048040
mov byte [rdi + 0xc], 0
lea r9, [rdi + 0xb]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048081
mov r8d, recv
mov rdx, rdi
mov rcx, r10
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048090
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e130
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xd], dl
je 0x1800480e2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x2b]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xc
jb 0x1800480d0
mov byte [rbx + 0xd], dl
lea r8, [rbx + 0xc]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004810f
mov r8d, recv
mov rdx, rbx
mov rcx, r9
call fcn.180040510
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180048120
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x180048153
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x180048140
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004817d
mov r8d, 7
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 6], 0
je 0x1800481a3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 5
jb 0x180048190
mov byte [rdi + 6], 0
lea r8, [rdi + 5]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800481d1
mov r8d, 5
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800481e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 5], sil
je 0x180048213
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 4
jb 0x180048200
mov byte [rdx + 5], sil
lea rax, [rdx + 4]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004823d
mov r8d, 4
mov rcx, rbx
call fcn.180040510
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 5], 0
je 0x180048263
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 4
jb 0x180048250
mov byte [rdi + 5], 0
lea r9, [rdi + 4]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048291
mov r8d, 4
mov rdx, rdi
mov rcx, r10
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800482a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e130
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xb], dl
je 0x1800482f2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x2b]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xa
jb 0x1800482e0
mov byte [rbx + 0xb], dl
lea r8, [rbx + 0xa]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004831f
mov r8d, 0xa
mov rdx, rbx
mov rcx, r9
call fcn.180040510
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180048330
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180048363
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180048350
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004838d
mov r8d, recv
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x1800483b3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x1800483a0
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800483e1
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800483f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x18], sil
je 0x180048423
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x17
jb 0x180048410
mov byte [rdx + 0x18], sil
lea rax, [rdx + 0x17]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004844d
mov r8d, reloc.WS2_32.dll_socket
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1e], 0
je 0x180048473
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1d
jb 0x180048460
mov byte [rdi + 0x1e], 0
lea r8, [rdi + 0x1d]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800484a1
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800484b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1a], sil
je 0x1800484e3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x19
jb 0x1800484d0
mov byte [rdx + 0x1a], sil
lea rax, [rdx + 0x19]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004850d
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x20], 0
je 0x180048533
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1f
jb 0x180048520
mov byte [rdi + 0x20], 0
lea r8, [rdi + 0x1f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048561
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov rdx, rcx
mov rcx, rax
call fcn.180050f70
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x30], r9
xor edx, edx
cmp byte [rbx + 0x1f], dl
je 0x1800485c2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x2b]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0x1e
jb 0x1800485b0
mov byte [rbx + 0x1f], dl
lea r8, [rbx + 0x1e]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x1800485ef
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov rdx, rbx
mov rcx, r9
call fcn.180040510
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180048600
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180048633
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180048620
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004865d
mov r8d, recv
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0xe], 0
je 0x180048683
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x180048670
mov byte [rdi + 0xe], 0
lea r8, [rdi + 0xd]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800486b1
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800486c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1b], sil
je 0x1800486f3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1a
jb 0x1800486e0
mov byte [rdx + 0x1b], sil
lea rax, [rdx + 0x1a]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004871d
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x25], 0
je 0x180048743
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x24
jb 0x180048730
mov byte [rdi + 0x25], 0
lea r8, [rdi + 0x24]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048771
mov r8d, Ordinal_41
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048780
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xe], sil
je 0x1800487b3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x1800487a0
mov byte [rdx + 0xe], sil
lea rax, [rdx + 0xd]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800487dd
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180040510
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0xe], 0
je 0x180048803
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x1800487f0
mov byte [rdi + 0xe], 0
lea r9, [rdi + 0xd]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048831
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r10
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048840
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e130
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 8], dl
je 0x180048892
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x2b]
xor byte [rax + rbx], cl
inc rax
cmp rax, 7
jb 0x180048880
mov byte [rbx + 8], dl
lea r8, [rbx + 7]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x1800488bf
mov r8d, 7
mov rdx, rbx
mov rcx, r9
call fcn.180040510
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1800488d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x15], sil
je 0x180048903
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x14
jb 0x1800488f0
mov byte [rdx + 0x15], sil
lea rax, [rdx + 0x14]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004892d
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.180040510
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0x15], 0
je 0x180048953
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x14
jb 0x180048940
mov byte [rdi + 0x15], 0
lea r9, [rdi + 0x14]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048981
mov r8d, reloc.WS2_32.dll_sendto
mov rdx, rdi
mov rcx, r10
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048990
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x1800489c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x1800489b0
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800489ed
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x180048a13
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x180048a00
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048a41
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048a50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1b], r8b
je 0x180048a84
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1a
jb 0x180048a71
mov byte [rdx + 0x1b], r8b
lea rax, [rdx + 0x1a]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x180048aae
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040510
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003b9b0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180048ad0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180048b03
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180048af0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048b2d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x180048b53
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x180048b40
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048b81
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048b90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1c], sil
je 0x180048bc3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1b
jb 0x180048bb0
mov byte [rdx + 0x1c], sil
lea rax, [rdx + 0x1b]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048bed
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x20], 0
je 0x180048c13
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1f
jb 0x180048c00
mov byte [rdi + 0x20], 0
lea r8, [rdi + 0x1f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048c41
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048c50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x17], sil
je 0x180048c83
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x16
jb 0x180048c70
mov byte [rdx + 0x17], sil
lea rax, [rdx + 0x16]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048cad
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x19], 0
je 0x180048cd3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x18
jb 0x180048cc0
mov byte [rdi + 0x19], 0
lea r8, [rdi + 0x18]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048d01
mov r8d, Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048d10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x27], sil
je 0x180048d43
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x26
jb 0x180048d30
mov byte [rdx + 0x27], sil
lea rax, [rdx + 0x26]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048d6d
mov r8d, Ordinal_41
mov rcx, rbx
call fcn.180040510
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0x27], 0
je 0x180048d93
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x26
jb 0x180048d80
mov byte [rdi + 0x27], 0
lea r9, [rdi + 0x26]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048dc1
mov r8d, Ordinal_41
mov rdx, rdi
mov rcx, r10
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048dd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x26], r8b
je 0x180048e04
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x25
jb 0x180048df1
mov byte [rdx + 0x26], r8b
lea rax, [rdx + 0x25]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x180048e2e
mov r8d, Ordinal_41
mov rcx, rbx
call fcn.180040510
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003a7a0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180048e50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x180048e83
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x180048e70
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048ead
mov r8d, 0xa
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x180048ed3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180048ec0
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048f01
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048f10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xd], sil
je 0x180048f43
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x180048f30
mov byte [rdx + 0xd], sil
lea rax, [rdx + 0xc]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048f6d
mov r8d, recv
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0xe], 0
je 0x180048f93
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x180048f80
mov byte [rdi + 0xe], 0
lea r8, [rdi + 0xd]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048fc1
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048fd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x180049003
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x180048ff0
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004902d
mov r8d, 0xa
mov rcx, rbx
call fcn.180040510
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0xb], 0
je 0x180049053
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xa
jb 0x180049040
mov byte [rdi + 0xb], 0
lea r9, [rdi + 0xa]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180049081
mov r8d, 0xa
mov rdx, rdi
mov rcx, r10
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret