joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180048f80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xe], sil
je 0x180048fb3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x180048fa0
mov byte [rdx + 0xe], sil
lea rax, [rdx + 0xd]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048fdd
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180040d10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0xe], 0
je 0x180049003
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x180048ff0
mov byte [rdi + 0xe], 0
lea r9, [rdi + 0xd]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180049031
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r10
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e3e0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 8], dl
je 0x180049092
mov eax, edx
nop word [rax + rax]
lea ecx, [rax + 0x33]
xor byte [rax + rbx], cl
inc rax
cmp rax, 7
jb 0x180049080
mov byte [rbx + 8], dl
lea r8, [rbx + 7]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x1800490bf
mov r8d, 7
mov rdx, rbx
mov rcx, r9
call fcn.180040d10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1800490d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x15], sil
je 0x180049103
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x14
jb 0x1800490f0
mov byte [rdx + 0x15], sil
lea rax, [rdx + 0x14]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004912d
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.180040d10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0x15], 0
je 0x180049153
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x14
jb 0x180049140
mov byte [rdi + 0x15], 0
lea r9, [rdi + 0x14]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180049181
mov r8d, reloc.WS2_32.dll_sendto
mov rdx, rdi
mov rcx, r10
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049190
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x1800491c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x1800491b0
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800491ed
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x180049213
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x180049200
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049241
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049250
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1b], r8b
je 0x180049284
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1a
jb 0x180049271
mov byte [rdx + 0x1b], r8b
lea rax, [rdx + 0x1a]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x1800492ae
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040d10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003c220
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1800492d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180049303
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x1800492f0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004932d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x180049353
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x180049340
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049381
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049390
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1c], sil
je 0x1800493c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1b
jb 0x1800493b0
mov byte [rdx + 0x1c], sil
lea rax, [rdx + 0x1b]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800493ed
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x20], 0
je 0x180049413
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1f
jb 0x180049400
mov byte [rdi + 0x20], 0
lea r8, [rdi + 0x1f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049441
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049450
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x17], sil
je 0x180049483
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x16
jb 0x180049470
mov byte [rdx + 0x17], sil
lea rax, [rdx + 0x16]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800494ad
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x19], 0
je 0x1800494d3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x18
jb 0x1800494c0
mov byte [rdi + 0x19], 0
lea r8, [rdi + 0x18]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049501
mov r8d, Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049510
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x27], sil
je 0x180049543
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x26
jb 0x180049530
mov byte [rdx + 0x27], sil
lea rax, [rdx + 0x26]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004956d
mov r8d, Ordinal_41
mov rcx, rbx
call fcn.180040d10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0x27], 0
je 0x180049593
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x26
jb 0x180049580
mov byte [rdi + 0x27], 0
lea r9, [rdi + 0x26]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x1800495c1
mov r8d, Ordinal_41
mov rdx, rdi
mov rcx, r10
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800495d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x26], r8b
je 0x180049604
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x25
jb 0x1800495f1
mov byte [rdx + 0x26], r8b
lea rax, [rdx + 0x25]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004962e
mov r8d, Ordinal_41
mov rcx, rbx
call fcn.180040d10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003b010
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180049650
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x180049683
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x180049670
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800496ad
mov r8d, 0xa
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x1800496d3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x1800496c0
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049701
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049710
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xd], sil
je 0x180049743
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x180049730
mov byte [rdx + 0xd], sil
lea rax, [rdx + 0xc]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004976d
mov r8d, recv
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0xe], 0
je 0x180049793
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x180049780
mov byte [rdi + 0xe], 0
lea r8, [rdi + 0xd]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800497c1
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800497d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x180049803
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1800497f0
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004982d
mov r8d, 0xa
mov rcx, rbx
call fcn.180040d10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0xb], 0
je 0x180049853
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xa
jb 0x180049840
mov byte [rdi + 0xb], 0
lea r9, [rdi + 0xa]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180049881
mov r8d, 0xa
mov rdx, rdi
mov rcx, r10
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049890
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x1800498c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x1800498b0
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800498ed
mov r8d, 7
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x14], 0
je 0x180049913
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x13
jb 0x180049900
mov byte [rdi + 0x14], 0
lea r8, [rdi + 0x13]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049941
mov r8d, reloc.WS2_32.dll_send
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049950
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1a], sil
je 0x180049983
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x19
jb 0x180049970
mov byte [rdx + 0x1a], sil
lea rax, [rdx + 0x19]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800499ad
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x1800499d3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x1800499c0
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049a01
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049a10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x16], sil
je 0x180049a43
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x180049a30
mov byte [rdx + 0x16], sil
lea rax, [rdx + 0x15]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049a6d
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x180049a93
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x180049a80
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049ac1
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049ad0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x180049b03
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x180049af0
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049b2d
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040d10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0x11], 0
je 0x180049b53
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180049b40
mov byte [rdi + 0x11], 0
lea r9, [rdi + 0x10]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180049b81
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r10
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049b90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x32], sil
je 0x180049bc3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x31
jb 0x180049bb0
mov byte [rdx + 0x32], sil
lea rax, [rdx + 0x31]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049bed
mov r8d, Ordinal_50
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x30], 0
je 0x180049c13
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x2f
jb 0x180049c00
mov byte [rdi + 0x30], 0
lea r8, [rdi + 0x2f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049c41
mov r8d, Ordinal_50
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049c50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180049c83
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180049c70
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049cad
mov r8d, recv
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x180049cd3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180049cc0
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049d01
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049d10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1b], r8b
je 0x180049d44
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1a
jb 0x180049d31
mov byte [rdx + 0x1b], r8b
lea rax, [rdx + 0x1a]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x180049d6e
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040d10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051a60
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180049d90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xd], sil
je 0x180049dc3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x180049db0
mov byte [rdx + 0xd], sil
lea rax, [rdx + 0xc]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049ded
mov r8d, recv
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x15], 0
je 0x180049e13
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x14
jb 0x180049e00
mov byte [rdi + 0x15], 0
lea r8, [rdi + 0x14]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049e41
mov r8d, reloc.WS2_32.dll_sendto
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049e50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1e], r8b
je 0x180049e84
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1d
jb 0x180049e71
mov byte [rdx + 0x1e], r8b
lea rax, [rdx + 0x1d]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x180049eae
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040d10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051770
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180049ed0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1b], sil
je 0x180049f03
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1a
jb 0x180049ef0
mov byte [rdx + 0x1b], sil
lea rax, [rdx + 0x1a]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049f2d
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x180049f53
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x180049f40
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049f81
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret