joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180049ab0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x180049ae3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x180049ad0
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049b0d
mov r8d, 7
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x14], 0
je 0x180049b33
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x13
jb 0x180049b20
mov byte [rdi + 0x14], 0
lea r8, [rdi + 0x13]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049b61
mov r8d, reloc.WS2_32.dll_send
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049b70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1a], sil
je 0x180049ba3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x19
jb 0x180049b90
mov byte [rdx + 0x1a], sil
lea rax, [rdx + 0x19]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049bcd
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x180049bf3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x180049be0
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049c21
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049c30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x16], sil
je 0x180049c63
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x180049c50
mov byte [rdx + 0x16], sil
lea rax, [rdx + 0x15]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049c8d
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x180049cb3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x180049ca0
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049ce1
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049cf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x180049d23
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x180049d10
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049d4d
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040f40
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0x11], 0
je 0x180049d73
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180049d60
mov byte [rdi + 0x11], 0
lea r9, [rdi + 0x10]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180049da1
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r10
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049db0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x32], sil
je 0x180049de3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x31
jb 0x180049dd0
mov byte [rdx + 0x32], sil
lea rax, [rdx + 0x31]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049e0d
mov r8d, Ordinal_50
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x30], 0
je 0x180049e33
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x2f
jb 0x180049e20
mov byte [rdi + 0x30], 0
lea r8, [rdi + 0x2f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049e61
mov r8d, Ordinal_50
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049e70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180049ea3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180049e90
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049ecd
mov r8d, recv
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x180049ef3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180049ee0
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049f21
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049f30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1b], r8b
je 0x180049f64
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1a
jb 0x180049f51
mov byte [rdx + 0x1b], r8b
lea rax, [rdx + 0x1a]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x180049f8e
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040f40
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051cf0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180049fb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xd], sil
je 0x180049fe3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x180049fd0
mov byte [rdx + 0xd], sil
lea rax, [rdx + 0xc]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a00d
mov r8d, recv
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x15], 0
je 0x18004a033
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x14
jb 0x18004a020
mov byte [rdi + 0x15], 0
lea r8, [rdi + 0x14]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a061
mov r8d, reloc.WS2_32.dll_sendto
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a070
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1e], r8b
je 0x18004a0a4
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1d
jb 0x18004a091
mov byte [rdx + 0x1e], r8b
lea rax, [rdx + 0x1d]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004a0ce
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040f40
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051a00
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004a0f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1b], sil
je 0x18004a123
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1a
jb 0x18004a110
mov byte [rdx + 0x1b], sil
lea rax, [rdx + 0x1a]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a14d
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x18004a173
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x18004a160
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a1a1
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a1b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x20], r8b
je 0x18004a1e4
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1f
jb 0x18004a1d1
mov byte [rdx + 0x20], r8b
lea rax, [rdx + 0x1f]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004a20e
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040f40
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051990
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004a230
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x18004a263
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x18004a250
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a28d
mov r8d, 0xa
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x13], 0
je 0x18004a2b3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x12
jb 0x18004a2a0
mov byte [rdi + 0x13], 0
lea r8, [rdi + 0x12]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a2e1
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a2f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x38], sil
je 0x18004a323
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x37
jb 0x18004a310
mov byte [rdx + 0x38], sil
lea rax, [rdx + 0x37]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a34d
mov r8d, gethostname
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x40], 0
je 0x18004a373
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x3f
jb 0x18004a360
mov byte [rdi + 0x40], 0
lea r8, [rdi + 0x3f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a3a1
mov r8d, 0x3f
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e490
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xe], dl
je 0x18004a452
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x46]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xd
jb 0x18004a440
mov byte [rbx + 0xe], dl
lea r8, [rbx + 0xd]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004a47f
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rbx
mov rcx, r9
call fcn.180040f40
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004a490
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x18004a4c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x18004a4b0
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a4ed
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a513
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a500
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a541
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a550
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e490
nop
lea r10, [rdi + 0x20]
mov qword [rsp + 0x20], r10
xor edx, edx
cmp byte [rbx + 0x10], dl
je 0x18004a5a2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x46]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xf
jb 0x18004a590
mov byte [rbx + 0x10], dl
lea r9, [rbx + 0xf]
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp rbx, r9
je 0x18004a5cf
mov r8d, reloc.WS2_32.dll_ntohs
mov rdx, rbx
mov rcx, r10
call fcn.180040f40
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004a5e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004a613
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004a600
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a63d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x18004a663
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x18004a650
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a691
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a6a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004a6d3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004a6c0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a6fd
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x17], 0
je 0x18004a723
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x16
jb 0x18004a710
mov byte [rdi + 0x17], 0
lea r8, [rdi + 0x16]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a751
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a760
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x17], sil
je 0x18004a793
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x16
jb 0x18004a780
mov byte [rdx + 0x17], sil
lea rax, [rdx + 0x16]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a7bd
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x18004a7e3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x18004a7d0
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a811
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a820
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x13], sil
je 0x18004a853
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x12
jb 0x18004a840
mov byte [rdx + 0x13], sil
lea rax, [rdx + 0x12]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a87d
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a8a3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a890
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a8d1
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a8e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x12], sil
je 0x18004a913
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x11
jb 0x18004a900
mov byte [rdx + 0x12], sil
lea rax, [rdx + 0x11]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a93d
mov r8d, reloc.WS2_32.dll_recvfrom
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a963
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a950
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a991
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a9a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1a], sil
je 0x18004a9d3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x19
jb 0x18004a9c0
mov byte [rdx + 0x1a], sil
lea rax, [rdx + 0x19]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a9fd
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x26], 0
je 0x18004aa23
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x25
jb 0x18004aa10
mov byte [rdi + 0x26], 0
lea r8, [rdi + 0x25]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004aa51
mov r8d, Ordinal_41
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret